Privacy, Security & Government Surveillance

Futurists have been predicting for years that there will be diminished privacy in the future, and we will just have to adapt. In 1999, for example, Sun Mcrosystems CEO Scott McNealy posited that we have “zero privacy.” Now, Wall Street Journal columnist Gordon Crovitz is suggesting that technology has the “power to rewrite constitutional protections.” He is referring to GPS tracking devices, of all things.

The Supreme Court is considering whether it was unreasonable for police to hide a GPS tracking device on a vehicle belonging to a suspected drug dealer. The Bill of Rights protects each of us against unreasonable searches and seizures. According to the Fourth Amendment,

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

In the case before the Supreme Court, U.S. v. Antoine Jones, the requirement to obtain a warrant was not problematic. In fact, the police established probable cause to suspect Jones of a crime and obtained a warrant. The problem is, the police violated the terms of the warrant, which had expired and which was never valid in the jurisdiction where the tracking occurred. Therefore, first and foremost, this is a case about police misconduct. Continue reading →

This week I will again be attending the Family Online Safety Institute’s excellent annual summit. The 2-day affair brings together some of the world’s leading experts on online safety and privacy issues. It’s a great chance to learn about major developments in the field. As I was preparing for the session I am moderating on Thursday, I thought back to the first FOSI annual conference, which took place back in 2007. What is remarkable about that period compared to now is that there was a flurry of legislative and regulatory activity related to online child safety then that we simply do not see today.

In fact, just 3 1/2 years ago, John Morris of the Center for Democracy and Technology and I compile a legislative index [summary here] that cataloged the more than 30 legislative proposals that had been introduced in the the 110th session of Congress. There was also a great deal of interest in these issues within the regulatory community. Finally, countless state and local measures related to online safety and speech issues had been floated. Today, by contrast, it is hard for me to find any legislative measures focused on online safety regulation at the federal level, and I don’t see much activity at the agency level either. I haven’t surveyed state and local activity, but it seems like it has also died down.

Generally speaking, I think this is a good development since I am opposed to most proposals to regulate online speech, expression, or conduct. But let’s ignore the particular wisdom of such measures and ask a simple question: What explains the decline in Internet safety legislation and online content regulation? I believe there are three possible explanations: Continue reading →

I highly recommend this important new study on “Why Parents Help Their Children Lie to Facebook about Age: Unintended Consequences of the Children’s Online Privacy Protection Act” by danah boyd of New York University, Eszter Hargittai from Northwestern University, Jason Schultz from University of California, Berkeley, and John Palfrey from Harvard University. COPPA is a complicated and somewhat open-ended law and regulatory regime. COPPA requires that commercial operators of websites and services obtain “verifiable parental consent” before collecting, disclosing, or using “personal information” (name, contact inform­ation) of children under the age of 13 if either their website or service (or “portion thereof”) is “directed at children” or they have actual knowledge that they are collecting personal information from a child.

The new study, which surveyed over 1,000 parents of children between the ages of 10 and 14, reveals that, despite the best of intentions, COPPA is having many unintended costs and consequences:

Although many sites restrict access to children, our data show that many parents knowingly allow their children to lie about their age — in fact, often help them to do so — in order to gain access to age–restricted sites in violation of those sites’ ToS. This is especially true for general–audience social media sites and communication services such as Facebook, Gmail, and Skype, which allow children to connect with peers, classmates, and family members for educational, social, or familial reasons.

The authors conclude that “COPPA inadvertently undermines parents’ ability to make choices and protect their children’s data” and that their results “have significant implications for policy–makers, particularly in light of ongoing discussions surrounding COPPA and other age–based privacy laws.” Indeed, this paper could really shake up the debate over online kids’ privacy regulation. I will have more analysis of the paper in my weekly Forbes column this weekend.

Additional reading for COPPA background and current controversies: Berin Szoka & Adam Thierer, “COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free Speech,” (May 21, 2009); and Adam Thierer, “Kids, Privacy, Free Speech & the Internet: Finding the Right Balance,” (August 12, 2011).

TechFreedom is calling on all Americans to stand up for their digital Fourth Amendment rights. The Constitution delicately balances privacy with the needs of law enforcement by making judges responsible for determining whether law enforcement has established ‘probable cause.’ This judicial warrant requirement has always been the crown jewel of our civil rights. Our Founding Fathers would be appalled to learn that this fundamental principle does not extend to our electronic communications and location. After all, they fought–and won–a revolution to prevent similar abuses by British authorities.

TechFreedom has joined with a philosophically diverse coalition of public interest groups in supporting the “Not Without a Warrant” grass-roots petition, which reads as follows:

The government should be required to go to a judge and get a warrant before it can read our email, access private photographs and documents we store online, or track our location using our mobile phones. Please support legislation that would update the Electronic Communications Privacy Act of 1986 (ECPA) to require warrants for this sensitive information and to require the government to report publicly on the use of its surveillance powers.

Today marks the 25th anniversary of ECPA’s passage. Anyone can sign the petition at NotWithoutAWarrant.com or show their support by liking the Facebook version.

TechFreedom Senior Adjunct Fellow Charlie Kennedy spoke at a Cato Institute event on Wednesday about modernizing ECPA. The video is archived here.

On the podcast this week, Simon Chesterman, Vice Dean and Professor of Law at the National University of Singapore, and Global Professor and Director of the NYU School of Law Singapore Programme, discusses his new book, One Nation Under Surveillance: A New Social Contract to Defend Freedom Without Sacrificing Liberty. The discussion begins with a brief overview of the NSA and how it garnered the attention of Americans after 9/11. Chesterman discusses the agency’s powers and the problems the NSA encounters, including how to sort through large amounts of data. The discussion then turns to how these powers can become exceptions to constitutional protections, and how such exceptional circumstances can be accommodated. Finally, Chesterman suggests that there has been a cultural shift in western society, where expectations of privacy have dimished with technological and cultural trends, so that information collection by the government is generally accepted. However, he says, society is concerned with how that information is used. According to Chesterman, there should be limits and accountability mechanisms in place for government agencies like the NSA.

Related Links

To keep the conversation around this episode in one place, we’d like to ask you to comment at the webpage for this episode on Surprisingly Free. Also, why not subscribe to the podcast on iTunes?

While policymakers rush write new Net regulations to protect privacy, we keep suggesting the FTC use its existing authority more effectively to punish unfair and deceptive trade practices. The FTC has just sued FrostWire for designing their peer-to-peer software to trick users into oversharing:

FrostWire for Android… was likely to cause a significant number of consumers installing and running it on their mobile computing devices to unwittingly share files stored on those devices.  The Defendants had configured the application’s default settings so that, immediately upon installation and set-up, many pre-existing files on the mobile device were designated for sharing.  These files could be shared through the Internet, and through any given… WiFi… network… with other FrostWire for Android users…  These shared files thus were available to other people in the consumer’s immediate vicinity and throughout the world to download and share further. Nothing in the installation and set-up process… adequately informed consumers of the immediate consequences of installing FrostWire for Android; nor could consumers be expected to know these consequences from any prior experience with other software.

The FTC has made a pretty good case that this qualifies as an unfair practice:

Under Section 5(n) of the FTC Act, an act or practice is “unfair” if it causes or is likely to cause substantial injury to consumers that is not reasonably avoidable by consumers and is not outweighed by countervailing benefits to consumers or to competition

In particular, the FTC notes the potential harms caused by inadvertently sharing all the files on your phone: Continue reading →

In his latest weekly Wall Street Journal column, Gordon Crovitz has penned a review of the new Jeff Jarvis book, Public Parts: How Sharing in the Digital Age Improves the Way We Work and Live . Gordon’s review closely tracks my own thoughts on the book, which I laid out last week in my Forbes essay, “Is Privacy Overrated?”  Gordon’s essay is entitled “Are We Too Hung Up on Privacy” and he finds, like I do, that Jarvis makes compelling case for understanding the benefits of publicness as the flip-side of privacy. Instead of repeating all the arguments we make in our reviews here, I’ll just ask people go check out both of our essays if they are interested.

I did, however, want to elaborate on one thing I didn’t have time to discuss in my review of the Jarvis book. While I like the approach he used in the book, I thought Jarvis could have spent a bit more time exploring some the thorny legal issues in play when advocates of privacy regulation look to enshrine into law quite expansive views of privacy “rights.”

One of the things that both Crovitz and I appreciated about the Jarvis book was the way he tries to get us to think about privacy in the context of ethics instead of law. “Privacy is an ethic governing the choices made by the recipient of someone else’s information,” Jarvis argues, while “publicness is an ethic governing the choices made by the creator of one’s own information,” he says. In my review, I explained why this was so important: Continue reading →

On Wednesday afternoon, it was my great pleasure to make some introductory remarks at a Family Online Safety Institute (FOSI) event that was held at the Yahoo! campus in Sunnyvale, CA. FOSI CEO Stephen Balkam asked me to offer some thoughts on a topic I’ve spent a great deal of time thinking about in recent years: Who needs parental controls? More specifically, what role do parental control tools and methods play in the upbringing of our children? How should we define or classify parental control tools and methods? Which are most important / effective? Finally, what should the role of public policy be toward parental control technologies on both the online safety and privacy fronts?

In past years, I spent much time writing and updating a booklet on these issues called Parental Controls & Online Child Protection: A Survey of Tools & Methods. It was an enormous undertaking, however, and I have abandoned updating it after I hit version 4.0. But that doesn’t mean I’m not still putting a lot of thought into these issues. My focus has shifted over the past year more toward the privacy-related concerns and away from the online safety issues. Of course, all these issues intersect and many people now (rightly) considered them to largely be the same debate.

Anyway, to kick off the FOSI event, I offered three provocations about parental control technologies and the state of the current debate over them. I buttressed some of my assertions with findings from a recent FOSI survey of parental attitudes about parental controls and online safety. Continue reading →

Yesterday, the Federal Trade Commission (FTC) released its long-awaited proposed revisions to the Children’s Online Privacy Protection rule (the “COPPA Rule”). Below I offer a few brief thoughts on the draft document. My remarks assume a basic level of knowledge about COPPA so that I don’t have to spend pages explaining the intricacies of this complex law and regulatory regime. If you need background on the COPPA law and rule, please check out this paper by Berin Szoka and me: “COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free Speech.”

Dodging the COPA / Mandatory Age Verification Bullet

The most important takeaway from yesterday’s proposal involves something the FTC chose not to do: They agency very wisely decided to ignore some requests to extend the coverage of COPPA’s regulatory provisions from children under 13 all the way up to teens up to 18.  An effort to expand COPPA’s “verifiable parental consent” requirements to all teens would have raised thorny First Amendment issues as well as a host of practical enforcement concerns.  In essence, it would have required Internet-wide age verification of children and adults in order to ensure that everyone was exactly who they claimed to be online. We already had an epic decade-long legal battle over that issue when the constitutionality of the Children’s Online Protection Act (COPA), another 1998 law sometimes confused with COPPA, was tested many times over and always found to be in violation of the First Amendment.

Regardless, the FTC didn’t go there yesterday, so this concern is off the table for now. The agency deserves credit for avoiding this constitutional thicket. Continue reading →

Come hear the other side of the privacy debate! Rep. Marsha Blackburn (R-TN) will lead a discussion among policy experts united by a desire to address demonstrated dangers of data abuse without giving up the value created by data as the vital currency of the digital economy. The Roundtable  is Wednesday, September 14, 8-9:30 am in Congressional Visitors Center Meeting Room North, CVC 268:

The roundtable discussion will cover online privacy issues in anticipation of the final reports to be released this fall by the Department of Commerce and the Federal Trade Commission. Invited participants will consider questions and policy issues related to the value of data, where government should or shouldn’t be involved in regulating online privacy, and alternatives to government regulation. Congressman Blackburn, a member of the House Energy and Commerce Subcommittee on Telecommunications and vice chair of the Subcommittee on Commerce, Manufacturing, and Trade, pledged to conduct a national series of tech industry roundtables in a speech to the Telecommunications Industry Association earlier this year. Her first roundtable was held in late June at the Interactive Advertising Bureau’s new online advertising community center in New York City. Congressman Blackburn also recently wrote an op-ed titled “The FTC’s Internet Kill Switch” that addresses why any proposed privacy regulation must consider the costs of diminished competition and innovation.

I shared my thoughts on Rep. Blackburn’s healthy skepticism of regulation in a CNET editorial in June: On Online Privacy and Avoiding overregulation. The TLF’s Ryan Radia (Competitive Enterprise Institute), Jim Harper (Cato), Larry Downes and I (both TechFreedom) will be there.  Joining us will be Howard Beales (George Washington University School of Business), Daniel Castro (Information Technology and Innovation Foundation), Harold Furchgott-Roth (Hudson’s Center for Economics of the Internet), Tom Lenard (Technology Policy Institute) and Randy May (Free State Foundation)/

Adam Thierer & I laid out our “Principles to Guide the Debate” on online privacy nearly three years ago, asking that those proposing regulation:
  1. Identify the harm or market failure that requires government intervention.
  2. Prove that there is no less restrictive alternative to regulation.
  3. Explain how the benefits of regulation outweigh its costs Continue reading →