Declan McCullagh, chief political correspondent for CNET and former Washington bureau chief for Wired News, discusses recent leaks of NSA surveillance programs. What do we know so far, and what more might be unveiled in the coming weeks? McCullagh covers legal challenges to the programs, the Patriot Act, the fourth amendment, email encryption, the media and public response, and broader implications for privacy and reform.

Download

Related Links

• Snowden: NSA snoops on U.S. phone calls without warrants, McCullagh
• Snowden: Feds can’t plug leaks by ‘murdering me’, McCullagh
• Feds: Power grid vulnerable to cyber threats, McCullagh

I was struck by the absurd title of a New York Post story from yesterday: Is Your Restaurant Spying on You? Some restaurants are—shocker—making note of your preferences and your qualities as a customer, for good or bad. That’s “spying”?

Of course, headlines are meant to catch attention. The story illustrates a phenomenon that will continue to proliferate, and that will probably continue to raise hackles, classed as “spying”, “privacy invasion”, “dossier building”, and such. People and businesses are more able to capture information about each other than they were before. (It is a two-way street. We consumers know more about businesses, and businesses know more about us.)

That’s a big change from the recent past. Over the past century or so, people got more mobile and thus less amenable to consistent observation—which means less amenable to being affixed with a reputation. Now information systems are catching up. What kind of person you are—a good tipper, a brusque faux gastronome—that information might precede you to a restaurant. Object to it. Call it what you want. But you might also consider getting used to it, tipping better, and being polite.

None of this is a comment on what our public policies should be. They should neither favor this cultural change nor fight it. People need to understand what happens with information about them, and they should be able to withhold information if they want, though that may be hard for privacy outliers to do.

As a student of information, I find it hard to accept that a restaurant noting the information you’ve made available to it is “spying.”

Fellow TLFer Julian Sanchez has written (twice) at Cato@Liberty on the big school-using-laptops-to-spy-on-kids case.

Indulging my contrarian habit, I’m taking a little bit of a different view, though not necessarily an inconsistent one. While it seems error to me that the school district issued laptops with a potentially invasive security system, failing to fully inform parents, I think a lot more facts have to come out before we reach legal conclusions.

I started to feel some contrary comin’ on when I read the lengthy commentary of a parent at the school, posted on a privacy colleague’s Facebook wall. Among other things, she said:

The minor in question is a truly bad kid. [cites supporting facts] He had broken two laptop computers and had been issued a loaner computer with the explicit instructions not to take it off school property. It disappeared from the school and when questioned he told the school it had been stolen from him. There is quite a bit of theft and laptops had been a target. The kids seemed to know about the security system in place, I didn’t know about it which I think was wrong — the school has apologized for this. The school activated the security system realized the computer was in use and the webcam took a still shot. The minor in question was sitting in front of the webcam, the rumor is with drugs. The photo was sent to the police which apparently was standard procedure for stolen property and not related to anything else.

Maybe the “drugs” were Mike & Ike’s candies. The plaintiff’s lawyer says so. (Consider the veracity of a kid explaining things to his parents and their counsel, though, and of a trial lawyer seeking to lead a class action.)

Sugar pills or not, if the laptop is AWOL from school—presumptively stolen—I don’t see that it would be unreasonable to use the security system to discover its location, and the camera to capture images of who is using it. If there are statutes that would prevent that, I think a court would find a way to avoid applying them, be it on the theory that the putative thief assumed the risk of being surveilled, unclean hands, or some other basis.

The reporting and commentary has been a little overwrought. Better facts will determine what law should apply. Parents at the school have started a Facebook group to discuss this and share the rest of the story given that the school district has, well, lawyered up.

I tipped a reporter at an outlet I respect about this parent’s version of events. The reporter was alternately dismissive of sources that weren’t “official” and highly defensive when I suggested that her writing and reporting appeared to be preserving controversy rather than getting to the bottom of things. So much for relying on media—even new media—for getting information out.

Maybe spun-up outrage will cause better policies in this area than would otherwise result. Maybe we’ll learn that the security system was used for routine, inappropriate spying on kids. But as a legal case, there’s a lot more to be learned before we should draw conclusions.

San Antonio too.

Just before the New Year, Mike Masnick reported:

It’s been well over five years since we first heard about a plan in Oregon to attach GPS devices to cars and tax drivers based on how much they drove and the idea hasn’t become any better in the intervening years… but apparently it’s still being pushed. Oregon’s governor is trying to move forward with the plan.  One of the reasons behind the bill has nothing to do with a more efficient way to tax drivers, but because the state is gaining less revenue from its gas tax since there are more fuel-efficient cars on the roads these days. Of course, rather than reward drivers for driving more fuel efficient cars, this sort of tax punishes them, and actually encourages the use of less fuel efficient vehicles. And, of course, that doesn’t even begin to get into the potential (and likely) privacy problems brought about by any system whereby the government has full access to a GPS system on your car.

This is a great example of the problems that often arise when trying to bring into the digital age areas of the economy monopolized or dominated by government.  There’s a clear (if imperfect) analogy here to Obama’s ambitious goal of digitizing health records:  both are great ideas that raise special privacy concerns because of the heavy involvement of government.  These privacy concerns are certainly not unwarranted:  I wouldn’t want the government to have access to my car’s location or my medical history at any given moment or a complete record of where I’ve driven or what doctors I’ve seen.  But just as relying on paper health records is clearly stupid (and dangerous), it would make a hell of a lot more sense for drivers to pay for road use depending on “where, when and how far they drove”—as in a small pilot project in the UK.

Today, state and Federal taxes on every gallon of gasoline are intended to serve two conflicting purposes—but do a poor job with both.  First, the taxes fund the cost of building and maintaining roads.  But the tax provides only a very rough proxy for how much driving Americans are doing, and says nothing about which roads are actually being used or when.  So government road planners have to guess at which roads need to be upgraded or where new roads are required.  Worse, the current system does nothing to encourage rational decisions on the part of drivers, who currently have no direct economic incentive (other than saving time) not to drive during rush hour or to use less-congested roads.

Second, the current tax system is what economists would call “Pigouvian“: it is intended to correct the negative externalities (air pollution) caused by driving.  But, again, taxing total gallons of gas consumed is a poor proxy for emissions.  As Cato’s Jerry Taylor points out (start podcast at 1:33), cars are already sufficiently computerized that if we really wanted to punish pollution through the tax system, we could directly tax emissions themselves by having each car keep track of unhealthy emissions and then uploading that data, say, at the car’s annual inspection.

So in a rational world, we’d abolish gasoline taxes entirely and institute user fees to fund the cost of roads & highways that reflect actual use.   If government insists on it, we could also tax emissions directly.  (We could make the whole transition revenue-neutral, lest this reform result in higher taxes/fees.)  Merely by reducing congestion, better economic incentives could significantly reduce air pollution.

If roads weren’t run by government monopolies, this kind of change would have happened a long time ago.  Although many people associate toll booths with road privatization, no private business would ever choose a technology as cumbersome (and costly) as toll booths if they had the option of using a system as seamless and invisible to the user as GPS-tracking or even existing transponder-based systems ( e.g.,  E-Z Pass, FasTrak).  Maybe there’s a more efficient or privacy-friendly option out there, or at least on the horizon.  I don’t know, but I suspect competing road operators would figure it out.

Some drivers might still be uncomfortable with the idea of a private company having access to their driving data, but that private company would have a strong incentive to compete for privacy-sensitive drivers by offering strong data protection policies (such as data anonymization and retention limits), which would of course be enforced under the FTC’s existing “unfair & deceptive trade practices.”

But because government has virtually monopolized the road system, we’re stuck with a terrible choice:

• Continue to use a “pricing” (tax) system from the 1950s when modern satellite and computer technology offers us clearly superior alternatives that could reduce congestion and pollution and perhaps even save lives; OR
• Risk putting the data created by those modern technologies directly into the government’s hands.

It’s a hard choice.  I don’t know what the right answer is—other than privatizing the roads, enforcing corporate privacy policies strictly under existing law, and increasing Fourth Amendment protections against government access to user data kept by companies.  Since road privatization is unlikely to happen in an era when we are (re)nationalizing core industries through bailouts, I suspect that we’ll end up having to choose either technology (with all its benefits)  or privacy, when we should be able to have both.

President Obama has talked about “investing” $50 billion in tax money over the next five years to subsidize the digitization of health records.  While one might hope that these records wouldn’t be directly accessible to government in the same way that driving records would be under the Oregon or UK projects, it’s by no means clear that this won’t be the case, given the Federal government’s dominant role in the health care sector.  If the Golden Rule (“He Who Has the Gold, Makes the Rules”) holds, increased government spending on health care across the board—whether in the name of e-Health or universal health—will surely lead to greater government control of the health care system.  That will probably mean greater access to e-health records.  If politicians can access FBI files of their opponents, they’ll probably abuse access to health care records, too.  No safeguards are ever perfect, of course, and invasions of privacy would happen if the data were kept by private companies, but at least those companies would be accountable in court, in the court of public opinion and in the marketplace if they allowed such violations by their employees or corporate partners, or simply failed to protect such a “honey pot” of data.

I’d like to see the most modern technology used across the board—whether it’s for roads or health care.  I just don’t want the real Big Brother—government—to have access to that information, a problem that is only going to increase as government’s role in our lives grows.