Concurring Opinions » Privacy (Electronic Surveillance)

Sometimes It Really Is Big Brother

Danielle Citron — Wed, 24 Feb 2010 14:14:02 +0000

Metaphors have long had a profound impact on the way we conceptualize problems. Sometimes they persist, never to be shaken. Other times, they wane in relevance, at times taking on a misleading character. In privacy, the Big Brother metaphor has stuck, but has been superseded by others, notably Dan Solove’s invocation of Kafka’s The Trial. As Dan underscores in The Digital Person: Technology and Privacy in the Information Age, unseen bureaucracies collect, process, and distribute our personal information in ways that have great power over our lives. Information brokers, for instance, amass digital dossiers on individuals that often include incomplete and misleading data, selling them to potential employers who decline to interview or hire them. In most instances, individuals have no idea that such digital dossiers have cost them work opportunities. They also have no means to force data brokers to disclose or correct their dossiers.

Only in the exceptional case do people discover that such dossiers contain incorrect information about them. For instance, as CNN reports, in 2009, data broker ChoicePoint provided an employer with a dossier on a Georgia man, which falsely asserted that he had two felony convictions. The employer initially refused to hire the man and explained their reason to him. The man contacted his congressman about the problem and, with his help, managed to convince ChoicePoint to remove the false criminal information from his dossier.

The metaphor of Kafka’s The Trial is so fitting. Most, unlike the Georgia man, lose work opportunities, never knowing that a data broker has rendered a verdict on them: Smoker! Criminal! Fiscally Irresponsible! Employers care about these things, and in this environment may decline to hire a smoker or Crohn’s sufferer whose health bills may be high, no matter how capable the person seems.

But now comes news of a Main Lain Pennsylvania school that allegedly can remotely turn on the web cameras in its students’ laptops, watching kids at home and punishing them for their activities there. (Cory Doctorow, who wrote the ingenious book Little Brother, quite fittingly broke the story on boingboing.) The school confirmed that it can remotely monitor the students’ web cam inputs but only does so to locate missing or stolen laptops. A student claims, however, that an assistant principal used images from his laptop to punish him for activities at home. The student claims that the administrator mistook Mike & Ike candy on his home desk for drugs. With this example, the Big Brother metaphor seems so utterly apt.

The FBI’s Electronic Surveillance Violations

Daniel Solove — Tue, 19 Jan 2010 20:07:26 +0000

The Washington Post reports that the FBI engaged in severe violations of the Electronic Communications Privacy Act between 2002 and 2006:

The FBI illegally collected more than 2,000 U.S. telephone call records between 2002 and 2006 by invoking terrorism emergencies that did not exist or simply persuading phone companies to provide records, according to internal bureau memos and interviews. FBI officials issued approvals after the fact to justify their actions.

E-mails obtained by The Washington Post detail how counterterrorism officials inside FBI headquarters did not follow their own procedures that were put in place to protect civil liberties. The stream of urgent requests for phone records also overwhelmed the FBI communications analysis unit with work that ultimately was not connected to imminent threats.

A Justice Department inspector general’s report due out this month is expected to conclude that the FBI frequently violated the law with its emergency requests, bureau officials confirmed.

ECPA allows the FBI to issue National Security Letters (NSLs) to obtain information from communications service providers. I’ve criticized NSLs in the past for providing too minimal a protection of privacy: “A NSL is a demand letter issued to a particular entity or organization to turn over various record and data pertaining to individuals. They do not require probable cause, a warrant, or even judicial oversight. They also come with a gag order, preventing the recipient of the letter from disclosing that the letter was ever issued. Compliance is mandatory.”

Apparently, the FBI found NSLs to be too cumbersome because they required an open case, so they devised a work-around. According to the Washington Post:

The USA Patriot Act expanded the use of national security letters by letting lower-level officials outside Washington approve them and allowing them in wider circumstances. But the letters still required the FBI to link a request to an open terrorism case before records could be sought.

Shortly after the Patriot Act was passed in October 2001, FBI senior managers devised their own system for gathering records in terrorism emergencies.

A new device called an “exigent circumstances letter” was authorized. It allowed a supervisor to declare an emergency and get the records, then issue a national security letter after the fact.

Over at the Volokh Conspiracy, Orin Kerr has a thoughtful post about the issue. He posits some circumstances in which the FBI may have not been violating the law, and his theories seem plausible to me since we need more facts. Nevertheless, at this point, I’m growing tired of giving the government the benefit of the doubt. These problems are indicative of a general trend in various government agencies during the Bush Administration to either concoct various end-runs around the law or ignore it entirely.

The lessons of the aftermath of September 11th indicate the following: (1) the existing electronic surveillance laws were poorly understood; (2) these laws were not as nimble and pro-security as many Executive Branch officials would have liked; (3) despite various provisions in these laws to protect privacy, they were often ignored or not adequately followed.

There’s clearly a larger problem at play here — our electronic surveillance laws aren’t working very well if the goal is to keep the government under control during times of crisis (when these laws are most fervently needed).

Timothy B. Lee’s “Google Attacks Highlight the Importance of Surveillance Transparency”

Deven Desai — Fri, 15 Jan 2010 21:05:30 +0000

The Google China news deserves some thought for a range of reasons. The questions about democracy, censorship, and more that swirled around Google and China’s relationship are important. One issue that is easily lost is the relationship between the claimed reasons for Google’s leaving China and policies about surveillance. My colleague at CITP, Timothy B. Lee, wrote an excellent piece at Freedom to Tinker about this issue. Ordinarily I would summarize and point folks to the post. It captured my attention so much, however, that I asked Tim whether I might repost it in full here. I am happy that he has agreed.

Google Attacks Highlight the Importance of Surveillance Transparency

by Timothy B. Lee

Ed posted yesterday about Google’s bombshell announcement that it is considering pulling out of China in the wake of a sophisticated attack on its infrastructure. People more knowledgeable than me about China have weighed in on the announcement’s implications for the future of US-Sino relations and the evolution of the Chinese Internet. Rebecca MacKinnon, a China expert who will be a CITP visiting scholar beginning next month, says that “Google has taken a bold step onto the right side of history.” She has a roundup of Chinese reactions here.

One aspect of Google’s post that hasn’t received a lot of attention is Google’s statement that “only two Gmail accounts appear to have been accessed, and that activity was limited to account information (such as the date the account was created) and subject line, rather than the content of emails themselves.” A plausible explanation for this is provided by this article (via James Grimmelmann) at PC World:

Drummond said that the hackers never got into Gmail accounts via the Google hack, but they did manage to get some “account information (such as the date the account was created) and subject line.”

That’s because they apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press.

Obviously, this report should be taken with a grain of salt since it’s based on a single anonymous source. But it fits a pattern identified by our own Jen Rexford and her co-authors in an excellent 2007 paper: when communications systems are changed to make it easier for US authorities to conduct surveillance, it necessarily increases the vulnerability of those systems to attacks by other parties, including foreign governments.

Rexford and her co-authors point to a 2006 incident in which unknown parties exploited vulnerabilities in Vodafone’s network to tap the phones of dozens of senior Greek government officials. According to news reports, these attacks were made possible because Greek telecommunications carriers had deployed equipment with built-in surveillance capabilities, but had not paid the equipment vendor, Ericsson, to activate this “feature.” This left the equipment in a vulnerable state. The attackers surreptitiously switched on the surveillance capabilities and used it to intercept the communications of senior government officials.

It shouldn’t surprise us that systems built to give law enforcement access to private communications could become vectors for malicious attacks. First, these interfaces are often backwaters in the system design. The success of any consumer product is going to depend on its popularity with customers. Therefore, a vendor or network provider is going to deploy its talented engineers to work on the public-facing parts of the product. It is likely to assign a smaller team of less-talented engineers to work on the law-enforcement interface, which is likely to be both less technically interesting and less crucial to the company’s bottom line.

Second, the security model of a law enforcement interface is likely to be more complex and less well-specified than the user-facing parts of the service. For the mainstream product, the security goal is simple: the customer should be able to access his or her own data and no one else’s. In contrast, determining which law enforcement officials are entitled to which information, and how those officials are to be authenticated, can become quite complex. Greater complexity means a higher likelihood of mistakes.

Finally, the public-facing portions of a consumer product benefit from free security audits from “white hat” security experts like our own Bill Zeller. If a publicly-facing website, cell phone network or other consumer product has a security vulnerability, the company is likely to hear about the problem first from a non-malicious source. This means that at least the most obvious security problems will be noticed and fixed quickly, before the bad guys have a chance to exploit them. In contrast, if an interface is shrouded in secrecy, and only accessible to law enforcement officials, then even obvious security vulnerabilities are likely to go unnoticed and unfixed. Such an interface will be a target-rich environment if a malicious hacker ever does get the opportunity to attack it.

This is an added reason to insist on rigorous public and judicial oversight of our domestic surveillance capabilities in the United States. There has been a recent trend, cemented by the 2008 FISA Amendments toward law enforcement and intelligence agencies conducting eavesdropping without meaningful judicial (to say nothing of public) scrutiny. Last month, Chris Soghoian uncovered new evidence suggesting that government agencies are collecting much more private information than has been publicly disclosed. Many people, myself included, oppose this expansion of domestic surveillance grounds on civil liberties grounds. But even if you’re unmoved by those arguments, you should still be concerned about these developments on national security grounds.

As long as these eavesdropping systems are shrouded in secrecy, there’s no way for “white hat” security experts to even begin evaluating them for potential security risks. And that, in turn, means that voters and policymakers will be operating in the dark. Programs that risk exposing our communications systems to the bad guys won’t be identified and shut down. Which means the culture of secrecy that increasingly surrounds our government’s domestic spying programs not only undermines the rule of law, it’s a danger to national security as well.

Update: Props to my colleague Julian Sanchez, who made the same observation 24 hours ahead of me.

Cell Phones, Dogs, and Prisons: A Better Policy Is Needed

Deven Desai — Sun, 27 Dec 2009 15:55:41 +0000

I call friends and family during the holidays. For me, unlike email and social networking options, talking to someone is a more intimate and fun experience. Regardless of how one “reaches out and touches someone” as AT&T used to say, it is easy to take the ability to do so for granted. As I thought about how much I rely on being able to connect with those close to me, I remembered how to manage the way in which inmates can communicate with the outside world poses some challenges. There is evidence that crimes are planned when inmates have cell phones and other means of communication. Yet, there are benefits to letting inmates have better ability to communicate with family and counsel. Unfortunately, the press about the problem has been a bit inflammatory, and one of article buried the real solution: fix the market for communication by inmates. When land line calls from prison cost hundreds of dollars a month, it may not be surprising that a black market for cell phones arises and may cause more problems than the ban on cell phones prevents.

There is a plausible argument for the ban on cell phones in prison. According to an article about Florida’s acquisition of a second cell phone sniffing dog (yes, a dog that can smell whether one has a cell phone): “Inmates can use phones for a variety of purposes, none of them good, corrections officials say. Among the most worrisome: using cell phones secreted behind bars to contact former associates on the outside to keep criminal operations going – something that’s far more difficult to do on monitored land lines.” Even Wired seems to agree that cell phones in prison are a problem and recently ran an article entitled “Prisoners Run Gangs, Plan Escapes and Even Order Hits With Smuggled Cellphones.” Yet, these perspectives seem to miss some key points about why these problems occur.

Before law and order screeching begins, let me be clear. I do not think letting prisoners have easy means to perpetuate bad acts is a good thing. And I do not doubt that some prisoners, maybe even many, use phones for all sorts of nefarious deeds. Nonetheless, one may want to ask why the incredible demand for cell phones? For example, according to Wired, “One California officer told investigators he made more than $100,000 in a single year selling phones.” Now prisons are investing in special dogs and expensive cell signal detectors. Some want the Federal government to allow cell jamming.

As the Wired article finally admits, “While the squabbling continues, what might be the most effective way of cutting illicit phone use is largely ignored: making it easier for inmates to place calls legally.”

As the article explains:

[I]nvestigations have established that most calls placed on contraband mobiles are harmless—just saying hi to family and friends. Whatever their crimes, most convicts have parents, children, and others they’re desperate to stay in touch with. Letters are slow, and personal visits often involve expensive, time-sucking travel. Some prisons have public phones for making collect calls, but access is limited, conversations are often monitored, and phone companies often charge much higher rates than on the outside.

And there is the problem. As a friend of mine informed me, even calling one’s counsel is difficult and quite expensive. I am not sure who is at fault, but either the prisons or the phone companies have set up system that costs so much money, one cannot be surprised that smuggling cell phones makes sense. One person ended up spending $800 a month to make land line calls. In an era of flat rate bills that is ridiculous.

Furthermore, the Wired article notes that letting prisoners have better connections with their families helps society in general because:

[I]t could reduce crime and save the public a bundle by cutting recidivism. Most of the more than 2 million men and women behind bars in the US will eventually be released, and decades of research show that those who maintain family ties are much less likely to land back in jail. Every parolee who stays straight saves taxpayers an average of more than $22,000 a year.

Even tough-on-crime Texas has embraced that logic. The state has long refused to allow phones of any sort for inmates in its prisons, but this year officials are installing landlines. “Once they’re in place, we expect a decrease in the problem,” Moriarty says.

In short, fair land line rates would seem to be a good idea. Another more controversial idea would be to let more information flow but monitor it. Privacy concerns are obviously huge here. Still, off the top of my head, I wonder whether a system where prisoners can connect with family but may give up privacy to monitor text and other communication, just as apparently happens with land line calls, would be better than encouraging everyone to use a contraband phone.

How To Lose Yourself (Or Not) in 30 Days: Wired’s Identity Loss Experiment

Deven Desai — Wed, 02 Dec 2009 15:54:09 +0000

Wired magazine ran an interesting competition starting on August 13. Writer Evan Ratliff who had written about how people disappear tried to disappear from the world and everyone he knew while Wired encouraged and helped people try and find him. The winner would receive $5,000. Ratliff explained his motivation:

It’s one thing to report on the phenomenon of people disappearing. But to really understand it, I figured that I had to try it myself. So I decided to vanish. I would leave behind my loved ones, my home, and my name. I wasn’t going off the grid, dropping out to live in a cabin. Rather, I would actually try to drop my life and pick up another.

The article is here. Anyone interested in privacy, manhunts, and technology should enjoy the read which I recommend. For one thing, the tale reminded me of Hitchcock thrillers where everyone is looking for an innocent man. Like Roger O. Thornhill in North by Northwest, Ratliff uses buses and trains to evade his pursuers (of course Ratliff asked for this one but the feel is quite similar). And like the movies there were sides. In this case, teams formed to hunt Ratliff down and much smaller ones tried to help him (the details about how folks used technology to track and coordinate the hunt (down to finding out who is cat sitter was and contacting the sitter) while Ratliff used it to fool the hunters is another fun part of the story). An interesting point comes from the romantic quarter. I started with a emotional response that the author and others expressed. It would be nice to drop out of one’s life; escape for a bit. I like the idea that one might be able to reinvent one’s life. I also think that our society does a poor job of letting people claim a new beginning and instead embraces a Inspector Javert approach to identity. I rooted for Ratliff. I wanted to believe that if you really said let me alone, it could work. But, as I read on, something else became clear. Ratliff missed his social life. That sense of absence was heightened because of Facebook and Twitter. Insofar as we like some of our lives, we probably like the people in them. Furthermore, when Ratliff has a triumph, he laments that he cannot share it.

In short, the article shows how easy it is to track someone. It also shows that once the spotlight is off, a type of obscurity returns. The problem may be that the spotlight can be turned on all too easily.

UCLA Law Review 57:1 (October)

UCLA Law Review — Fri, 30 Oct 2009 23:21:12 +0000

Volume 57, Issue 1 (October 2009)

Articles

From Privacy To Liberty: The Fourth Amendment After Lawrence	Thomas P. Crocker	1
Who Can Sue Over Government Surveillance?	Scott Michelman	71
Leverage in the Board Room: The Unsung Influence of Private Lenders in Corporate Governance	Frederick Tung	115

Essay

After the Bailout: Regulating Systemic Moral Hazard

Karl S. Okamoto

183

Comments

Evaluating The Public Interest: Regulation Of Industrial Hemp Under The Controlled Substances Act	Christine A. Kolosov	237
Improving The Education Of California’s Juvenile Offenders: An Alternative To Consent Decrees	Stefanie Low	275
The Right to Control One’s Name	Julia Shear Kushner	313

Discourse

Getting the Framers Wrong: A Response to Professor Geoffrey Stone	Samuel Calhoun
The Perils of Religious Passion: A Response to Professor Samuel Calhoun	Geoffrey Stone

Th UCLA Law Review is also pleased to announce the launch of a our new website.

Tweeting for the Party

Danielle Citron — Mon, 28 Sep 2009 19:11:26 +0000

During the 2008 election, Democrats effectively used Web 2.0 platforms to garner interest in the campaign and win supporters. President Obama has been widely hailed as the first “Tech President,” and he seems to have trounced the Facebook landscape. To date, President Barack Obama has over 6.6 million Facebook friends, while Sarah Palin only has 848, 614 Facebook pals and Mitt Romney has 70, 130.

Although the President has proven his mettle on Facebook and MySpace (where he has over 1.8 million friends), Republicans rule the day on the micro-blogging front. The Congressional Research Service reports that congressional Republicans out-tweeted their Democratic counterparts during two one-week periods this summer. Nancy Scola attributes Congressional Republicans’ Twitter dominance to their desire to regain the public’s attention and favor now that they are in the minority. AMERICAblogs’ John Aravosis worries that Democrats have ceded their online advantage.

No matter the current political victor in this social media landscape, Government 2.0 is here to stay. It surely has great potential to shine light on government policymaking and to marshal public participation, especially from people who otherwise wouldn’t bother getting involved with government policymaking. Adding the President as a friend on MySpace and joining live chats may seem to be a relatively costless endeavor as compared to writing letters or commenting on agency rulemakings. But Government 2.0 also poses privacy risks: social media sites not only give government access to people’s policy insights but also access to all of individuals’ social media data, such as their videos, photos, walls musings, “Top 25 things you don’t know about me” lists, and the like. Soon, I will be posting on SSRN a draft of my essay “The One-Way Mirror: Enhancing Participation and Securing Privacy for Government 2.0″ (forthcoming George Washington Law Review) and hope to get your feedback.

Understanding Privacy in Paperback

Daniel Solove — Mon, 14 Sep 2009 14:36:16 +0000

I’m pleased to announce that my book, Understanding Privacy, has just come out in paperback from Harvard University Press, with a price that’s much more reasonable and affordable than the hardcover.

Understanding Privacy offers a comprehensive overview of the many difficulties involved in discussions of privacy. Drawing from a broad array of interdisciplinary sources, I set forth a framework for understanding privacy that provides clear practical guidance for engaging with privacy issues.

Lori Drew Case Decided

Daniel Solove — Sun, 30 Aug 2009 05:18:36 +0000

The Lori Drew case has finally been decided. Background about the case is here. In previous posts (here and here), I argued that the CFAA should be held to be unconstitutionally vague.

In an opinion released on August 28, Judge George Wu struck down, on unconstitutional vagueness grounds, the prosecution’s attempt to enforce violations of website terms of service as crimes under the Computer Fraud and Abuse Act (CFAA):

[I]f any conscious breach of a website’s terms of service is held to be sufficient by itself to constitute intentionally accessing a computer without authorization or in excess of authorization, the result will be that section 1030(a)(2)(C) becomes a law “that affords too much discretion to the police and too little notice to citizens who wish to use the [Internet].” City of Chicago [v. Morales], 527 U.S. [41] at 64 [(1999)].

Congratulations to Orin Kerr, who assisted in the defense, and who is cited numerous times throughout the court’s opinion.

I See Code: Plain View and Computer Searches

Deven Desai — Thu, 27 Aug 2009 13:01:15 +0000

The Ninth Circuit has taken a swat computer searches and the plain view doctrine (pdf). I have not yet read the entire opinion but Orin Kerr has a series of posts about the decision here. And Shaun Martin, for whom I have a ton of respect as well, covers the case here. Shaun’s post captures how well-written the opinion is: “In my dreams I could write an opinion this good. It’s clear. It’s concise. It provides meaningful, systemic guidelines. It’s just. It’s got a keen sense of both the practical way the world works as well as the dangers inherent in certain conduct. In short, it’s exactly what I want in a wide-ranging opinion that makes meaningful precedent. … If you only read a dozen Ninth Circuit opinions this year, this should be amongst them.”

Dan and others will likely have more to say, so stay tuned, folks. As Orin notes, “This is really new territory, so it will be interesting to see how it plays out. I suspect we’ll find out soon, as there are a lot of these cases.” In the interim, here are three paragraphs worth reading:

The point of the Tamura procedures is to maintain the privacy of materials that are intermingled with seizable materials, and to avoid turning a limited search for particular information into a general search of office file systems and computer databases. If the government can’t be sure whether data may be concealed, compressed, erased or booby-trapped without carefully examining the contents of every file—and we have no cavil with this general proposition—then everything the government chooses to seize will, under this theory, automatically come into plain view. Since the government agents ultimately decide how much to actually take, this will create a powerful incentive for them to seize more rather than less: Why stop at the list of all baseball players when you can seize the entire Tracey Directory? Why just that directory and not the entire hard drive? Why just this computer and not the one in the next room and the next room after that? Can’t find the computer? Seize the Zip disks under the bed in the room where the computer once might have been. See United States v. Hill, 322 F. Supp. 2d 1081 (C.D. Cal. 2004). Let’s take everything back to the lab, have a good look around and see what we might stumble upon.

This would make a mockery of Tamura and render the carefully crafted safeguards in the Central District warrant a nullity. All three judges below rejected this construction, and with good reason. One phrase in the warrant cannot be read as eviscerating the other parts, which would be the result if the “otherwise legally seized” language were read to permit the government to keep anything one of its agents happened to see while performing a forensic analysis of a hard drive. The phrase is more plausibly construed as referring to any evidence that the government is entitled to retain entirely independent of this seizure.

To avoid this illogical result, the government should, in future warrant applications, forswear reliance on the plain view doctrine or any similar doctrine that would allow it to retain data to which it has gained access only because it was required to segregate seizable from non-seizable data. If the government doesn’t consent to such a waiver, the magistrate judge should order that the seizable and non-seizable data be separated by an independent third party under the supervision of the court, or deny the warrant altogether.

Surveillance Facebook-Style: It’s Your Party and You Can Cry If You Want To

Danielle Citron — Sun, 19 Jul 2009 11:01:18 +0000

The U.K.’s Register reports that British police stormed a man’s birthday barbeque party because his invite to 15 Facebook friends advertised an “all night party.” Before the party could really begin, police showed up in four cars, a riot van, and a helicopter, ordering the birthday boy to shut the party down or face arrest. With an appropriate amount of humor, Andrew Poole, the birthday trouble-maker, explained: “What the police did was come in and stop 15 people eating hamburgers.” What would possess the Facebook Precinct to bother here? Section 63 of the Criminal Justice and Public Order Act 1994 grants police powers to remove individuals attending or preparing for a “rave,” defined as playing amplified music “wholly or predominantly characterised by the emission of a succession of repetitive beats.”

This incident demonstrates the perils of a society that monitors and mines Facebook communications. The costs to liberty include blows to free expression and association. Brits will surely think twice about wall messages and “what I am doing now” missives that include talk of parties and other activities subject to misinterpretation. The costs to society: the misdirection of police from real threats to society and wasted resources spent breaking up a birthday bash (the helicopter time apparently cost 200 pounds and tack on the police efforts, including any investigation they conducted and time at the party, and gas for the four cars and van). So with Facebook surveillance the British may get less liberty and less security.

Commentators on the Register story noted their relief at living in the United States. They suggested that law enforcement and security officials would never be so foolish as to monitor Facebook traffic. Think again. The NSA’s Advanced Research Development Activity (ARDA) has funded research on the “Semantic Analytics on Social Networks: Experiences in Addressing the Problem of Conflict of Interest Detection,” which discusses how intelligence about people can be extracted from social networks. ARDA’s role is to spend NSA money on research that can “solve some of the most critical problems facing the U.S. intelligence community.” ARDA’s function is to make sense of the massive amount of data that the NSA collects.

Should Americans be worried about intelligence profiling a la Facebook? Many might think that the use of privacy settings on social networking sites would obviate the problem. First, studies suggest that most social networking site users use the default privacy settings, which are often the least privacy protecting and may reveal much of a user’s musings. Second, this assumption presumes that third party sites will not turn over social networking data, which they own, to the government, either for a pretty price or in the face of a subpoena or warrant. This assumption may be faulty. So what is all of the fuss? Automated intelligence profiling has obvious costs, such as the ones posed by the birthday party bust. It also has less apparent ones, such as mining misleading social networking data with other not-so reliable private and public database date and, poof, people end up on government watchlists.

Stock Xchange Photo

Lori Drew Tentatively Acquitted

Daniel Solove — Fri, 03 Jul 2009 02:41:50 +0000

Judge George Wu has ruled that he is planning to dismiss the charges against Lori Drew, the woman involved in the MySpace suicide case involving Megan Meier. Background about the case is here. According to an article by Kim Zetter of Wired, who has provided terrific coverage of the case:

“It basically leaves it up to a website owner to determine what is a crime,” said Wu on Thursday, echoing what critics of the case have been saying for months. “And therefore it criminalizes what would be a breach of contract.” . . . .

Wu told Assistant U.S. Attorney Mark Krause that if Drew had been convicted of the felonies, he would have let the convictions stand, and would have already sentenced her. But the misdemeanor convictions troubled him, because of the vague wording of the statute. . . .

To convict Drew of the felonies, prosecutors would have needed to prove two things: that Drew accessed MySpace “without authorization,” and did it for the purpose of committing a tortious act — in this case, to intentionally cause harm to Megan Meier.

But for the misdemeanors, the jury just had to find that Drew obtained the unauthorized access. Wu said that language, standing on its own, was too vague to pass constitutional muster in this case.

“I don’t see how the misdemeanor aspect would be constitutional,” he said. “That is the issue I’m wrestling with at this time.”

Wu also doubted that MySpace provided sufficient notice to members to hold them responsible. If a user didn’t read the terms of service, the judge asked prosecutor Krause, could they still be charged with violating them?

In previous posts (here and here), I argued that the CFAA should be held to be unconstitutionally vague. I’m encouraged that Judge Wu agrees, though I believe the CFAA is unconstitutionally vague not only in its misdemeanor provisions, but in its felony ones as well.

Congratulations to my colleague, Orin Kerr, who assisted in Lori Drew’s defense.

The AP story is here.

New Developments in Cryptography and Privacy

Deven Desai — Tue, 30 Jun 2009 18:35:08 +0000

According to Help Net Security, Craig Gentry, a researcher at IBM, appears to have found a way to allow “the deep and unlimited analysis of encrypted information – data that has been intentionally scrambled – without sacrificing confidentiality.” The solution involves a an “ideal lattice.” I’ll leave the explanation of all the math to the math/computer science folks. As the Help Net article notes, the solution seems to enable some great advantages for anyone providing cloud computing for:

computer vendors storing the confidential, electronic data of others will be able to fully analyze data on their clients’ behalf without expensive interaction with the client, and without seeing any of the private data. With Gentry’s technique, the analysis of encrypted information can yield the same detailed results as if the original data was fully visible to all.

It all sounds wonderful. One could have encrypted data and let others data mine while maintaining anonymity or privacy. Yet, something seemed odd to me. So I did what lawyers do, I called someone who knew more about computer science and asked for some help. That person explained that yes this could mean one could query an encrypted database without decrypting the data. The example to consider is a database of book purchases. One could ask how many people bought both book A and book B and see that result without ever seeing what a specific person purchased. Great, right? Not so fast.

As this person reminded me, with other sources of information one can figure out what a specific person did. That reminded me of the AOL debacle. With a little work, people were able to figure out who the anonymous subjects were.

All of which highlights that privacy is not binary. The cluster of information and the ability to analyze it seems often, if not always, to lead to problems about the use of information. So if this breakthrough allows a company or the government to claim that we should remain calm and all is well, we may want to remain clam but show how all may not be well. A few regulations about the use of the data even if supposedly anonymous, might allow the beneficial aspects of the solution to thrive while limiting the harms that can occur.

Image: WikiCommons
By: Gwenda; License: Public Domain
(My apologies to CS folks if the image does not match the breakthrough’s area of encryption)

The Many Deaths of Privacy

Frank Pasquale — Thu, 18 Jun 2009 15:00:49 +0000

As they follow the fascinating and heartening “Twitter Revolution” in Tehran, commentators worry that “the regime is prepared to detain dissidents — reportedly using Facebook and Twitter to locate them.” Yesterday also saw new reports of controversy over domestic surveillance by the US National Security Agency. Apparently the “agency routinely examined large volumes of Americans’ e-mail messages without court warrants.” Commentators like Glenn Greenwald and our own Dan Solove have done a great job explaining the legal details of NSA surveillance. I just want to comment on some of broader social trends that explain the upward ratchet of surveillance around the world.

Worries about the “death of privacy” have been prevalent for some time. We increasingly lack control over (or even awareness of) the digital profiles kept about us by businesses and governments. Another form of privacy—that at the core of the public-private divide—has also been in decline over the past couple decades. As the essays in Freeman and Minow’s book Government by Contract show, “privatization” is often less an arm’s length transaction between government and business than a veritable marriage of institutions. The recent explosion of public-private partnerships in the finance and auto industries further erodes the distinction between government and business. As William J. Novak’s essay in Government by Contract observes, much of what we think of as purely private markets are creatures of state action:

Robert Lee Hale contended that the sharp theoretical separation of public and private obscured the actual proactive role of public power in structuring the so-called private bargains that had such an immense effect on the distribution of wealth and power in American society. . . . [T]he private sphere is positively constructed by law and government and is consequently always suffused with (as opposed to immune from) sovereignty, force, violence, and coercion.

This is particularly true of communications technologies, which are often of great interest to government regulators. As Michael D. Birnhack and Niva Elkin-Koren explain in their brilliant article The Invisible Handshake, new and hidden exchanges of information for power are key to government-business relations:

Law enforcement agencies seek to enhance their monitoring capacity and online businesses seek to prevent fraud and combat piracy while strengthening their ties with authorities. . . . The invisible hand [of market-based communications] turned out to be very useful for the State, and it is now being replaced with a handshake, which, likewise, is invisible. . . . The use of private parties for executing government roles may create an unholy alliance between governments that wish to exercise their power and large online players that seek to maintain and strengthen their dominant role in the market.

Birnhack and Elkin-Koren were prophetic. The kind of government-business alliances they feared have become de rigeur in the national surveillance state. Both Chris Hoofnagle and Jon D. Michaels have described the development in some detail. Michaels’s story of FedEx is indicative of the larger trend:

[After FedEx's] CEO announced his company’s commitment to cooperating with the government “up to and including the line on which we would be doing a disservice to our shareholders” . . . FedEx has received a range of government perks. For instance, FedEx has been afforded special access to government security databases, presumably giving it a range of advantages over non-cooperating competitors. It has also been awarded a prized seat on the FBI’s regional terrorism task force (it is the only private company so represented) and thus has even more insider access to international security threats, again presumably well before its competitors receive such warnings. Moreover, FedEx has received an exceptional license from the State of Tennessee to develop an internal police force . . . .

Hoofnagle proposes that “the Privacy Act should apply to private sector companies that sell information to the government,” not just to the government itself. It seems to me that the first step to wisdom in this area is to realize that whatever we fear from direct government collection of data, we should fear from ostensibly “private” third parties that do the same. Otherwise, the ailing “public/private” divide could cause many more “deaths” of individual privacy.

At Long Last, A Cyber Security Czar

Danielle Citron — Wed, 03 Jun 2009 16:08:27 +0000

President Obama recently announced the creation of a White House cyber security coordinator who will oversee a national strategy for securing American interests in cyberspace. The coordinator will be a member of the National Security Council, reporting to the national security adviser and the senior White House economic adviser. President Bush started us in this direction by instituting the Cyber Initiative to overhaul the government’s cyber defenses. Yet we remain vulnerable to attacks on systems related to government operations, money supply, electric-power distribution, and transportation. Thus, devoting resources to shoring up cyber security is crucial.

Why do we need to coalesce power in a cyber security czar to oversee the nation’s information security efforts? Ira Winkler offers an explanation for centralizing this responsibility, rather than spreading it across various agencies. He considers complications that arise when multiple agencies engage in cyber security efforts of the offensive and defensive variety. He asks: what if the NSA engages in a long-term project to enter false information into an adversary’s database, unaware that the Army had hacked into the same database to try to track military movements? According to Winkler, the lack of coordination would allow the NSA’s efforts to mislead the Army. Divergent defensive efforts could similarly clash, thus undermining cyber security.

The President’s plan raises a number of unresolved issues. The President hopes to recruit the private sector’s help in devising a comprehensive security strategy. He has suggested building public and private partnerships around cybersecurity. How will the Administration accomplish this partnership? Would it be designed to get input from security professionals regarding government regulation of the private sector’s cyber security efforts? Will the government have a role in overseeing private networks? The heart burn involved in solving these issues is worthwhile given the critical importance of our networks to our economy and the real threat of cyber warfare.

Thanks to Wikimedia Commons for the image.

Online Symposium: Citron’s Cyber Civil Rights

Frank Pasquale — Tue, 14 Apr 2009 04:18:03 +0000

From tomorrow through Thursday, Concurring Opinions will be hosting a number of scholars invited to discuss Danielle Citron’s work Cyber Civil Rights. Responding to controversies over online attacks, Citron argues the following:

Social networking sites and blogs have increasingly become breeding grounds for anonymous online groups that attack women, people of color, and members of other traditionally disadvantaged groups. These destructive groups target individuals with defamation, threats of violence, and technology-based attacks that silence victims and concomitantly destroy their privacy. Victims go offline or assume pseudonyms to prevent future attacks, impoverishing online dialogue and depriving victims of the social and economic opportunities associated with a vibrant online presence. Attackers manipulate search engines to reproduce their lies and threats for employers and clients to see, creating digital “scarlet letters” that ruin reputations. . . .

Web 2.0 technologies accelerate mob behavior. With little reason to expect self-correction of this intimidation of vulnerable individuals, the law must respond. General criminal statutes and tort law proscribe much of the mobs’ destructive behavior, but the harm they inflict also ought to be understood and addressed as civil rights violations. Civil rights suits reach the societal harm that would otherwise go unaddressed and would play a crucial expressive role. Acting against these attacks does not offend First Amendment principles when they consist of defamation, true threats, intentional infliction of emotional distress, technological sabotage, and bias-motivated abuse aimed to interfere with a victim’s employment opportunities. To the contrary, it helps preserve vibrant online dialogue and promote a culture of political, social, and economic equality.

As I’ve noted before, I think this piece breaks new ground in applying venerable laws to the online environment. In this cyber-symposium, we propose to discuss the following issues:

What can the law do to respond to these threats?

How we deter harassment while promoting legitimate speech?

How do we balance the privacy rights of speakers and those they speak about in the new communicative landscape created by sites like AutoAdmit, Juicy Campus, Facebook, and anonymous message boards?

A list of scholars invited to discuss these issues appears below:

As co-organizers of the online symposium, Danielle, David Hoffman, Deven Desai and I welcome these guests and look forward to participating in the discussion. We have decided to default to “no comments” for this cyber-symposium. It was a tough decision, but ultimately we tended to feel that, for this topic in particular, the costs of editing and/or responding to abusive or off-topic comments would likely be higher than the benefits of our usual default to openness.

As recent controversies have shown, it’s easy for online mobs to inflict real injuries on their victims–and women bear a disproportionate share of the abuse. Citron argues that “acting against these attacks . . . helps preserve vibrant online dialogue and promote a culture of political, social, and economic equality.” We look forward to an animated and insightful discussion on how to balance liberty, equality, and privacy online.

Tracking Online Behavior to Combat Terror in the U.K.

Danielle Citron — Sat, 11 Apr 2009 23:07:32 +0000

As of last week, all Internet traffic in the United Kingdom will be archived for a year’s time. The British government has adopted the European Union directive requiring Internet access providers to store their users’ email traffic (i.e., the authors, date, and time of messages, not the messages themselves), VoIP calls (traditional phone calls are already monitored pursuant to previously adopted EU directive), and web surfing. Hundreds of public agencies, including law enforcement, will have access to data reservoirs teeming with personal information to fight “crime and terrorism.” The U.K. is poised to amass more data from the private sector in the name of counter-terrorism, considering proposals to require social networking sites, such as Facebook, to retain its British users’ records. The British government has adopted a threat model of governance: emergencies demand extraordinary measures to protect security, no matter the cost to other liberties.

The Obama Administration may not be as opposed to the U.K. approach as might be assumed. In the same week that the British adopted data retention as part of its anti-terror strategy, the Department of Justice vigorously defended the National Security Agency’s surveillance of countless Americans. In Jewel v. NSA, Electronic Frontier Foundation’s lawsuit challenging the National Security Agency’s warrantless wiretapping of Americans, the DOJ invoked the state secrets doctrine, insisting that the case must be dismissed without further inquiry in order to prevent “exceptionally grave harm to national security.” The DOJ also argued that the U.S. Patriot Act immunizes the U.S. from liability under federal wiretapping laws and the Stored Communications Act, going even further than the Bush Administration’s invocation of sovereign immunity for FISA violations. The emergency model of executive power may be here to stay.

No More What’s His/Her Face? iPhoto and Face Recognition

Deven Desai — Fri, 20 Feb 2009 23:54:29 +0000

CNET has a fluff piece about the fun of iPhoto’s new face recognition software. The author shares how the software identified a friend as a lemur and mistakenly identified friends as aged relatives. So here “the goofs are what make it fun.” One tags some photos and the software examines the entire library to find possible matches. As the report notes, “The science behind face recognition is complex and still evolving. In general, face recognition software looks for predictable patterns–characteristics and proportions that stay constant from one photograph to another, things like the distance between the eyes or from the eyes to the mouth.” (A friend of mine works on this area as part of his PhD program. The statistical models and math behind his work is quite sophisticated).

There is, however, a possible dark side to iPhoto. The more people tag help catalog photos, the more the general ability to track people will increase. Right now this information is on one’s computer. But I am guessing that online analogs exist or are about to (search facebook by face! and so on). I think it was Minority Report where the main character has to get new eyes to avoid surveillance recognition (yes that was retinal but you get the parallel). I am not saying this technology must stop (stopping technology is not a viable strategy). But as we move forward and play with new technology, the seemingly innocuous can have some rather potent impacts on how we live. Keeping an eye those potential changes may allow us to manage privacy and other interests before the problems occur rather than after.

Internet Safety

Jason Mazzone — Fri, 20 Feb 2009 21:47:13 +0000

Republican lawmakers have introduced companion bills in the Senate and the House entitled the Internet Stopping Adults Facilitating the Exploitation of Today’s Youth Act–or the Internet Safety Act. Each Bill imposes the following requirement: “A provider of an electronic communication service or remote computing service shall retain for a period of at least two years all records or other information pertaining to the identity of a user of a temporarily assigned network address the service assigns to that user.” The Bills appear to impose record-keeping requirements not just on traditional ISPs but on anybody operating a wireless access point (whether protected by a password or not): homes, hotels, coffee places, libraries, corporations, and schools.

Privacy Expectations: Being Seen vs. Being Recorded

Daniel Solove — Mon, 05 Jan 2009 03:01:45 +0000

An interesting case from the Wisconsin Court of Appeals embodies what I believe is a thoughtful and nuanced understanding of privacy. The case is Wisconsin v. Jahnke, 2007AP2130-CR (Dec. 30, 2008).

The case is a criminal prosecution of a man who secretly recorded his girlfriend in the nude, in violation of Wisconsin Statute § 942.09(2)(am). I’ve posted the text of the full statute below. The statute provides that it is a felony to record another person in the nude without that person’s consent “in a circumstance in which [the person] has a reasonable expectation of privacy.” The defendant contended that his girlfriend didn’t have a reasonable expectation of privacy because (as the court characterizes his argument), “she knowingly and consensually exposed her nude body to him while he was secretly videotaping her.” In other words, he argued that since she expected to be seen by him, she lost her expectation of privacy in her nude body.

The court wisely rejected the defendant’s construction of the statute:

Under this construction, Jahnke’s girlfriend’s privacy interest in not being recorded in the nude is left unprotected any time she permits anyone, under any circumstance, to view her nude. If she disrobes in a medical facility and permits medical personnel to view her, such personnel could record her without violating subsection 1 and, of course, later share that recording without violating subsections 2 or 3. It is one thing to be viewed in the nude by a person at some point in time, but quite another to be recorded in the nude so that a recording exists that can be saved or distributed and viewed at a later time.

The dissent raises some interesting arguments involving statutory construction and some prior caselaw. In particular, the dissenting judge points to an earlier decision defining the term “reasonable expectation of privacy” under the statute, holding that it “requires that the person who is depicted nude is in a circumstance in which he or she has an assumption that he or she is secluded from the presence or view of others, and that assumption is a reasonable one under all the circumstances.” State v. Nelson, 718 N.W.2d 168 (Wisc. App. 2006). The majority concluded that the Nelson definition was “incomplete” and that the “statute is plainly directed at reasonable expectations vis-à-vis not being recorded.”

The majority opinion wisely avoids a trap that many courts get into — understanding “privacy” narrowly as absolute secrecy or seclusion. Privacy involves a cluster of expectations involving the nature and extent to which their information is captured, used, and disseminated. It seems quite reasonable to assume that two lovers who see each other nude nevertheless expect privacy. They might be exposing their nude bodies to each other, but what they expect is that nobody else will see them. Since this is a criminal statute, it is important that courts avoid interpreting privacy too liberally, especially in areas where expectations of privacy are muddy. But it seems to me that under this circumstance–the nonconsensual recording of a person in the nude when she is exposing her body only to her boyfriend (rather than walking down a public street in the nude)–expectations are clear that the intended exposure is for the boyfriend’s eyes only.

The opinion is here.

WISCONSIN STAT. § 942.09(2)(am) provides:

Whoever does any of the following is guilty of a Class I felony:

1. Captures a representation that depicts nudity without the knowledge and consent of the person who is depicted nude while that person is nude in a circumstance in which he or she has a reasonable expectation of privacy, if the person knows or has reason to know that the person who is depicted nude does not know of and consent to the capture of the representation.

2. Makes a reproduction of a representation that the person knows or has reason to know was captured in violation of subd. 1. and that depicts the nudity depicted in the representation captured in violation of subd. 1., if the person depicted nude in the reproduction did not consent to the making of the reproduction.

3. Possesses, distributes, or exhibits a representation that was captured in violation of subd. 1. or a reproduction made in violation of subd. 2., if the person knows or has reason to know that the representation was captured in violation of subd. 1. or the reproduction was made in violation of subd. 2., and if the person who is depicted nude in the representation or reproduction did not consent to the possession, distribution, or exhibition.

Hat tip: How Appealing