Concurring Opinions » Privacy (Electronic Surveillance)

UCLA Law Review 57:1 (October)

UCLA Law Review — Fri, 30 Oct 2009 23:21:12 +0000

Volume 57, Issue 1 (October 2009)

Articles

From Privacy To Liberty: The Fourth Amendment After Lawrence	Thomas P. Crocker	1
Who Can Sue Over Government Surveillance?	Scott Michelman	71
Leverage in the Board Room: The Unsung Influence of Private Lenders in Corporate Governance	Frederick Tung	115

Essay

After the Bailout: Regulating Systemic Moral Hazard

Karl S. Okamoto

183

Comments

Evaluating The Public Interest: Regulation Of Industrial Hemp Under The Controlled Substances Act	Christine A. Kolosov	237
Improving The Education Of California’s Juvenile Offenders: An Alternative To Consent Decrees	Stefanie Low	275
The Right to Control One’s Name	Julia Shear Kushner	313

Discourse

Getting the Framers Wrong: A Response to Professor Geoffrey Stone	Samuel Calhoun
The Perils of Religious Passion: A Response to Professor Samuel Calhoun	Geoffrey Stone

Th UCLA Law Review is also pleased to announce the launch of a our new website.

Tweeting for the Party

Danielle Citron — Mon, 28 Sep 2009 19:11:26 +0000

During the 2008 election, Democrats effectively used Web 2.0 platforms to garner interest in the campaign and win supporters. President Obama has been widely hailed as the first “Tech President,” and he seems to have trounced the Facebook landscape. To date, President Barack Obama has over 6.6 million Facebook friends, while Sarah Palin only has 848, 614 Facebook pals and Mitt Romney has 70, 130.

Although the President has proven his mettle on Facebook and MySpace (where he has over 1.8 million friends), Republicans rule the day on the micro-blogging front. The Congressional Research Service reports that congressional Republicans out-tweeted their Democratic counterparts during two one-week periods this summer. Nancy Scola attributes Congressional Republicans’ Twitter dominance to their desire to regain the public’s attention and favor now that they are in the minority. AMERICAblogs’ John Aravosis worries that Democrats have ceded their online advantage.

No matter the current political victor in this social media landscape, Government 2.0 is here to stay. It surely has great potential to shine light on government policymaking and to marshal public participation, especially from people who otherwise wouldn’t bother getting involved with government policymaking. Adding the President as a friend on MySpace and joining live chats may seem to be a relatively costless endeavor as compared to writing letters or commenting on agency rulemakings. But Government 2.0 also poses privacy risks: social media sites not only give government access to people’s policy insights but also access to all of individuals’ social media data, such as their videos, photos, walls musings, “Top 25 things you don’t know about me” lists, and the like. Soon, I will be posting on SSRN a draft of my essay “The One-Way Mirror: Enhancing Participation and Securing Privacy for Government 2.0″ (forthcoming George Washington Law Review) and hope to get your feedback.

Understanding Privacy in Paperback

Daniel Solove — Mon, 14 Sep 2009 14:36:16 +0000

I’m pleased to announce that my book, Understanding Privacy, has just come out in paperback from Harvard University Press, with a price that’s much more reasonable and affordable than the hardcover.

Understanding Privacy offers a comprehensive overview of the many difficulties involved in discussions of privacy. Drawing from a broad array of interdisciplinary sources, I set forth a framework for understanding privacy that provides clear practical guidance for engaging with privacy issues.

Lori Drew Case Decided

Daniel Solove — Sun, 30 Aug 2009 05:18:36 +0000

The Lori Drew case has finally been decided. Background about the case is here. In previous posts (here and here), I argued that the CFAA should be held to be unconstitutionally vague.

In an opinion released on August 28, Judge George Wu struck down, on unconstitutional vagueness grounds, the prosecution’s attempt to enforce violations of website terms of service as crimes under the Computer Fraud and Abuse Act (CFAA):

[I]f any conscious breach of a website’s terms of service is held to be sufficient by itself to constitute intentionally accessing a computer without authorization or in excess of authorization, the result will be that section 1030(a)(2)(C) becomes a law “that affords too much discretion to the police and too little notice to citizens who wish to use the [Internet].” City of Chicago [v. Morales], 527 U.S. [41] at 64 [(1999)].

Congratulations to Orin Kerr, who assisted in the defense, and who is cited numerous times throughout the court’s opinion.

I See Code: Plain View and Computer Searches

Deven Desai — Thu, 27 Aug 2009 13:01:15 +0000

The Ninth Circuit has taken a swat computer searches and the plain view doctrine (pdf). I have not yet read the entire opinion but Orin Kerr has a series of posts about the decision here. And Shaun Martin, for whom I have a ton of respect as well, covers the case here. Shaun’s post captures how well-written the opinion is: “In my dreams I could write an opinion this good. It’s clear. It’s concise. It provides meaningful, systemic guidelines. It’s just. It’s got a keen sense of both the practical way the world works as well as the dangers inherent in certain conduct. In short, it’s exactly what I want in a wide-ranging opinion that makes meaningful precedent. … If you only read a dozen Ninth Circuit opinions this year, this should be amongst them.”

Dan and others will likely have more to say, so stay tuned, folks. As Orin notes, “This is really new territory, so it will be interesting to see how it plays out. I suspect we’ll find out soon, as there are a lot of these cases.” In the interim, here are three paragraphs worth reading:

The point of the Tamura procedures is to maintain the privacy of materials that are intermingled with seizable materials, and to avoid turning a limited search for particular information into a general search of office file systems and computer databases. If the government can’t be sure whether data may be concealed, compressed, erased or booby-trapped without carefully examining the contents of every file—and we have no cavil with this general proposition—then everything the government chooses to seize will, under this theory, automatically come into plain view. Since the government agents ultimately decide how much to actually take, this will create a powerful incentive for them to seize more rather than less: Why stop at the list of all baseball players when you can seize the entire Tracey Directory? Why just that directory and not the entire hard drive? Why just this computer and not the one in the next room and the next room after that? Can’t find the computer? Seize the Zip disks under the bed in the room where the computer once might have been. See United States v. Hill, 322 F. Supp. 2d 1081 (C.D. Cal. 2004). Let’s take everything back to the lab, have a good look around and see what we might stumble upon.

This would make a mockery of Tamura and render the carefully crafted safeguards in the Central District warrant a nullity. All three judges below rejected this construction, and with good reason. One phrase in the warrant cannot be read as eviscerating the other parts, which would be the result if the “otherwise legally seized” language were read to permit the government to keep anything one of its agents happened to see while performing a forensic analysis of a hard drive. The phrase is more plausibly construed as referring to any evidence that the government is entitled to retain entirely independent of this seizure.

To avoid this illogical result, the government should, in future warrant applications, forswear reliance on the plain view doctrine or any similar doctrine that would allow it to retain data to which it has gained access only because it was required to segregate seizable from non-seizable data. If the government doesn’t consent to such a waiver, the magistrate judge should order that the seizable and non-seizable data be separated by an independent third party under the supervision of the court, or deny the warrant altogether.

Surveillance Facebook-Style: It’s Your Party and You Can Cry If You Want To

Danielle Citron — Sun, 19 Jul 2009 11:01:18 +0000

The U.K.’s Register reports that British police stormed a man’s birthday barbeque party because his invite to 15 Facebook friends advertised an “all night party.” Before the party could really begin, police showed up in four cars, a riot van, and a helicopter, ordering the birthday boy to shut the party down or face arrest. With an appropriate amount of humor, Andrew Poole, the birthday trouble-maker, explained: “What the police did was come in and stop 15 people eating hamburgers.” What would possess the Facebook Precinct to bother here? Section 63 of the Criminal Justice and Public Order Act 1994 grants police powers to remove individuals attending or preparing for a “rave,” defined as playing amplified music “wholly or predominantly characterised by the emission of a succession of repetitive beats.”

This incident demonstrates the perils of a society that monitors and mines Facebook communications. The costs to liberty include blows to free expression and association. Brits will surely think twice about wall messages and “what I am doing now” missives that include talk of parties and other activities subject to misinterpretation. The costs to society: the misdirection of police from real threats to society and wasted resources spent breaking up a birthday bash (the helicopter time apparently cost 200 pounds and tack on the police efforts, including any investigation they conducted and time at the party, and gas for the four cars and van). So with Facebook surveillance the British may get less liberty and less security.

Commentators on the Register story noted their relief at living in the United States. They suggested that law enforcement and security officials would never be so foolish as to monitor Facebook traffic. Think again. The NSA’s Advanced Research Development Activity (ARDA) has funded research on the “Semantic Analytics on Social Networks: Experiences in Addressing the Problem of Conflict of Interest Detection,” which discusses how intelligence about people can be extracted from social networks. ARDA’s role is to spend NSA money on research that can “solve some of the most critical problems facing the U.S. intelligence community.” ARDA’s function is to make sense of the massive amount of data that the NSA collects.

Should Americans be worried about intelligence profiling a la Facebook? Many might think that the use of privacy settings on social networking sites would obviate the problem. First, studies suggest that most social networking site users use the default privacy settings, which are often the least privacy protecting and may reveal much of a user’s musings. Second, this assumption presumes that third party sites will not turn over social networking data, which they own, to the government, either for a pretty price or in the face of a subpoena or warrant. This assumption may be faulty. So what is all of the fuss? Automated intelligence profiling has obvious costs, such as the ones posed by the birthday party bust. It also has less apparent ones, such as mining misleading social networking data with other not-so reliable private and public database date and, poof, people end up on government watchlists.

Stock Xchange Photo

Lori Drew Tentatively Acquitted

Daniel Solove — Fri, 03 Jul 2009 02:41:50 +0000

Judge George Wu has ruled that he is planning to dismiss the charges against Lori Drew, the woman involved in the MySpace suicide case involving Megan Meier. Background about the case is here. According to an article by Kim Zetter of Wired, who has provided terrific coverage of the case:

“It basically leaves it up to a website owner to determine what is a crime,” said Wu on Thursday, echoing what critics of the case have been saying for months. “And therefore it criminalizes what would be a breach of contract.” . . . .

Wu told Assistant U.S. Attorney Mark Krause that if Drew had been convicted of the felonies, he would have let the convictions stand, and would have already sentenced her. But the misdemeanor convictions troubled him, because of the vague wording of the statute. . . .

To convict Drew of the felonies, prosecutors would have needed to prove two things: that Drew accessed MySpace “without authorization,” and did it for the purpose of committing a tortious act — in this case, to intentionally cause harm to Megan Meier.

But for the misdemeanors, the jury just had to find that Drew obtained the unauthorized access. Wu said that language, standing on its own, was too vague to pass constitutional muster in this case.

“I don’t see how the misdemeanor aspect would be constitutional,” he said. “That is the issue I’m wrestling with at this time.”

Wu also doubted that MySpace provided sufficient notice to members to hold them responsible. If a user didn’t read the terms of service, the judge asked prosecutor Krause, could they still be charged with violating them?

In previous posts (here and here), I argued that the CFAA should be held to be unconstitutionally vague. I’m encouraged that Judge Wu agrees, though I believe the CFAA is unconstitutionally vague not only in its misdemeanor provisions, but in its felony ones as well.

Congratulations to my colleague, Orin Kerr, who assisted in Lori Drew’s defense.

The AP story is here.

New Developments in Cryptography and Privacy

Deven Desai — Tue, 30 Jun 2009 18:35:08 +0000

According to Help Net Security, Craig Gentry, a researcher at IBM, appears to have found a way to allow “the deep and unlimited analysis of encrypted information – data that has been intentionally scrambled – without sacrificing confidentiality.” The solution involves a an “ideal lattice.” I’ll leave the explanation of all the math to the math/computer science folks. As the Help Net article notes, the solution seems to enable some great advantages for anyone providing cloud computing for:

computer vendors storing the confidential, electronic data of others will be able to fully analyze data on their clients’ behalf without expensive interaction with the client, and without seeing any of the private data. With Gentry’s technique, the analysis of encrypted information can yield the same detailed results as if the original data was fully visible to all.

It all sounds wonderful. One could have encrypted data and let others data mine while maintaining anonymity or privacy. Yet, something seemed odd to me. So I did what lawyers do, I called someone who knew more about computer science and asked for some help. That person explained that yes this could mean one could query an encrypted database without decrypting the data. The example to consider is a database of book purchases. One could ask how many people bought both book A and book B and see that result without ever seeing what a specific person purchased. Great, right? Not so fast.

As this person reminded me, with other sources of information one can figure out what a specific person did. That reminded me of the AOL debacle. With a little work, people were able to figure out who the anonymous subjects were.

All of which highlights that privacy is not binary. The cluster of information and the ability to analyze it seems often, if not always, to lead to problems about the use of information. So if this breakthrough allows a company or the government to claim that we should remain calm and all is well, we may want to remain clam but show how all may not be well. A few regulations about the use of the data even if supposedly anonymous, might allow the beneficial aspects of the solution to thrive while limiting the harms that can occur.

Image: WikiCommons
By: Gwenda; License: Public Domain
(My apologies to CS folks if the image does not match the breakthrough’s area of encryption)

The Many Deaths of Privacy

Frank Pasquale — Thu, 18 Jun 2009 15:00:49 +0000

As they follow the fascinating and heartening “Twitter Revolution” in Tehran, commentators worry that “the regime is prepared to detain dissidents — reportedly using Facebook and Twitter to locate them.” Yesterday also saw new reports of controversy over domestic surveillance by the US National Security Agency. Apparently the “agency routinely examined large volumes of Americans’ e-mail messages without court warrants.” Commentators like Glenn Greenwald and our own Dan Solove have done a great job explaining the legal details of NSA surveillance. I just want to comment on some of broader social trends that explain the upward ratchet of surveillance around the world.

Worries about the “death of privacy” have been prevalent for some time. We increasingly lack control over (or even awareness of) the digital profiles kept about us by businesses and governments. Another form of privacy—that at the core of the public-private divide—has also been in decline over the past couple decades. As the essays in Freeman and Minow’s book Government by Contract show, “privatization” is often less an arm’s length transaction between government and business than a veritable marriage of institutions. The recent explosion of public-private partnerships in the finance and auto industries further erodes the distinction between government and business. As William J. Novak’s essay in Government by Contract observes, much of what we think of as purely private markets are creatures of state action:

Robert Lee Hale contended that the sharp theoretical separation of public and private obscured the actual proactive role of public power in structuring the so-called private bargains that had such an immense effect on the distribution of wealth and power in American society. . . . [T]he private sphere is positively constructed by law and government and is consequently always suffused with (as opposed to immune from) sovereignty, force, violence, and coercion.

This is particularly true of communications technologies, which are often of great interest to government regulators. As Michael D. Birnhack and Niva Elkin-Koren explain in their brilliant article The Invisible Handshake, new and hidden exchanges of information for power are key to government-business relations:

Law enforcement agencies seek to enhance their monitoring capacity and online businesses seek to prevent fraud and combat piracy while strengthening their ties with authorities. . . . The invisible hand [of market-based communications] turned out to be very useful for the State, and it is now being replaced with a handshake, which, likewise, is invisible. . . . The use of private parties for executing government roles may create an unholy alliance between governments that wish to exercise their power and large online players that seek to maintain and strengthen their dominant role in the market.

Birnhack and Elkin-Koren were prophetic. The kind of government-business alliances they feared have become de rigeur in the national surveillance state. Both Chris Hoofnagle and Jon D. Michaels have described the development in some detail. Michaels’s story of FedEx is indicative of the larger trend:

[After FedEx's] CEO announced his company’s commitment to cooperating with the government “up to and including the line on which we would be doing a disservice to our shareholders” . . . FedEx has received a range of government perks. For instance, FedEx has been afforded special access to government security databases, presumably giving it a range of advantages over non-cooperating competitors. It has also been awarded a prized seat on the FBI’s regional terrorism task force (it is the only private company so represented) and thus has even more insider access to international security threats, again presumably well before its competitors receive such warnings. Moreover, FedEx has received an exceptional license from the State of Tennessee to develop an internal police force . . . .

Hoofnagle proposes that “the Privacy Act should apply to private sector companies that sell information to the government,” not just to the government itself. It seems to me that the first step to wisdom in this area is to realize that whatever we fear from direct government collection of data, we should fear from ostensibly “private” third parties that do the same. Otherwise, the ailing “public/private” divide could cause many more “deaths” of individual privacy.

At Long Last, A Cyber Security Czar

Danielle Citron — Wed, 03 Jun 2009 16:08:27 +0000

President Obama recently announced the creation of a White House cyber security coordinator who will oversee a national strategy for securing American interests in cyberspace. The coordinator will be a member of the National Security Council, reporting to the national security adviser and the senior White House economic adviser. President Bush started us in this direction by instituting the Cyber Initiative to overhaul the government’s cyber defenses. Yet we remain vulnerable to attacks on systems related to government operations, money supply, electric-power distribution, and transportation. Thus, devoting resources to shoring up cyber security is crucial.

Why do we need to coalesce power in a cyber security czar to oversee the nation’s information security efforts? Ira Winkler offers an explanation for centralizing this responsibility, rather than spreading it across various agencies. He considers complications that arise when multiple agencies engage in cyber security efforts of the offensive and defensive variety. He asks: what if the NSA engages in a long-term project to enter false information into an adversary’s database, unaware that the Army had hacked into the same database to try to track military movements? According to Winkler, the lack of coordination would allow the NSA’s efforts to mislead the Army. Divergent defensive efforts could similarly clash, thus undermining cyber security.

The President’s plan raises a number of unresolved issues. The President hopes to recruit the private sector’s help in devising a comprehensive security strategy. He has suggested building public and private partnerships around cybersecurity. How will the Administration accomplish this partnership? Would it be designed to get input from security professionals regarding government regulation of the private sector’s cyber security efforts? Will the government have a role in overseeing private networks? The heart burn involved in solving these issues is worthwhile given the critical importance of our networks to our economy and the real threat of cyber warfare.

Thanks to Wikimedia Commons for the image.

Online Symposium: Citron’s Cyber Civil Rights

Frank Pasquale — Tue, 14 Apr 2009 04:18:03 +0000

From tomorrow through Thursday, Concurring Opinions will be hosting a number of scholars invited to discuss Danielle Citron’s work Cyber Civil Rights. Responding to controversies over online attacks, Citron argues the following:

Social networking sites and blogs have increasingly become breeding grounds for anonymous online groups that attack women, people of color, and members of other traditionally disadvantaged groups. These destructive groups target individuals with defamation, threats of violence, and technology-based attacks that silence victims and concomitantly destroy their privacy. Victims go offline or assume pseudonyms to prevent future attacks, impoverishing online dialogue and depriving victims of the social and economic opportunities associated with a vibrant online presence. Attackers manipulate search engines to reproduce their lies and threats for employers and clients to see, creating digital “scarlet letters” that ruin reputations. . . .

Web 2.0 technologies accelerate mob behavior. With little reason to expect self-correction of this intimidation of vulnerable individuals, the law must respond. General criminal statutes and tort law proscribe much of the mobs’ destructive behavior, but the harm they inflict also ought to be understood and addressed as civil rights violations. Civil rights suits reach the societal harm that would otherwise go unaddressed and would play a crucial expressive role. Acting against these attacks does not offend First Amendment principles when they consist of defamation, true threats, intentional infliction of emotional distress, technological sabotage, and bias-motivated abuse aimed to interfere with a victim’s employment opportunities. To the contrary, it helps preserve vibrant online dialogue and promote a culture of political, social, and economic equality.

As I’ve noted before, I think this piece breaks new ground in applying venerable laws to the online environment. In this cyber-symposium, we propose to discuss the following issues:

What can the law do to respond to these threats?

How we deter harassment while promoting legitimate speech?

How do we balance the privacy rights of speakers and those they speak about in the new communicative landscape created by sites like AutoAdmit, Juicy Campus, Facebook, and anonymous message boards?

A list of scholars invited to discuss these issues appears below:

As co-organizers of the online symposium, Danielle, David Hoffman, Deven Desai and I welcome these guests and look forward to participating in the discussion. We have decided to default to “no comments” for this cyber-symposium. It was a tough decision, but ultimately we tended to feel that, for this topic in particular, the costs of editing and/or responding to abusive or off-topic comments would likely be higher than the benefits of our usual default to openness.

As recent controversies have shown, it’s easy for online mobs to inflict real injuries on their victims–and women bear a disproportionate share of the abuse. Citron argues that “acting against these attacks . . . helps preserve vibrant online dialogue and promote a culture of political, social, and economic equality.” We look forward to an animated and insightful discussion on how to balance liberty, equality, and privacy online.

Tracking Online Behavior to Combat Terror in the U.K.

Danielle Citron — Sat, 11 Apr 2009 23:07:32 +0000

As of last week, all Internet traffic in the United Kingdom will be archived for a year’s time. The British government has adopted the European Union directive requiring Internet access providers to store their users’ email traffic (i.e., the authors, date, and time of messages, not the messages themselves), VoIP calls (traditional phone calls are already monitored pursuant to previously adopted EU directive), and web surfing. Hundreds of public agencies, including law enforcement, will have access to data reservoirs teeming with personal information to fight “crime and terrorism.” The U.K. is poised to amass more data from the private sector in the name of counter-terrorism, considering proposals to require social networking sites, such as Facebook, to retain its British users’ records. The British government has adopted a threat model of governance: emergencies demand extraordinary measures to protect security, no matter the cost to other liberties.

The Obama Administration may not be as opposed to the U.K. approach as might be assumed. In the same week that the British adopted data retention as part of its anti-terror strategy, the Department of Justice vigorously defended the National Security Agency’s surveillance of countless Americans. In Jewel v. NSA, Electronic Frontier Foundation’s lawsuit challenging the National Security Agency’s warrantless wiretapping of Americans, the DOJ invoked the state secrets doctrine, insisting that the case must be dismissed without further inquiry in order to prevent “exceptionally grave harm to national security.” The DOJ also argued that the U.S. Patriot Act immunizes the U.S. from liability under federal wiretapping laws and the Stored Communications Act, going even further than the Bush Administration’s invocation of sovereign immunity for FISA violations. The emergency model of executive power may be here to stay.

No More What’s His/Her Face? iPhoto and Face Recognition

Deven Desai — Fri, 20 Feb 2009 23:54:29 +0000

CNET has a fluff piece about the fun of iPhoto’s new face recognition software. The author shares how the software identified a friend as a lemur and mistakenly identified friends as aged relatives. So here “the goofs are what make it fun.” One tags some photos and the software examines the entire library to find possible matches. As the report notes, “The science behind face recognition is complex and still evolving. In general, face recognition software looks for predictable patterns–characteristics and proportions that stay constant from one photograph to another, things like the distance between the eyes or from the eyes to the mouth.” (A friend of mine works on this area as part of his PhD program. The statistical models and math behind his work is quite sophisticated).

There is, however, a possible dark side to iPhoto. The more people tag help catalog photos, the more the general ability to track people will increase. Right now this information is on one’s computer. But I am guessing that online analogs exist or are about to (search facebook by face! and so on). I think it was Minority Report where the main character has to get new eyes to avoid surveillance recognition (yes that was retinal but you get the parallel). I am not saying this technology must stop (stopping technology is not a viable strategy). But as we move forward and play with new technology, the seemingly innocuous can have some rather potent impacts on how we live. Keeping an eye those potential changes may allow us to manage privacy and other interests before the problems occur rather than after.

Internet Safety

Jason Mazzone — Fri, 20 Feb 2009 21:47:13 +0000

Republican lawmakers have introduced companion bills in the Senate and the House entitled the Internet Stopping Adults Facilitating the Exploitation of Today’s Youth Act–or the Internet Safety Act. Each Bill imposes the following requirement: “A provider of an electronic communication service or remote computing service shall retain for a period of at least two years all records or other information pertaining to the identity of a user of a temporarily assigned network address the service assigns to that user.” The Bills appear to impose record-keeping requirements not just on traditional ISPs but on anybody operating a wireless access point (whether protected by a password or not): homes, hotels, coffee places, libraries, corporations, and schools.

Privacy Expectations: Being Seen vs. Being Recorded

Daniel Solove — Mon, 05 Jan 2009 03:01:45 +0000

An interesting case from the Wisconsin Court of Appeals embodies what I believe is a thoughtful and nuanced understanding of privacy. The case is Wisconsin v. Jahnke, 2007AP2130-CR (Dec. 30, 2008).

The case is a criminal prosecution of a man who secretly recorded his girlfriend in the nude, in violation of Wisconsin Statute § 942.09(2)(am). I’ve posted the text of the full statute below. The statute provides that it is a felony to record another person in the nude without that person’s consent “in a circumstance in which [the person] has a reasonable expectation of privacy.” The defendant contended that his girlfriend didn’t have a reasonable expectation of privacy because (as the court characterizes his argument), “she knowingly and consensually exposed her nude body to him while he was secretly videotaping her.” In other words, he argued that since she expected to be seen by him, she lost her expectation of privacy in her nude body.

The court wisely rejected the defendant’s construction of the statute:

Under this construction, Jahnke’s girlfriend’s privacy interest in not being recorded in the nude is left unprotected any time she permits anyone, under any circumstance, to view her nude. If she disrobes in a medical facility and permits medical personnel to view her, such personnel could record her without violating subsection 1 and, of course, later share that recording without violating subsections 2 or 3. It is one thing to be viewed in the nude by a person at some point in time, but quite another to be recorded in the nude so that a recording exists that can be saved or distributed and viewed at a later time.

The dissent raises some interesting arguments involving statutory construction and some prior caselaw. In particular, the dissenting judge points to an earlier decision defining the term “reasonable expectation of privacy” under the statute, holding that it “requires that the person who is depicted nude is in a circumstance in which he or she has an assumption that he or she is secluded from the presence or view of others, and that assumption is a reasonable one under all the circumstances.” State v. Nelson, 718 N.W.2d 168 (Wisc. App. 2006). The majority concluded that the Nelson definition was “incomplete” and that the “statute is plainly directed at reasonable expectations vis-à-vis not being recorded.”

The majority opinion wisely avoids a trap that many courts get into — understanding “privacy” narrowly as absolute secrecy or seclusion. Privacy involves a cluster of expectations involving the nature and extent to which their information is captured, used, and disseminated. It seems quite reasonable to assume that two lovers who see each other nude nevertheless expect privacy. They might be exposing their nude bodies to each other, but what they expect is that nobody else will see them. Since this is a criminal statute, it is important that courts avoid interpreting privacy too liberally, especially in areas where expectations of privacy are muddy. But it seems to me that under this circumstance–the nonconsensual recording of a person in the nude when she is exposing her body only to her boyfriend (rather than walking down a public street in the nude)–expectations are clear that the intended exposure is for the boyfriend’s eyes only.

The opinion is here.

WISCONSIN STAT. § 942.09(2)(am) provides:

Whoever does any of the following is guilty of a Class I felony:

1. Captures a representation that depicts nudity without the knowledge and consent of the person who is depicted nude while that person is nude in a circumstance in which he or she has a reasonable expectation of privacy, if the person knows or has reason to know that the person who is depicted nude does not know of and consent to the capture of the representation.

2. Makes a reproduction of a representation that the person knows or has reason to know was captured in violation of subd. 1. and that depicts the nudity depicted in the representation captured in violation of subd. 1., if the person depicted nude in the reproduction did not consent to the making of the reproduction.

3. Possesses, distributes, or exhibits a representation that was captured in violation of subd. 1. or a reproduction made in violation of subd. 2., if the person knows or has reason to know that the representation was captured in violation of subd. 1. or the reproduction was made in violation of subd. 2., and if the person who is depicted nude in the representation or reproduction did not consent to the possession, distribution, or exhibition.

Hat tip: How Appealing

The Year in Privacy Books: 2008

Daniel Solove — Sat, 27 Dec 2008 20:54:18 +0000

Here’s a list of notable books about information privacy published in 2008. Pick up a few to help stimulate the economy, save the publishing business, and learn more about privacy:

Colin J. Bennett, The Privacy Advocates: Resisting the Spread of Surveillance (MIT Press 2008)

A very informative account of those who work in the privacy advocacy community.

Anupam Chander, Lauren Gelman, and Margaret Jane Radin (editors), Securing Privacy in the Internet Age (Stanford University Press 2008)

A great collection of essays, from a symposium at Stanford Law School. A bit dated — the symposium was held in 2003 — but still worth reading. I have a piece in the book discussing data security vulnerabilities and the law — originally penned back in 2003, so I can say “told ya so!”

William Cuddihy, The Fourth Amendment: Origins and Original Meaning 602-1791 (Oxford University Press 2008)

The best and most comprehensive intellectual history of the Fourth Amendment ever written.

Cory Doctorow, Little Brother (Tor Teen 2008)

A contemporary version of Orwell’s 1984 — thought-provoking and engaging fiction, as usual from Doctorow.

Laura Donohue, The Cost of Counterterrorism: Power, Politics, and Liberty (Cambridge University Press 2008)

A detailed and compelling history of how 9/11 altered privacy and surveillance in the US and UK.

Sam Gosling, Snoop: What Your Stuff Says About You (Basic Books 2008)

A fascinating discussion of current psychological research about what the products we buy reveal about us.

Mohammad Hashim Kamali, The Right to Life, Security, Privacy and Ownership in Islam (Islamic Texts Society 2008)

A very interesting exploration of privacy in Islamic law.

Jon Mills, Privacy: The Lost Right (Oxford University Press 2008)

From my blurb on the book jacket: “Privacy: The Lost Right provides a clear, concise, and accessible synthesis of the field of information privacy.”

Lena Cowen Orlin, Locating Privacy in Tudor London (Oxford University Press 2008)

An historical account of privacy in everyday life during the sixteenth century in England.

John Palfrey, Born Digital: Understanding the First Generation (Basic Books 2008)

A deft and accessible account of how the generation growing up today will face increasing challenges to their privacy.

Bruce Schneier, Schneier on Security (Wiley 2008)

This book is a collection of Bruce Schneier’s essays. Schneier is always interesting and wise — and he’s always worth reading.

Wolfgang Sofsky, Privacy: A Manifesto (Princeton University Press 2008)

A. C. Grayling of The Times writes: “Its message, implied throughout, is that as one of the great values of civilisation and one of the essentials of personal and psychological integrity, privacy is worth fighting to regain.”

Daniel J. Solove, Understanding Privacy (Harvard University Press 2008)

D. S. Dunn, in Choice writes: “Legal scholars will want to read this book, but so will psychologists, communication specialists, public policy makers, philosophers, and anyone interested in where to draw the line between public and private life.”

Rob Walker, Buying In: The Secret Dialogue Between What We Buy and Who We Are (Random House 2008)

A compelling account of modern data mining and marketing practices.

Jonathan Zittrain, The Future of the Internet–And How to Stop It (Yale University Press 2008)

A fascinating examination of Web 2.0 and how new technologies can impede freedom and progress.

Lori Drew and the Computer Fraud and Abuse Act

Daniel Solove — Sun, 16 Nov 2008 19:52:07 +0000

The Lori Drew trial is set to begin this week, and it is a travesty that this trial is even taking place. The basic facts of this case are that Drew was the mother of a teenage daughter and she created a fake MySpace profile for a fictional teen boy to befriend a classmate of her daughter’s. It remains unclear what the motivation was for creating this fake profile, but from what I’ve read, it was to learn about rumors about her daughter. This classmate, Megan Meier, befriended the fake MySpace persona. At some point, the fake persona broke up with Meier, saying he no longer wanted to be friends, and Meier committed suicide.

Afterwards, there was considerable media attention in the case, although this didn’t happen until about a year later. There was outrage at Drew, with many people calling for blood. But local prosecutors determined, correctly in my opinion, that although Drew’s conduct may have been immature, shortsighted, and mean, it wasn’t criminal.

Enter an ambitious federal prosecutor, eager for fame and national attention. He indicted Lori Drew for creating a fake MySpace profile, which he contends is a violation of the Computer Fraud and Abuse Act (CFAA). The CFAA § 1020(a)(2)(C) makes it a criminal misdemeanor to “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer if the conduct involved an interstate or foreign communication.” The CFAA § 1030(c)(2)(B)(2) make it a felony if one “intentionally accesses a computer without authorization . . . , and thereby obtains . . . information from any protected computer” and “the offense was committed in furtherance of any . . . tortious act [in this case intentional infliction of emotional distress] in violation of the . . . laws . . . of any State.”

Basically, the theory of the prosecution’s case is that Lori Drew violated the CFAA because she violated the terms of service of Myspace which prohibited creating fake profiles, and she did so in furtherance of committing the tort of intentional infliction of emotional distress.

These CFAA provisions are, in my opinion, unconstitutionally vague. I believe they either must be struck down or saved with a narrowing interpretation. I personally would strike down these parts of the statute and have Congress start over. My argument is here, and I won’t repeat much of it, but the gist is that a vague law is one that either fails to provide the kind of notice that will enable ordinary people to understand what conduct it prohibits; or authorizes or encourages arbitrary and discriminatory enforcement. Because the CFAA would essentially criminalize many violations of website terms of service (if not nearly all), this allows the website operators to virtually write the criminal code.

So I hereby declare that on Concurring Opinions nobody may write a comment while wearing a hat. If you write a comment by wearing a hat, you’re violating our terms of service, and that’s a criminal violation under the CFAA! And if your comment is tortious (defamatory, invasive of privacy, etc.) then that’s a felony violation of the CFAA, and you could be put in prison for up to 5 years.

Of course, we all know that most of these violations wouldn’t be prosecuted. Prosecutors would use their discretion to go after only those cases that they found particularly bad. Like what happened in here with Drew. But this is precisely what the constitutional prohibition on vague laws is all about — it prevents arbitrary enforcement of laws by prosecutors because they’re dealing with an unpopular defendant or because they want to get some media attention.

If the government’s interpretation stands, it means that hundreds of thousands–perhaps millions–of Internet users are criminals. The absurdity of it all is mind-boggling.

What perplexes me about the case are the following questions:

1. Why is this case being prosecuted at all? The case is making a mockery out of the CFAA. I can think of no reason why this prosecution is going forward other than to be a way for the prosecutor to gain media attention and go after a person who is unpopular. Of course, I am only speculating as to the prosecutor’s motives, but I find this case so inappropriate that I can’t think of a legitimate motivation to bring it.

2. Why is this case going to trial? The judge, U.S. District Judge George Wu, apparently hasn’t made any rulings on dismissing the case. This is exactly the kind of prosecution that should be dismissed prior to prosecution. Why should a defendant have to stand trial, a very expensive and stressful experience, when as a matter of law, the statute either (a) shouldn’t apply to her conduct; or (b) is unconstitutionally vague?

3. In the most recent news, the judge has said he will allow evidence of Meier’s suicide, even though it isn’t relevant:

U.S. District Judge George Wu previously indicated he might bar any mention of suicide because it could be prejudicial, but he changed his mind after hearing lawyers’ arguments.

Wu said he was now convinced that many prospective jurors would be aware of the suicide from reading news reports or seeing a recent episode of the TV show “Law and Order” that involved a similar scenario.

He said he would instruct jurors, possibly at the outset of the trial, that the case was not about the suicide and that Drew is not charged with causing the suicide.

I have no idea if this AP report is correct about Judge Wu’s reasons for allowing the evidence of the suicide, but it strikes me as erroneous reasoning. The suicide has little to do with the violation of the CFAA. The alleged violation can be proven without introducing evidence of the suicide. The suicide is so prejudicial, likely to inflame the jurors’ passions and get them to hate Lori Drew for what happened rather than to focus on the alleged violation of law. It should be excluded from evidence, as this evidence is considerably more prejudicial than probative. The fact that pretrial publicity might mean that some jurors know about it is no excuse for sidestepping the rules of evidence. In many high profile cases that were much more widely publicized than this one, plenty of evidence was excluded that was more prejudicial than probative.

This case is basically a witch hunt. It is exactly what the Constitution mandates should not happen in criminal law. The law shouldn’t be vague. It shouldn’t be a tool that prosecutors can use whenever they don’t like a particular person. Judge Wu should dismiss this case immediately, either striking down these provisions of the CFAA or issuing a limiting construction. This case should not be going to trial.

Disclosure: My colleague, Orin Kerr, is one of the defense attorneys for Lori Drew. My opinions here are my own.

UPDATE: Scott Greenfield at Simple Justice has this critique of Judge Wu’s evidentiary ruling.

FBI Surveillance of Norman Mailer

Daniel Solove — Tue, 11 Nov 2008 21:38:41 +0000

The Washington Post has an interesting article about the FBI’s surveillance of author Norman Mailer:

In the summer of 1962, FBI Director J. Edgar Hoover was scanning his morning Washington Post when an item on Page A15 caught his eye. Norman Mailer’s most recent article in Esquire magazine had mocked Jacqueline Kennedy for, among other things, being excessively soft-spoken for a first lady.

Hoover scribbled a note: “Let me have memo on Norman Mailer.”

Over the next 15 years, FBI agents closely tracked the grand and mundane aspects of the acclaimed novelist’s life, according to previously confidential government files. Agents questioned his friends, scoured his passport file, thumbed through his best-selling books and circulated his photo among informants. They kept records on his appearances at writers conferences, talk shows and peace rallies. They noted the volume of envelopes in his mailbox and jotted down who received his Christmas cards. They posed as his friend, chatted with his father and more than once knocked on his door disguised as deliverymen.

The Mailer file wasn’t publicly known until very recently. According to the Washington Post article:

The bureau’s first confidential memo on Mailer, dated June 29, 1962, noted that the writer “admitted being a ‘Leftist’” and said that he had described the FBI as a “secret police organization” that should be abolished. An informant claimed that Mailer had been invited to a 1953 reception at the Polish Consulate in New York, though it was unknown whether he had attended. The memo quoted Louis Budenz, a former managing editor of the Daily Worker who broke with the Communist Party in 1945, as saying Mailer was a “concealed Communist.”

Apparently, if you want to avoid having an FBI file, don’t mock the First Lady and don’t criticize the FBI.

NSA Surveillance: Having a Laugh at the Expense of Your Privacy

Daniel Solove — Thu, 09 Oct 2008 17:20:29 +0000

ABC News reports about a new scandal arising out of the NSA Surveillance Program:

Despite pledges by President George W. Bush and American intelligence officials to the contrary, hundreds of US citizens overseas have been eavesdropped on as they called friends and family back home, according to two former military intercept operators who worked at the giant National Security Agency (NSA) center in Fort Gordon, Georgia.

According to one of the intercept operators, “US military officers, American journalists and American aid workers were routinely intercepted and “collected on” as they called their offices or homes in the United States.” Another intercept operator independently confirmed what the first one had reported.

Not only did they listen in on private conversations, with no connection to terrorism, but they also shared calls that they deemed interesting or funny:

Faulk says he and others in his section of the NSA facility at Fort Gordon routinely shared salacious or tantalizing phone calls that had been intercepted, alerting office mates to certain time codes of “cuts” that were available on each operator’s computer.

“Hey, check this out,” Faulk says he would be told, “there’s good phone sex or there’s some pillow talk, pull up this call, it’s really funny, go check it out. It would be some colonel making pillow talk and we would say, ‘Wow, this was crazy’,” Faulk told ABC News.

Faulk said he joined in to listen, and talk about it during breaks in Back Hall’s “smoke pit,” but ended up feeling badly about his actions. . . .

In testimony before Congress, then-NSA director Gen. Michael Hayden, now director of the CIA, said private conversations of Americans are not intercepted.

“It’s not for the heck of it. We are narrowly focused and drilled on protecting the nation against al Qaeda and those organizations who are affiliated with it,” Gen. Hayden testified.

Big Breaks in the Palin E-mail Breach Investigation

Paul Ohm — Sun, 21 Sep 2008 06:01:48 +0000

The odds that the Feds will find the person who broke into Sarah Palin’s e-mail account are considerably better than I had thought they would have been, because someone who claims to have committed the crime has bragged about it to the infamous 4chan image hosting site. (Quick CoOp aside, every day I better appreciate how the paper by new permablogger Danielle Citron–who first introduced me to 4chan–on Cyber Civil Rights will be a must-read in this day of 4chan and Jason Fortuny.) Although the posts have been deleted, Kim Zetter has reproduced them for Wired’s Threat Level blog. First, the user known as “Rubico” bragged about how he had breached the Yahoo account by providing Governor Palin’s supposedly private answers to the questions posed by Yahoo’s password recovery scheme:

it took seriously 45 mins on wikipedia and google to find the info, Birthday? 15 seconds on wikipedia, zip code? well she had always been from wasilla, and it only has 2 zip codes (thanks online postal service!)

the second was somewhat harder, the question was “where did you meet your spouse?” did some research, and apparently she had eloped with mister palin after college, if youll look on some of the screenshits that I took and other fellow anon have so graciously put on photobucket you will see the google search for “palin eloped” or some such in one of the tabs.

I found out later though more research that they met at high school, so I did variations of that, high, high school, eventually hit on “Wasilla high” I promptly changed the password to popcorn and took a cold shower…

Oh, and about Rubico’s screenshots? They apparently reveal the URL bar of Rubico’s browser, which in turn reveals that Rubico had not been browsing Yahoo directly but had instead been using an anonymizing proxy service called Ctunnel. Good idea, right?, because Yahoo no doubt captures and preserves the IP addresses used to recover passwords. But although using Ctunnel may have been a good idea, advertising that fact on a screenshot, it turns out, was not:

Gabriel Ramuglia who operates Ctunnel, the internet anonymizing service the hacker used to post the information from Palin’s account to the 4chan forum, told Threat Level this morning that the FBI had contacted him yesterday to obtain his traffic logs. Ramuglia said he had about 80 gigabytes of logs to process and hadn’t yet looked for the information the FBI was seeking but planned to be in touch with the agents today.

Apparently, providing the screenshot in this case was a particularly dumb move. In another interview Ramuglia notes:

Usually, this sort of thing would be hard to track down because it’s Yahoo email, and a lot of people use my service for that . . . . Since they were dumb enough to post a full screenshot that showed most of the [Ctunnel.com] URL, I should be able to find that in my log.

There are more lessons here than are worth listing. A few, after the jump:

For law enforcement:

The pressure is on. Usually, you would be forgiven for failing to track a crime across the Internet, but if Rubico is the person behind the breach (and I bet you know already whether Rubico’s claims match up with information in Yahoo’s logs), you should be able to find the identity of Rubico in pretty short order. Many news outlets are now reporting that Rubico is a 20-year old college student in Tennessee whose father is a Democratic state representative.

For would-be Internet criminals:

Don’t brag about your crimes.
If you’re going to brag, brag only to people you know.
If you’re going to brag, don’t post screenshots that give away important clues which make it easier to track you!
Use more than one anonymizing proxy.

For webmail providers:

As I said last time, people will be scrutinizing your security closely. After discussing Rubico’s boasts, Ed Felten has concluded that although it is hard for a service to simultaenously give away accounts to any anonymous person who requests one while still maintaining robust password recovery mechanisms, “it’s still surprising that Yahoo’s recovery scheme was so weak.”

For Gabriel Ramuglia, the person who runs Ctunnel.

Expect a mixed reaction. On the one hand, many will celebrate your data retention policies for helping the feds get one big step closer to solving this case. On the other hand, other people will consider it a betrayal that you held yourself out as an anonymizing service yet stored this information at all. You don’t endear yourself in the eyes of the latter group by moralizing about how people shouldn’t be using your service to “conduct illegal activities.“

For lawmakers:

What I said last time. (For examples of people pointing out gaps in the law, see this and this. Oh, and Bill O’Reilly is pissed too.)

For the media:

Be careful how you report this case. As best as I can tell, the 20-year old who is now having his name dragged through the mud has been linked to the Rubico posts through a series of connections being unearthed by bloggers. Reporters in the MSM seem to be repeating the conclusions of these bloggers without a lot of independent investigation. This guy may, for all I know, be rubico, but I have yet to read a single article that lays out a case airtight enough to justify such widespread dissemintation of the rumor.