Privacy, Security & Government Surveillance

This will go on as long as the government is awash in money.

Google is promoting its “privacy tips” video series. As I’ve noted before, this is good stuff. Over the long haul, education will be much more effective protection for consumers than privacy regulation – and it will have none of the costs of regulation in wasted tax dollars, market-distorting rent-seeking, and regulatory capture.

Conflict of interest warning!: I was a guest of Google at the recent International Association of Privacy Proffessionals dinner. As you weigh the credibility of what I’ve written here, you are welcome – indeed, encouraged – to consider the embarassingly close relationship I have with Google – how I basically survive on the rubber chicken dinners they sneak me once every . . . 40 years. If it appears that I am being too nice to Google, you are welcome to call me out on it. It is much more fun being mean, but it is important to be fair, so I do say nice things when I see good being done. Now that my disclosure is longer than the substantive post, I’m relatively sure that I won’t be regarded as easier than an FTC Commissioner after an Aspen Summit – at least not this time.

If you’re in D.C. and a lawyer or legally-minded, that’s two strikes against you you might be interested in attending the Third Annual Homeland Security Law Institute, January 17-18, 2008 at the L’Enfant Plaza Hotel in Washington, DC.

This program provides a comprehensive look at some of the most critical issues and initiatives being undertaken as part of the Nation’s Homeland Security agenda. We have an impressive group of former DHS employees, as well as key figures from the private sector. Keynote speakers include The Honorable John Ashcroft, Former Attorney General of the United States, and The Honorable Congressman Bennie Thompson, Chair of the House Committee on Homeland Security.

I’ll be speaking on a panel Friday the 18th entitled: Immigration Policy and Legal Issues: Do All Roads Lead to a National Identity System and if so What are the Implications?

I’ve been invited to participate in a panel at Princeton’s “Computing in the Cloud” conference on January 14-15. The topic of my panel will be:

In cloud computing, a provider’s data center holds information that would more traditionally have been stored on the end user’s computer. How does this impact user privacy? To what extent do users “own” this data, and what obligations do the service providers have? What obligations should they have? Does moving the data to the provider’s data center improve security or endanger it?

This is an interesting and open-ended question, and one about which I don’t have a lot of settled opinions. I’ll be speaking alongside two law professors, so I’ll probably leave any legal analysis up to them and focus more on policy or technology issues. I’ve written about this in the context of Facebook over at Techdirt; those posts may make a good starting point for my contribution to the panel.

But I’m curious what TLF readers think about these questions. And in particular, what are the must-read articles or papers on the subject?

It looks like it’ll be a fascinating couple of days, so if you’re in the area, be sure to sign up so you get some free lunch.

Amid Op-Eds and news stories today decrying REAL ID and illustrating its defects, DHS assistant secretary for policy development Richard Barth steps up to defend the national ID law.

Real ID is not a national identification card. Under Real ID, the federal government will not be issuing licenses or IDs, nor will it collect information about license or ID-card holders.

To which the commenters reply:

“Oh….a Bush Toadie… What a load of (inappropriate term)!”

“If someone from the Department of Fatherland Security says it…I believe it!!”

“I think that using your public office to lie should be a punishable offense. I would also say, the comment ‘The Real ID is not a National ID’ should get this man about 3 Years, maybe 2 with good behavior.”

Pity poor Richard Barth.

Wow. This is some really bad poetry, but it’s a pleasure to read.

Terrorism is a strategy used by the weak to goad the strong into self-injurious overreaction.

DownsizeDC has a campaign underway that I think is critical to defeating terrorism. It’s described on their site this way: “We’re looking for a few brave Americans to start a real war on terror — by not being afraid!”

The “I am Not Afraid” campaign is not about passing or killing any legislation. It is just to get Washington, D.C.’s consistent overreaction to the threat of terrorism under control. The sense of proportion this campaign seeks to create really makes it worth a visit, but here’s a taste:

Nearly 800,000 people have died in car accidents in the last twenty years. During that time there have been exactly two Islamic terrorist attacks on U.S. soil, with less than 3,000 total fatalities. That’s more than 200 TIMES as many Americans dying in their cars as at the hands of Islamic terrorism. And yet . . .

We’ve turned the whole world upside down in response to the two terrorist attacks. We’ve launched invasions, created vast new bureaucracies, shredded the Bill of Rights, compounded regulations, spent hundreds of billions of dollars, and disrupted travel and commerce. But no one is suggesting that we do 200 times as much to address the driving risk, which is 200 times greater.

Terror warriors, keep your straw men in the barn. This is not a pacifist, terrorism-denial campaign. It seeks proportional responses to threats, and acceptance of harms that cannot reasonably be prevented. The message to legislators:

“I am not afraid of terrorism, and I want you to stop being afraid on my behalf. Please start scaling back the official government war on terror. Please replace it with a smaller, more focused anti-terrorist police effort in keeping with the rule of law. Please stop overreacting. I understand that it will not be possible to stop all terrorist acts. I accept that. I am not afraid.”

This is good, important work to defeat terrorism.

Over at Ars, Julian sums up the state of the legislative battle over domestic eavesdropping:

The current wrangling continues a debate that began this summer with the hasty passage of the Protect America Act in response to a ruling by the FISA court—a ruling which the court has declined to release, but which is purported to have required intelligence agencies to acquire warrants when wiretapping conversations between foreign parties that were routed (and recorded) through US telecom switches. Eavesdropping on purely foreign communications had previously been unrestricted—primarily because, traditionally, the physical tap on foreign-to-foreign calls had occurred overseas, outside US jurisdiction. But the Protect America Act, which is due to expire in February, went beyond merely closing this “intelligence gap” and authorized a broad program of surveillance, under minimal court oversight, that permits Americans’ conversations with foreigners to be collected, so long as the American party to the communication was not “targeted” by an investigation. The bills now under consideration seek to establish a more permanent solution: the Intelligence Committee version of the FISA Amendment would remain in effect for six years, while the Judiciary Committee version sunsets in four. While media attention has focused largely on the question of immunity for telecom firms, the additional limitations on surveillance contained in the Judiciary Committee’s version of the bill are, arguably, at least as significant. That bill would explicitly bar “bulk” or “vacuum cleaner” surveillance of international telecom traffic that is not directed at a particular person or telephone number. It would require individualized FISA court review whenever the collection of an American’s communications became a “significant purpose” of an investigation, whether or not that person was a “target” of the investigation. And it would provide for a congressional audit of past extrajudicial surveillance by the National Security Agency.

It’s a little depressing that the debate in the Senate will be between a bill that will do a significant amount of damage to civil liberties and one that will do a great deal of damage to civil liberties. As I understand it (although I haven’t read the Senate bills closely) the House version is better than either Senate bill, although even that is far from an ideal bill. Neither house appears to have seriously considered legislation that simply permitted warrantless surveillance of foreign-to-foreign communications as they passes through the United States, which is ostensibly the reason this legislation was needed in the first place.

Poor Stewart Baker. He’s the DHS policy guy who has been pushed forward to argue that signing “MOUs” (memorandae of understanding) with one or two states overcomes the dozen+ states that have passed legislation opposing or rejecting the REAL ID Act.

It’s true that REAL ID has had a good couple weeks. Arizona’s Governor claims to have signed up her state – oh, except for everyone from the ACLU to the John Birch Society saying “Hell NO!”