So a few weekends ago, I attended the American Constitution Society’s National Convention.
I decided it would be a great opportunity to practice liveblogging. Unfortunately, in the bowels of the Captiol hill Hyatt, there was no wireless access. So, for one panel, I wrote in a Word document as if I was live blogging, and I now post it.
All I’ve cleaned up to post here were typos. I’ve never done it before, so it’s probably more of an attempt to write a transcript than it is to react to the panel. The ACS website should have the video up soon, so if you watch it, you cen tell me if I did a good job.
–Adam
Panel discussion – hosted by the Separation of Powers and Federalism Issue Group
“The End of Anonymity? Threats to Privacy in a Brave New World”
Participants:
Jeff Rosen: (JR) – moderator
Marcy Wilder: (MW)
Melissa Ngo: (MN)
Leslie Harris: (LH)
Orrin Kerr: (OK)
Bios available here:
JR: (opens) Welcome and thank you for coming.
Privacy advocates like to predict the imminent end of privacy, usually in alarmist terms but it is true we have seen many new threats to privacy in the last 8 years
Scandals, wire-tapping, national security, Patriot Act, ISP release of search terms, the Kosinski scandal.
The issue is widespread, and will be part of the presidential campaign
Introduces panel.
Let’s jump in with threats to privacy in private sector
We live on line, and our activity there tends to be aggregated, whether by google or others.
To LH: “What is the greatest threat to privacy in terms of data collection by ISPs and what can govt do?
LH: we are operating in a digital universe with out of date legal standards (20 years)
Over the last 8 years, there’s been a focus on Nat. Sec and the debate has been over the laws there.
Traditional 4th amend, standards are so eroded, in that most existing law predates the web.
So for any issue we discuss, our context has far outstripped the law
ISPs used to be seen as telephony carriers, with common carriage laws
Now ISPs are info services, and have tech to deconstruct packets, and are required under Calia to do that.
ISPs are trying to commercialize and value the data streams they have access to.
Behavioral advertising is happening already out there in the Internet cloud
“Profiling” in conjunction with 3rd P advertisers
“Probably violates the electronic comm. Privacy act but it never anticipated that
There is strong pressure from govt. and from rights holders to forensically examine the datastreams (DRM, DMCA, etc)
For example, in conjunction with the child porn searches
ISPs are in a different place than 25 years ago, from what people signed on for
JR: Concretely, what can this audience fear from this world? There are those who say there’s not much to worry about
Leaked search terms? What is it?
MN: It has to do with the belief that personal information can be gathered and reused
Yes, they [ISPs] gather and search your personal info.
Info is gathered and possibly kept. But what do they do with it, and who has access?
The DoJ came to the search engines a few years ago and asked for all the search terms from a 2 month period.
All but Google complied. Lawsuit ensued.
Website were turned over, but not search terms
Court held there was an expectation of privacy in the info.
Is that the info you really want out there?
AOL searches included personal (medical) searches
People don’t want that type to be reused or repackaged
JR: Orin, you’ve been a skeptic of privacy hysteria. Is MN right? What about Yahoo complying with Chinese requests
OK: Let’s break it down a bit
1) Search terms and what happens to them
2) ISPs who transmit search terms
Orrin is worried about #1,, but not #2.
No search engine privacy law, but there should be.
Google should not keep search terms in a way that could be obtained by a subpoena
That info should be protected.
Govt. has been hands off about search terms, practical difficulties in linking IP addresses and search terms.
Govt would rather search hard drives.
But search terms can be invasive, and the judge handled it well
Theres a need for an ECPA type act for search terms and search companies like Google
Not worried about ISP since terms are content, and the rules are the same for them as they would be for reading emails, eg. Stronger protections exists
JR: The panel has IDed a real danger, and a solution, the search term privacy act
Marcy, tell us about the politics of privacy, if such a bill were proposed.
Privacy tends to be bipartisan, ands Clinton / Gore supported Patriot Act terms
Given the different ACLU ratings of Obama and McCain, how would they handle such a bill?
MW: the politics of privacy will be contextually dependent
Nat sec. will see a big difference on McCain and Obama, but no difference on health care
On the health side: everyone agrees that health care info data bases will have many positive effects, but privacy concerns are a roadblock. No one knows what to do.
The biggest threat in health care and everywhere else is a lack of transparency and a lack of knowledge
What the heck is actually going on?
Most of what is happening is opaque, and to have good rules, we need to shine the lights in, and that is not in the interests of the people doing the looking.
Users are blissfully ignorant, as long as their experience is good.
Health records: digitization will be good in practice / theory, easier to read, understand and share.
But “behind the curtain” is a mystery.
We don’t know what will happen?
Who will have access? Employers? Is medical ID theft an issue?
Easier to share means easier to steal.
The real question is “what should the rules be, and what is the role of consent and consumer control. I’d say, not so much
JR:
I want to press on the political question, since Obama is, for example calling for the return of habeas. Would Obama propose such a bill?
LH: Obama has already got some net cloud privacy proposals in his platform.
But I don’t want to pass Orrin’s bill.
Search is much too narrow. We live online, and hat needs ot be protected is any oinfo stored on line.
The short version is that online info is treated as business records with no expectation of privacy
Whether it’s flickr, or gmail or, GPS phone data or what have you.
It’s all stored behind low legal walls, so think broader.
Consent is a very weak protection
Internet consumers by and large don’t understand about cookies and opting out.
To make the consumer bear the burden is a mistake-
Clickwrap agreements, ToS
JR: OK, defend your bill, and also tell us your ideal govt. surveillance bill.
What would you suggest to a Pres. McCain?
OK: the govt surv. Problem is so broad.
Surveillance is a category not a thing.
We are moving to a networked environment where surveillance will be situationally dependant
I see my law as a restricting govt. acess. I’d like to see a ban on private access to search terms
Recent legal developments have shown that there is bette rprotection than we thought we had
a) 4th Am. Expectation in stored content – a Rorschach decision?
b) MA court finding reasonable expect of privacy in picture files stored behind a password on Sprint site
Virtual online homes storage spaced can be private and enjoy 4th protections.
So there is more protection emerging, at least with respect to content
On consent: If people consent to monitoring, that’s Ok as long as the consent is knowing
We do need consent in fact. No burying it in a long list of terms.
Real notice must be provided, and if it is then consent is OK
JR: Melissa, narrower or broader privacy laws? Are judges better than congress / th epresident at protecting privacy?
Where will you put your faith and why?
MN: tough question, and context dependent.
For example the war atmosphere clouds perceptions of what are acceptable levels of privacy
Which cases reach judges is relevant
Employment verification systems
DHHS wants employers to run employee data against the DHS database
Problem is: DGS and other agencies have admitted that their databases are wrong.
(Debate rages) Some say it is not a big deal, MN is not confident about the abilitiy of the bureacracy to solve problems. Personal anecdote about flawed citizenship status
A lot of hoops for her to jump through to solve someone else’s problem, even assuming she had the wherewithal to do so.
Most citizens don’t have the time or ability to spend days/ weeks/ months to solve red tape to keep jobs.
JR: Marcy, on health care privacy in the next administration, where will you put your faith?
MW: Congress. We want health care tech to move forward
People don’t agree on reimbursement reform or universal health care, and so focus on IT because everyone is onboard
Everyone wants data on line for good reasons, and everyone wants protections
Look for movement on HIPA regs in 2009.
They are 10 years old and need updating. Either BO or JMc will support this
“unifying moment”.
JR: on to nat. sec. privacy and surveillance
Obama has criticized it, McCain has waffled, most recently supporting tapping
Orrin, what does Mc Cain look like on this topic?
OK: (political disclaimer)
Supports the Protect America approach, but thinks the legislation was poorly written.
Basic idea as understood, we can monitor without oversight anyone outside the US with no inside contacts.
The idea is good.
The FISA court should be involved as to methodology
Constitutional law questions at stake.
“What is presidential power?”
But the area of disagreement is narrow, and tend to be about “types of court orders”
JR Orrin, is it right that everyone agrees that warrantless surveillance of U.S. citizens is bad?
OR: If that happened, it’s bad.
JR: how are our liberties being eroded, Leslie?
LH Orin is right that everyone agrees that external people can be tapped with FISA guidelines.
The real issue is how can we tap Americans as part of that process
Civil liberties community is split.
Most think a full FISA warrant is necessary, and even that might be a rubber stamp.
What should the FISA court’s role be, and what will be done with the data
I’m skeptical about the level of protection that will emerge from the deal being cut on FISA right now.
JR: Obama has criticized the FISA deal, is there any chance he’d get into this?
LH: I would not advise Obama to get into that right away. Other issues.
The FISA deal is six years. A problem
Obama may and should get to it later, but not off the bat. Too potentially damaging.
LH would prefer a two year bill, to allow for natural evolution
JR: what is the concrete threat of the FISA compromise? How are Americans endangered
LH: Americans will be targeted outside established rules for such surveillance.
The original purpoise of the court is being undermined. It will allow end-runs
The court is written out of its core purpose.
MN: last she saw was the proposal that included telecom immunity
LH: now they’ll have to go back to the court to show that the US told them it was legal
Case will not be dismissed out of hand
In each one they will have to go and show the court that the govt told them [telecoms?] it was legal
MN: the biggest question is, if you give the telecoms retroactive immunity, and do not investigate what happend, is that saying that Congress and the Administration is Ok with companies breaking the law because the govt told them to.
That’s one of the biggest discussion on telecom immunity. Should that happen, or should we shine some light in?
JR: final thoughts on NSA? OK.
Turning to the future, we need to scare the audience
Scenario: surv cameras
British style in NYC and DC
Google says that in 10 years those feeds will be on Google, or at least requested.
I.e. you’ll be able to click through a google search and get a live feed.
That is, like google streets, but live.
This will be ubiquitous real time surv.
What should be done?
LH: add to that, that everyone will have some sort of location device [GPS] there wil be real time tracking via GPS or RFID, or Onstar or whatever
Complete record will exist that will allow us to see hwere you are and what you are doing?
JR: why should we be upset?
“we already have zero privacy, get over it” right?
LH: posting on line, the no-privacy generation. Start to care after they leave school
Privacy spectrum:
Only matters when there is a concrete harm, or think it is an inherent right with personal control.
Starting from the latter means the above scenario is awful.
From the former means wait and see what harms develop.
Massive govt profiles?
Is Orrin right, and that we will see more case law saying that stored data will have protections?
We may need wholesale changes to the legal regimes, and all pressures are in the other direction.
All the associated panopticon / big brother problems
MW: this is all happening now to some extent.
No privacy? So what? That’s the attitude of the new generation
What is creepy is the loss of control by individuals
Laws are stepping up to control and limit the govt.
The private sector is becoming increasingly relevant, and may be more
We need to describe specifically and concretely what we don’t like
“ick factor” is not a policy argument
We need to discuss the issue in terms of pros and cons
Bigger question: once we talk about this, can it be stopped at all?
Tech is driving this in a way that the law cannot keep pace with.
JR: Orrin, in the panopticon world, is it a problem? Will you go this far and assent?
and what can be done?>
OK: I think this would be terrible. No good reason to do it.
Who is behind it is critical.
If govt. we could pass laws against it.
If companies, we can regulate, and take consumer initiatives “bad for business”
Privacy tends to be good for business.
Public opposition will make it tough for business to do things.
Economic interests, or relection interests make institutions vulnerable to laws and regulations.
JR: how likely is this outcome?
Even the young were upset by Beacon on Facebook.
Will even the netizens be appalled by the cameras?
LH: the face book people should not have been so shocked, and were only able to see what happened because they were in a distinct community.
John Q will not be able to see what’s happening until it is too late, and further, won’t be able to do anything about it.
People tend toward apathy and technological inability
People don’t even kill 3rd party cookies.
The answer, at least in part, is to give people more control and transparency with tech.
JR: MN, can you respond to the point about tech, and it being too late?
Where is your faith?
MN: it’s difficult. People say tech is OK because they think that if the enabled behavior was illegal, then the etch wouldn’t be there. That is, since it’s possible, it must be OK.
There are attacks on privacy every day.
Leslie is right, people do not want to use privacy enhancing tech.
Companies losing unencrypted data, even though encryption is a basic.
People don’t do it because it is a little hard and time consuming.
May steps, rather than “hard”
People would rather believe that if they do nothing wrong they have nothing to worry about.
But in this day and age, merely to refuse to allow one’s data to be observed is to be under suspicion.
Instread of playing catch-up, we need people to assert control and learn procedures and protections, and we also need standardized protections on the outside that everyone can benefit from.
JR: what is a comprehensive strategy that could unite good law, technology and decisions.
How optimistic are you?
MW: I see an emergence of legislation as well as emergence norms.
The internet’s ability to unite people, in participatory communities and to increase transparency is good and will help.
The more transparency there is, earlier on, the more likely there will be an appropriate reaction.
We need to educate people more about the coming types of invasions.
QUESTIONS:
On consent: what info does the average consumer need to give reasonable consent to a service, and how will new services change the need to re issue consent?
LH: online consent has not worked. Most people think privacy policies mean no data is collected.
Meaningful consent in that context needs:
A way to provide enough enough info so people understand what is happening.
e.g. cookies.
Have to understand the legal framework and the long-term consequences of storage
I haven’t seen that work.
It would have to happen everywhere.
Further ToS could not include a right to modify, and would have to include a right to revoke.
Recall that the issue involves tertiary or even quaternary level actors.
To whom is permission being given? What are the secondary uses?
Consent is therefore inadequate
MW: the answer is that there needs to be a standardization of formatting for consent.
They need to be short and understandable, not mortgage documents
So how do we do that? [CC model?]
Second, consent is meaningful up to a point
Healthcare example: I consent to use of my info so provider can be paid.
What that really means is that the care provider will send the info through various entities.
Each middle man may abstract and sell data, always for different reasons.
Pharmacy reminders, quality control, etc.
Payment means many many things.
And the consumer doesn’t really have a way to consent to any or all of that.
Once data is “out” it will be copied many times, and it’s out forever.
We need to standardize, yes, but make consent meaningful
OK: I love standardization,. Analogizes CCommons. Understandable.
Consumer choice
[enforcement?]
JR: youtube has discovered that people don’t read policies, but will watch videos
Question: returning from out of the country traveler (even if US citizens) have no 4th amendment rights
9th circuit ruling about laptop contents being searchable.
Has tech outstripped the Constitution? Clearly no founding father intent
Do we need a Constitutional Amendment for privacy?
OK: a very hard question..
What should the rules be? Many feel that typically, it is outrageous to search a laptop without any prior cause, and just border crossing should not be enough.
On the other hand, we’d like to be able to stop people smuggling informational contraband.
Bottom line: no one knows where to do.
As for an amendment, this would be hard, because what would it be.
No agreement community wide as to what the rules should be.
The action will be with statutory change. And a hearing is being held on 6/25
MN: what is your laptop to you? Is it a book, or is it your journal, your crystallized thoughts?
the standard should be high, high enough to justify an invadion of the mind
tech’s answer is “scrubbed” laptops and VPN servers.
Also, encryption. Perhaps even multiple levels.
Of course, few people will multiply encrypt hard drives
But tech is not going to help for the reasons above, so we need legislation, or an amendment
JR: why an amendment? Who doesn’t think this is invasive? Why is the 4th amendment enough?
LH the 4th is adequate, but it is not being interpreted correctly.
Business records cases fomr the 1970s are inapposite.
If you don’t have a cognizable privacy inetrest, and 3rd parties have your data, there is no need to develop jurisprudence because too many parties have no interest in challenging the status quo.
Agreed, though that statutory solutions are needed.
We need to stop reacting to the outrage of the month and legislating the “last war”.
So our laws are out of date.
So, we have the potential protections in place, we just need to use them.
QUESTION: what is the panels best estimate of the liability resulting from the wiretapping [telecoms] is there personal liability for officials? And if so to the latter, why not?
OK: the question is, suing someone for a constitutional right violation has many procedural hurdles.
4th amendment problems in terms of proving search.
Qualifies immunity, etc all interfere with resolution on the merits.
QUESTION immunity. Why haven’t we learned from history, e.g Nuremburg?
Why are we even considering allowing a “I was just following orders” defense now?
Why can’t we say that the waiver in the white paper is invalid
OK: there is a legal proposition that says govt permission make it OK.
JR: why is it so important to immunize the telecoms?
OK: hard to say where people are coming from?
Is it a desire to avoid costly lawsuits where the point is discovery, not damages?
I.e. the real goal is unrelated to the ostensible purpose of the suit?
The appropriateness of the govt.’s activity?
Doesn’t think the immunity deal changes much since state Secrets will kill it all anyway.
QUESTION for Leslie: aside from the harmful aspects, do you really think people care about privacy?
Analogy of being overheard on the phone. People give away all kind s of stuff.
People only care about privacy when it hurts them.
LH cultural norms changing from privacy towards exhibitionism.
People are oblivious until things become transparent, and then they are surprised.
Why are people so shocked that the cops look at their facebook page?
People have different sets of expectations depending on the situation.
Health care is different for that reason
MN: Less pessimistic that we are doomed.
As more and more incidents happen, and people see that they aren’t private, and that they can be exposed, they will adjust their behavior.
They’ll realize, that unlike they think they have now, they have no control over digitally released information.
People will step back and try to make things “private private”