Privacy, Security & Government Surveillance

The battle between Google and the Justice Department has not suffered from a lack of coverage. The short story is that DOJ asked (well, “commanded” actually) that Google and other search engines turn over massive amounts of data regarding searches and websites on their systems, to be used in the government’s defense of the Child Online Protection Act. The legal case will be settled based on subpoena law, on which I’m no expert. On policy grounds, however, I’m with Google–which is defending its customers right to privacy. A loss could diminish the public’s trust that their online activity will be kept confidential, and hurt not only Google but the growth of the the Internet itself.

How broad is the DOJ request? Most of the media coverage has focused on its request for data on all searches made over a one-month period. That’s a lot. But its nothing compared to its original request for data on websites. Here, DOJ requested (and I’m not making this up): “all URLs that are available to be located through a query on your company’s search engine as of July 31, 2005.” Let’s repeat that: “all URLs that are available to be located through a query on your company’s search engine as of July 31, 2005”.

Correct me if I’m wrong, but that’s about everything isn’t it? All websites. DOJ wants a list of all the websites in the world. (Well, all that are on Google anyway, which is pretty close). How many is that? If you search “www” in Google itself, you get 9.2 billion results. Were Google to print out this list, say at 50 per page, it would be 184 million pages long. If you laid these pages end to end, it still wouldn’t be a bigger waste of time.

DOJ has since modified its original request, and is now asking for only a million URLs. That’s a lot less, but still a lot.

I’m not saying all such subpoenas should be rejected. There is a legitimate role for the right to subpoena in the legal system, even subpoenas by the government. But given the stakes here, there should be a stiff burden of proof that what is requested is actually what is needed, and no more. “Give me everything” doesn’t meet that burden.

(I recently engaged my former Cato Institute colleague and fellow TLF blogger Jim Harper in a dialog about the effectiveness of U.S. engagement with China in terms of broadening human rights and speech rights in particular. I’ve been doing some soul-searching about this recently and asked Jim to help me think through the issue (and the “engagement is good” theory) again. What follows is the transcript of our e-mail exchange. A condensed version of this exchange also appaers on CNET today. – – Adam Thierer)

THIERER: Jim, I must admit, in recent months I have really been struggling with the issue of U.S. corporate engagement / investment in China. In particular, I have been wondering if my long-held assumption is correct: that greater engagement by U.S. companies in China will really help achieve meaningful reforms for its repressed citizenry. I have always argued that investment by U.S. companies – – and technology companies in particular – – could help break down some of the legal barriers to greater economic and social / cultural freedom.

In recent years, however, the reports from the front have not been good. It does not seem the U.S. corporate engagement / investment has really done much to effectuate positive reforms in the post-Tiananmen era. It seems that the Chinese are just as repressive as ever, especially on the political / cultural front. Worse yet, we know that many large American corporate technology leaders have actually assisted the efforts of Chinese officials when they sought to repress speech and dissent. (Microsoft, for example, has made news recently by shutting down a journalist’s blog because of material that might be offensive to Chinese authorities. And Yahoo and Google are coming under fire for playing ball with Chinese officials too.)

Tell me my fellow libertarian friend, are you not also troubled by these developments? Are you still comfortable with our traditional position on the issue?

HARPER: I recall, a few years ago, being very concerned when I heard that Google had come to an agreement with the Chinese government so that their service would not be blocked there. I had a natural sense of revulsion at the thought that any company, much less one of the technology companies that are doing so much to improve life around the world, would get in bed with censors and despots. Google has never been as forthcoming about what exactly they do to appease the Chinese as I would like them to be, so I suppose I am still uncomfortable with it.

But I have come to believe that the best option for a company faced with this dilemma is to accept the ugly conditions some governments put on doing business in their countries. This is for a couple of reasons: There is strong evidence that refusing trade doesn’t help anybody. The U.S. trade embargo toward Cuba has been a dismal failure. We’ve had some level of trade restrictions with Cuba for more than 40 years and, if anything, it has helped Castro by pauperizing the Cubans, demoralizing them, and shielding them from knowledge about the benefits of freedom. Heck, if we had had trade with Cuba the last 40 years, a steady diet of fast food probably would have killed off Fidel by now…

Just as importantly, if you give them the communications tools that these companies provide, the Chinese people will evade government controls and get done what we want them to get done, censorship or no censorship. You don’t have to use words like “falun gong” or “Taiwan” or “free speech” to communicate about liberty and public issues. Before Vaclac Havel was the first President of a free Czechoslovakia, he was a playwright. His plays weren’t political polemics that tweaked the nose of the government and invited censorship (though he got in plenty of trouble). They were subtle critiques of life under the regime. Everybody knew what he was talking about. Freedom had been in the hearts of the Czechs for years when the Velvet Revolution officially delivered it. Technology and communications are enabling this on a broader scale in China. It’s working. You’ll see.

Continue reading →

Declan McCullagh and Anne Broache at CNET today report on federal agencies tracking web visitors against the rules. It’s not surprising, but it is disturbing. If government wants to increase surveillance in America and argues that we should trust them to follow the rules, then this example puts a huge dent in their argument. If a company made a similar mistake, they’d be facing a fine, but what will happen to the bureaucrats who ignore their public duties?

This is cross posted from Sonia Arrison’s blog.

Big Brother (UK edition)

by on December 21, 2005

Just in time for the holidays, British officials have announced that Santa will no longer be the only one who can find out if you’ve been naughty or nice. The Independent reports the imminent creation of a nationwide network of road, convenience store and other cameras that will be tied into a central database equipped with license plate reading technology. The movements of all cars will be recorded and stored for a period of two years. The ostensible purpose is to gather intelligence and fight terrorism, of course. Truly frightening.

Overall, I’m extremely critical of the Bush administration’s flagrant disregard for civil liberties in the wiretapping controversy. But I think this is an entirely understandable mistake. The New York Times reports that the NSA sometimes accidentally listens in on a domestic call because they mistakenly believe that it to be a foreign call.

As electronic networks become ever more sophisticated and globalized, policymakers are going to face more and more thorny challenges when it comes to regulations that are tied to the “location” where a particular action is taken. Already we see this with telecom regulation, where technologies like VoIP are allowing people to do an end run around 20th century regulations based on the physical location of someone’s phone line. I imagine that sorting out other laws–copyright, fourth amendment, privacy regulations, etc–will become equally difficult as the Internet continues to extend its reach into every aspect of our lives.

Indeed, in the long run, the traditional distinction between domestic and foreign surveillance may be complete eviscerated by the march of technology. After all, it’s trivial to disguise the true origins of a network connection. if terrorists know the NSA isn’t allowed to eavesdrop on domestic communication, they could easily set up a tunnel so that their communications appear to originate on a U.S. network. In that case, would it count as domestic surveillance to eavesdrop on their conversation?

I’m not sure what the right answer is, but it’s a type of question we’re going to hear a lot in the next few years.

(Hat Tip: Julian over at Andrew Sulivan’s blog)

Gadget Hacking – RFID

by on December 14, 2005 · 4 comments

For those who think that consumers will be powerless in the face of the “worldwide RFID infrastructure” ™, I submit: DCist.

Wait. Isn’t DCist that local newsy ‘blog with plenty o’ nightlife information for D.C.-area residents? How could such an airy, lightweight site have anything to do with the privacy onslaught posed by RFID?

RFID is a highly technical challenge that furrows the brows of smart and serious technology analysts and privacy activists. It takes privacy expertise, public policymaking experience, and tech savvy to handle RFID. These things are in short supply among the – sorry to say it – great unwashed . . .

Balderdash.

DCist has posted a brief, entertaining recipe for hacking your Metro SmartTrip card. For entertainment, people are learning about technology. My favorite comment so far: “Big next winter: Smart trip mittens.”

Here’s the significance: Ordinary people are getting access to relevant information about where RFID is and how it works. Ordinary people are fully capable of understanding RFID. Ordinary people will use it to their advantage when they want and decline to use it when they want.

The premise of experts (a premise that serves the expert class quite well) is that people can’t figure this stuff out so they have to be protected from it by law and regulation, after thousands of hearings, meetings, forums, and conferences.

Repeat: balderdash.

This is evidence of what I wrote about some time ago: a variety of social forces will constrain and contain RFID.

There’s a company called Riya that offers software to search personal photos using face recognition technology. Jennifer Granick of Stanford law school wrote a piece about it and its privacy implications, but her take is old and doesn’t see the big picture. Yes, face recognition technology changes society in ways that no longer allows the type of anonymity we have been used to, but that’s not the story here. The news–and it’s GOOD news–is that the government no longer has a monopoly on this piece of surveillance tech. That means the threat of living in a big brother state actually decreases, as it allows anyone to watch the watchers. Moore’s law keeps making technology more accessible and that promotes liberty.

Mayor Gavin Newsom has been pushing the idea of “free WiFi” in San Francisco, but it would be anything but free. The Mayor’s play to grant special status to only one WiFi provider in San Francisco would essentially create a government-controlled WiFi monopoly in SF. There are so many reasons to oppose a government-controlled Internet, that if I listed them all here, you’d be reading all day. To learn more, you can go to the Pacific Research Institute’s (PRI) fact page or you can see links to related data here.

PRI is calling on all San Franciscans to oppose government controlled WiFi. Please go to the PRI homepage and click on the “Fight Government-Controlled Internet in San Francisco” banner up top. This will send an e-mail to Mayor Gavin Newsom expressing your views.

If you join in–and if you pass the word on to your friends and family to join in–it will help to strengthen the voices of the free market and free speech.

Here is a open letter PRI wrote to the Mayor.

This week, I’m debating some folks on data security regulation at CNET News. com. Could be interesting and informative.

So far, the debate has transmogrified, at the hand of News.com’s editors, from data security regulation into “IDENTITY CRISIS” and my first post was provocatively (mis-)named “Why should people trust the industry?” – a question that I think is off-point and needlessly loaded. An inauspicious start but, still, check it out.

Highlight: California State Senator Joe Simitian calls regulating a “duty.”

CAGW on Real ID

by on October 18, 2005

Citizens Against Government Waste has issued a report on the Real ID Act.

This is a welcome look at Real ID. It’s known by civil libertarians as a dramatic step forward for our national ID system, but CAGW points out that it will also be a huge expense, costing the average driver around $90.

Would you pay $90 to be even more subject to government surveillance?

Kudos to CAGW for recognizing the privacy issues while it exposes the huge costs involved in the Real ID Act.