Archive for the ‘Privacy (National Security)’ Category
The War Against Disclosure
posted by Frank Pasquale
Three remarkable recent lobbying campaigns go beyond the normal bounds of partisan sniping over “markets vs. regulation.” They threaten our capacity to understand how society is ordered: whom it serves, for what purposes, and at what costs. Consider these attacks on basic disclosure norms in politics and business:
1) Campaign Finance Disclosures: Regardless of ideology, almost everyone used to agree that campaign funding sources and amounts should be disclosed. 92% of Americans had that position in 2010. Justice Scalia has eloquently insisted that such disclosure laws violate no one’s rights. But thought leaders in the Republican party are now vigorously resisting disclosure, as Norm Ornstein observes:
The 2010 mid-term elections showed clearly how legal loopholes involving non-profit groups called 501(c)4s, and the failure to adopt clear regulations surrounding campaigns, can result in hundreds of millions of dollars of spending to influence campaigns that masked the identity of huge donors. In response to these realities, the Federal Communications Commission is considering requiring robust disclosure by TV stations of the major donors of political ads; the Securities and Exchange Commission is considering requiring public corporations to disclose to stockholders their spending on politics, and the White House has drafted an executive order to require companies applying for federal contracts to disclose their spending on political campaigns. . . .
Last month, Mitch McConnell [said] he views disclosure as “a cynical effort to muzzle critics of this administration and its allies in Congress.” . . . The Wall Street Journal’s full-throated support for transparency has disappeared as well; it blasted the FCC recently for considering requiring TV stations to put donors of campaign spots on the Internet . . .
John Yoo has also joined the debate, arguing that presidential power stops just short of the prerogative to require federal contractors to disclose their political donations.
2) Conflict Mineral and Extractive Industry Disclosures: One of the surprising victories for decency in the Dodd-Frank Act last year was a provision requiring certain disclosures from mining and resource extraction companies, and companies using “conflict minerals” from in or around the Congo. If you’re a consumer with preferences for certain industrial processes (say, those that don’t create incentives for rape, murder, and starvation), you want to be able to see which companies are fueling conflict and corruption and which are not. But intense corporate pressure is now delaying the rulemaking process needed to implement the disclosure provisions. According to Gerry Fay, “it is estimated that going ‘conflict free’ would cost companies just one penny per product.” But apparently that is too high a price to end corporate complicity in one of Africa’s bloodiest wars.
Read the rest of this post »
May 15, 2011 at 3:32 pm
Posted in: Constitutional Law, Corporate Law, Corruption, Government Secrecy, Law and Inequality, Politics, Privacy, Privacy (National Security), Technology
Print This Post
15 Comments
Chapter 1 of Nothing to Hide
posted by Daniel Solove
I’ve posted Chapter 1 of my new book, NOTHING TO HIDE: THE FALSE TRADEOFF BETWEEN PRIVACY AND SECURITY (Yale University Press, May 2011) on SSRN. The book is about some of the common arguments made in the debate between privacy and security. Chapter 1 is here.
May 9, 2011 at 10:38 am
Posted in: Articles and Books, Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement), Privacy (National Security)
Print This Post
One Comment
Nothing to Hide: The False Tradeoff Between Privacy and Security
posted by Daniel Solove
I’m pleased to announce the publication of my new book, NOTHING TO HIDE: THE FALSE TRADEOFF BETWEEN PRIVACY AND SECURITY (Yale University Press, May 2011). Here’s the book jacket description:
“If you’ve got nothing to hide,” many people say, “you shouldn’t worry about government surveillance.” Others argue that we must sacrifice privacy for security. But as Daniel J. Solove argues in this important book, these arguments and many others are flawed. They are based on mistaken views about what it means to protect privacy and the costs and benefits of doing so. The debate between privacy and security has been framed incorrectly as a zero-sum game in which we are forced to choose between one value and the other. Why can’t we have both?
In this concise and accessible book, Solove exposes the fallacies of many pro-security arguments that have skewed law and policy to favor security at the expense of privacy. Protecting privacy isn’t fatal to security measures; it merely involves adequate oversight and regulation. Solove traces the history of the privacy-security debate from the Revolution to the present day. He explains how the law protects privacy and examines concerns with new technologies. He then points out the failings of our current system and offers specific remedies. Nothing to Hide makes a powerful and compelling case for reaching a better balance between privacy and security and reveals why doing so is essential to protect our freedom and democracy.
This book grows out of an essay I wrote a few years ago about the Nothing-to-Hide Argument. The essay’s popularity surprised me and made me realize that there is a hunger out there for discussions about the arguments made in the debate between privacy and security.
The primary focus of NOTHING TO HIDE is on critiquing common pro-security arguments. I’ve given them nifty names such as the “Luddite Argument,”the “War-Powers Argument,” the “All-or-Nothing Argument,” the “Suspicionless-Searches Argument,” the “Deference Argument,” and the “Pendulum Argument,” among others. I also discuss concrete issues of law and technology, such as the Fourth Amendment Third Party Doctrine, the First Amendment, electronic surveillance statutes, the USA-Patriot Act, the NSA surveillance program, and government data mining.
May 3, 2011 at 12:50 pm
Posted in: Articles and Books, Book Reviews, Criminal Procedure, Government Secrecy, Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement), Privacy (National Security), Technology
Print This Post
One Comment
IP vs. Auto Safety
posted by Frank Pasquale
Two items of note on this topic recently. First, the NYT reports on NHTSA’s lazy approach to IP overreach by automakers:
For years, the National Highway Traffic Safety Administration has declined to post on its Web site reports from automakers about problems with their cars and about specialized warranty extensions that could save consumers large sums on repairs. . . . The technical service bulletins . . . provide information on unusual problems with vehicles . . . . Special service campaigns are a form of technical service bulletin that often tell dealers of warranty extensions for particular repairs. “Many manufacturers have asserted that technical service bulletin information is copyrighted and will not waive those copyrights,” [said] an agency spokeswoman . . . . “N.H.T.S.A. has a legal obligation to abide by copyright law.”
NHTSA could easily excerpt the gist of bulletins as fair use. Or it could communicate facts in them without using any of the actual language or diagrams they contain. Anyone who has taken a week of copyright knows about the idea/expression or fact/expression dichotomy. But copyfraud obfuscates this obvious workaround.
Second, ongoing legal battles over Toyota’s sudden acceleration incidents may lead to “security measures typically reserved for classified government secrets:”
The fight centers on access to Toyota’s source code, the software that controls sophisticated engine management and other electronics in its vehicles. Plaintiffs’ attorneys believe the code might contain evidence that could bolster their cases. The Japanese auto maker has been fighting to restrict access to the software, saying it needs to protect what it calls the “crown jewel” of its global enterprise.
Toyota said the attorneys should only be allowed to view parts of the code in a highly secure room, the likes of which is used by members of Congress or in trials against terrorists and spies for viewing classified information.
As I note in the piece, this kind of “qualified transparency” will become more and more common in tech disputes. Debates about “channeling” innovation protection (to patent or trade secret law) will increasingly need to take into account how patent law’s disclosure function could help more people understand potentially dangerous products.
April 3, 2011 at 1:38 pm
Posted in: Administrative Law, Consumer Protection Law, Intellectual Property, Privacy (National Security), Technology
Print This Post
2 Comments
New Privacy Law Reference Book: Privacy Law Fundamentals
posted by Daniel Solove
Professor Paul Schwartz (Berkeley School of Law) and I recently published a new book, PRIVACY LAW FUNDAMENTALS. This book is a distilled guide to the essential elements of U.S. data privacy law. In an easily-digestible format, the book covers core concepts, key laws, and leading cases.
The book explains the major provisions of all of the major privacy statutes, regulations, cases, including state privacy laws and FTC enforcement actions. It provides numerous charts and tables summarizing the privacy statutes (i.e. statutes with private rights of action, preemption, and liquidated damages, among other things). Topics covered include: the media, domestic law enforcement, national security, government records, health and genetic data, financial information, consumer data and business records, government access to private sector records, data security law, school privacy, employment privacy, and international privacy law.
This book provides an concise yet comprehensive overview of the field of privacy law for those who do not want to labor through lengthy treatises. Paul and I worked hard to keep it under 200 pages — our goal was to include a lot of information yet do so as succinctly as possible. PRIVACY LAW FUNDAMENTALS is written for those who want a handy reference, a bird’s eye view of the field, or a primer for courses in privacy law.
We wrote this book to be a useful reference for practitioners — ideally, a book they’d keep at the corner of their desks or in their briefcases.
We also think it can serve as a useful study aid for students taking privacy law courses.
You can check it out here, where you can download the table of contents.
March 21, 2011 at 12:44 am
Posted in: Articles and Books, Book Reviews, Privacy, Privacy (Consumer Privacy), Privacy (Electronic Surveillance), Privacy (Gossip & Shaming), Privacy (ID Theft), Privacy (Law Enforcement), Privacy (Medical), Privacy (National Security)
Print This Post
No Comments
NASA v. Nelson
posted by Daniel Solove
The U.S. Supreme Court has decided NASA v. Nelson, reversing the 9th Circuit 8-0. My thoughts about the case are here and here, and as I predicted, the Court rejected the 9th Circuit holding that the government employment background check questionnaires violated the constitutional right to information privacy. Fortunately, the Court kept its opinion narrow and didn’t use it as an opportunity to wipe out the constitutional right to information privacy, a right that the Court mentioned just a few times but that has taken on more of a life in the circuit courts. According to the Court:
We assume, without deciding, that the Constitution protects a privacy right of the sort mentioned in Whalen and Nixon. We hold, however, that the challenged portions of the Government’s background check do not violate this right in the present case. The Government’s interests as employer and proprietor in managing its internal operations, combined with the protections against public dissemination provided by the Privacy Act of 1974, 5 U. S. C. §552a, satisfy any “interest in avoiding disclosure” that may “arguably ha[ve] its roots in the Constitution.” Whalen, supra, at 599, 605.
Concurring in the judgment, Justice Scalia (joined by Justice Thomas) would have happily axed the right:
I would simply hold that there is no constitutional right to “informational privacy.” . . . . The Court’s sole justification for its decision to “assume, without deciding” is that the Court made the same mistake before—in two 33-year-old cases, Whalen v. Roe, 429 U. S. 589 (1977), and Nixon v. Administrator of General Services, 433 U. S. 425 (1977). . . . It is unfathomable why these cases’ passing, barely explained reference to a right separate from the Fourth Amendment—an unenumerated right that they held to be not applicable—should be afforded stare decisis weight.
I have little else to say about the case that I haven’t already said in my previous posts other than to reiterate my relief the Court kept its decision narrow. I believed from the beginning that this case was doomed because the constitutional right to information privacy focuses on preventing unwarranted disclosures not on restricting the collection of information via questionnaires.
January 20, 2011 at 1:30 am
Posted in: Constitutional Law, Employment Law, Privacy, Privacy (National Security)
Print This Post
One Comment
The Aftermath of Wikileaks
posted by Danielle Citron
The U.K.’s freedom of information commissioner, Christopher Graham, recently told The Guardian that the WikiLeaks disclosures irreversibly altered the relationship between the state and public. As Graham sees it, the WikiLeaks incident makes clear that governments need to be more open and proactive, “publishing more stuff, because quite a lot of this is only exciting because we didn’t know it. . . WikiLeaks is part of the phenomenon of the online, empowered citizen . . . these are facts that aren’t going away. Government and authorities need to wise up to that.” If U.K. officials take Graham seriously (and I have no idea if they will), the public may see more of government. Whether that more in fact provides insights to empower citizens or simply gives the appearance of transparency is up for grabs.
In the U.S., few officials have called for more transparency after the release of the embassy cables. Instead, government officials have successfully pressured internet intermediaries to drop their support of WikiLeaks. According to Wired, Senator Joe Lieberman, for instance, was instrumental in persuading Amazon.com to kick WikiLeaks off its web hosting service. Senator Lieberman has suggested that Amazon, as well as Visa and and PayPal, came to their own decisions about WikiLeaks. Lieberman noted:
“While corporate entities make decisions based on their obligations to their shareholders, sometimes full consideration of those obligations requires them to act as responsible citizens. We offer our admiration and support to those companies exhibiting courage and patriotism as they face down intimidation from hackers sympathetic to WikiLeaks’ philosophy of irresponsible information dumps for the sake of damaging global relationships.”
Unlike the purely voluntary decisions that Internet intermediaries make with regard to cyber hate, see here, Amazon’s response raises serious concerns about what Seth Kreimer has called “censorship by proxy.” Kreimer’s work (as well as Derek Bambauer‘s terrific Cybersieves) explores American government’s pressure on intermediaries to “monitor or interdict otherwise unreachable Internet communications” to aid the “War on Terror.”
Legislators have also sought to ensure opacity of certain governmental information with new regulations. Proposed legislation (spearheaded by Senator Lieberman) would make it a federal crime for anyone to publish the name of U.S. intelligence source. The Securing Human Intelligence and Enforcing Lawful Dissemination (SHIELD) Act would amend a section of the Espionage Act that forbids the publication of classified information on U.S. cryptographic secrets or overseas communications intelligence. The SHIELD Act would extend that prohibition to information on human intelligence, criminalizing the publication of information “concerning the identity of a classified source or information of an element of the intelligence community of the United States” or “concerning the human intelligence activities of the United States or any foreign government” if such publication is prejudicial to U.S. interests.
Another issue on the horizon may be the immunity afforded providers or users of interactive computer services who publish content created by others under section 230 of the Communications Decency Act. An aside: section 230 is not inconsistent with the proposed SHIELD Act as it excludes federal criminal claims from its protections. (This would not mean that website operators like Julian Assange would be strictly liable for others’ criminal acts on its services; the question would be whether a website operator’s actions violated the SHIELD Act). Now for my main point: Senator Lieberman has expressed an interest in broadening the exemptions to section 230′s immunity to require the removal of certain content, such as videos featuring Islamic extremists. Given his interest and the current concerns about security risks related to online disclosures, Senator Lieberman may find this an auspicious time to revisit section 230′s broad immunity.
January 7, 2011 at 1:25 pm
Posted in: Anonymity, Architecture, Current Events, Cyberlaw, First Amendment, Google & Search Engines, Government Secrecy, Privacy (Electronic Surveillance), Privacy (National Security), Technology
Print This Post
2 Comments
19 Points on Wikileaks
posted by Frank Pasquale
Don’t worry, it’s not another prolix post from me, just commentary on Jack Goldsmith’s Seven Thoughts on Wikileaks and Lovink & Riemens’s Twelve theses on WikiLeaks. (And here’s an FAQ for those confused by the whole controversy.)
Goldsmith, who takes cybersecurity very seriously, nevertheless finds himself “agreeing with those who think Assange is being unduly vilified.” He believes that “it is not obvious what law he has violated,” and Geoff Stone today said that many Lieberman-inspired efforts to expand the Espionage Act to include Assange’s conduct would be unconstitutional. Goldsmith asks:
What if there were no wikileaks and Manning had simply given the Lady Gaga CD to the Times? Presumably the Times would eventually have published most of the same information, with a few redactions, for all the world to see. Would our reaction to that have been more subdued than our reaction now to Assange? If so, why?
Lovink & Riemens provide something of an answer:
Read the rest of this post »
December 11, 2010 at 9:39 pm
Posted in: Anonymity, Current Events, Cyber Civil Rights, First Amendment, Google & Search Engines, Government Secrecy, Privacy, Privacy (Electronic Surveillance), Privacy (National Security), Science Fiction, Wiki
Print This Post
2 Comments
Wikileaks, Neoliberalism, and American Decline
posted by Frank Pasquale
The flood of revelations from Wikileaks raises some difficult questions about data security and government secrecy. Some privacy activists might enjoy seeing technology “turn the tables” on a national surveillance state, exposing its secrets as indiscriminately as programs like warrantless wiretapping gathered up citizens’ data. But retaliation is inevitable: just as the shoe-bomber provoked new TSA rituals, those who want more surveillance of the internet will point to the leaked cables. As Ross Douthat argues, “WikiLeaks is at best a temporary victory for transparency, and it’s likely to spur the further insulation of the permanent state from scrutiny, accountability or even self-knowledge.” We can expect more security initiatives, more indiscriminate classification of documents, and perhaps even more undocumented communications about critical issues.
The discussion of Wikileaks tends to focus on either process (can government officials still communicate securely?) or substance (what do particular cables reveal about American policy?). Those two conversations ought to converge. As Felix Stalder notes, policy promoting an “Information Sharing Environment” may well have created the conditions for this breach:
There is an inherent paradox. Vast streams of classified records need to flow freely in order to sustain complex, distributed and time-sensitive operations. Yet, since the information is classified, it needs to flow within strict boundaries which cannot be clearly defined on a general level (after all, you never know what needs to get connected with what in advance), and it needs to flow through many, many hands. This creates the techno-organisational preconditions for massive amounts of information to leak out.
Stalder also reveals how a larger neoliberal policy framework saps the trust structures that are necessary to build solidarity and order in institutions:
Read the rest of this post »
December 6, 2010 at 9:16 pm
Posted in: Cyberlaw, Military Law, Privacy, Privacy (Electronic Surveillance), Privacy (National Security), Technology, Uncategorized
Print This Post
22 Comments
The Year in Privacy Books 2010
posted by Daniel Solove
Here’s a list of notable privacy books published in 2010.
Previous lists:
This list contains a few books published late in 2009 that I missed on the 2009 list.
| Adam D. Moore, Privacy Rights: Moral and Legal Foundations (Penn. St. U. Press 2010)
My blurb: “Privacy Rights is a lucid and compelling examination of the right to privacy. Adam Moore provides a theoretically rich and trenchant account of how to reconcile privacy with competing interests such as free speech, workplace productivity, and security.” |
 |
| Cass Sunstein, On Rumors (Farrar , Strauss and Giroux 2009)
A very short essay on the damage wrought by false online rumors and a discussion of how and why such rumors spiral out of control, such as the phenomena of social cascades and group polarization. The book is worth reading, but quite short for a book (only 88 pages of primary text, in a very tiny book the size of a paperback). |
 |
| Stewart Baker, Skating on Stilts: Why We Aren’t Stopping Tomorrow’s Terrorism (Hoover Institution Press 2010)
A provocative argument for stronger security protections and a vigorous attack on privacy. The arguments against privacy are often glib and dismissive, but the book is worth reading for Baker’s extensive personal experience dealing with the issues.
|
 |
| Christena Nippert-Eng, Islands of Privacy (U. Chicago 2010)
A fascinating sociological account of people’s attitudes toward privacy and their behaviors with regards to preserving their privacy. It contains numerous interviews, quoted copiously, of people in their own voices discussing how they conceal their secrets. Engaging and compelling reading.
|
 |
| Hal Niedzviecki, The Peep Diaries: How We’re Learning to Love Watching Ourselves and Our Neighbors (City Lights Press 2009)
This book is an extended essay on self-exposure online. It is filled with many interesting anecdotes. The book has a journalistic style and raises observations and questions more than it proposes solutions or policies. The “notes” at the end consist only of a brief bibliography for each chapter, and there are no indications of which facts in the book came from which particular sources — a pet peeve of mine. |
 |
| Bill Bryson, At Home: A Short History of Private Life (Doubleday 2010)
An extensive history of the home, which as I’ve explored in some of my own writings, plays an important role in the history of privacy. Bryson’s narrative reads well, but he only supplies a bibliography at the end — no endnotes or indications of the sources of particular facts and details. I find this practice to be quite problematic for a work of history. |
 |
| Shane Harris, The Watchers: The Rise of America’s Surveillance State (Penguin 2010)
An engaging narrative that chronicles the surveillance and security measures the United States undertook after 9/11. Filled with interesting facts, the book reads like a story. |
 |
| Robin D. Barnes, Outrageous Invasions: Celebrites’ Private Lives, Media, and the Law (Oxford 2010)
There are some very interesting parts of this book, but it at times seems like a grab bag of topics relating to celebrities and its central argument could use more development. Nevertheless, it is worth reading because it discusses some interesting cases and explores comparative legal perspectives on the issues.
|
 |
| David Kirkpatrick, The Facebook Effect (Simon& Schuster 2010)
A fascinating account of the rise of Facebook. There are times when Kirkpatrick seems too sympathetic to Mark Zuckerberg and Facebook, but overall, this book is illuminating and engaging. |
 |
| Viktor Mayer-Schonberger, Delete: The Virtue of Forgetting in the Digital Age (Princeton 2009)
An interesting discussion of the “right to be forgotten.” Some of the ground in this book appears to be already well-trodden, but Mayer-Schonberger’s keen insights on data retention and destruction make it a worthy addition to the literature. |
 |
December 6, 2010 at 10:33 am
Posted in: Articles and Books, Book Reviews, Privacy, Privacy (Consumer Privacy), Privacy (Electronic Surveillance), Privacy (Gossip & Shaming), Privacy (ID Theft), Privacy (Law Enforcement), Privacy (National Security)
Print This Post
6 Comments
Fourth Amendment Pragmatism
posted by Daniel Solove
I just uploaded the final published version of my essay, Fourth Amendment Pragmatism, 51 B.C. L. Rev. 1511 (2010) to SSRN. Here’s the abstract:
In this essay, Professor Solove argues that the Fourth Amendment reasonable expectation of privacy test should be abandoned. Instead of engaging in a fruitless game of determining whether privacy is invaded, the United States Supreme Court should adopt a more pragmatic approach to the Fourth Amendment and directly face the issue of how to regulate government information gathering. There are two central questions in Fourth Amendment analysis: (1) The Coverage Question – Does the Fourth Amendment provide protection against a particular form of government information gathering? and (2) The Procedure Question – How should the Fourth Amendment regulate this form of government information gathering? The Coverage Question should be easy to answer: The Fourth Amendment should regulate whenever government information gathering creates problems of reasonable significance. Such a scope of coverage would be broad, and the attention wasted on the Coverage Question would be shifted to the Procedure Question. This pragmatic approach to the Fourth Amendment is consistent with its text and will make Fourth Amendment law coherent and comprehensive.
November 30, 2010 at 10:28 pm
Posted in: Articles and Books, Criminal Procedure, Privacy, Privacy (Law Enforcement), Privacy (National Security)
Print This Post
No Comments
Overly Optimistic Projections by the TSA
posted by Danielle Citron
On November 24, the TSA Blog declared victory for its full-scan machines. In a post entitled “Opt Out Turns Into Opt In,” TSA’s Blogger Bob wrote that what was supposed to be a protest day turned into a “TSA Appreciation Day.” The post cited scores of articles describing the absence of significant delays and few protests. Yet the lack of significant protest can be explained by many things that have nothing to do with flyers’ support for the move to full-body scan machines. The absence of significant protests no doubt had something to do with the fact that it was Thanksgiving. More generally, travelers have one thing on their mind: to get to their destination with as little embarrassment and delay as possible. Perhaps people might not want to make a fuss and been seen as troublemakers. Or as between a pat down by a TSA guard, the full screen body scan might seem less degrading.
The TSA Blog fails to mention a Zogby poll released on November 23 that casts doubt on the theory that people have opted into full body scans. The poll suggests that 61% of the 2,032 voters polled from November 19 to November 22 oppose the use of full body scans and TSA pat downs. Republicans and Independents oppose full body scans in greater numbers than Democrats. Of those polled, 52% believe that the enhanced security measures will not prevent terrorist activity, and almost half say it is a violation of privacy rights. The poll also finds that when given a choice, likely voters will choose full body scans over the TSA pat downs (48% to 7%), but 42% would rather have neither. So much for opting in.
November 26, 2010 at 5:48 pm
Posted in: Privacy, Privacy (National Security)
Print This Post
3 Comments
More Fun with the Airline Screening Playset: Body Imaging X-Ray Edition!
posted by Daniel Solove
I’ve been following the recent controversy over the TSA’s body imaging X-ray machines, otherwise known as the “backscatter” or “exhibit-yourself-in-the-nude” devices. It made me reminisce about an old post I wrote about the Playmobil airline screening playset.
I had not used the playset for a while. Five long years have elapsed since my post, and I had outgrown this toy and moved on to more advanced ones. But this recent controversy made me regress. . . .
November 19, 2010 at 1:02 pm
Posted in: Humor, Privacy, Privacy (Law Enforcement), Privacy (National Security)
Print This Post
33 Comments
Should We Prepare for a Cyber War? A Response to Seymour Hersch
posted by Doug DePeppe
The following is a special guest post:
About two weeks ago, The New Yorker published Seymour Hersch’s article “The Online Threat: Should We be Worried About a Cyber War?” Reflecting on Hersh’s controversial views which question the legitimacy of the national – indeed global response – to the cybersecurity threat, I recognized an incongruent juxtaposition of my own conclusions from my direct participation in this global effort versus Hersch’s conclusions. Because I believe Hersch’s views, extolled in a national publication, are both wrong and destructive, I am offering my observations and conclusions as a counterbalance.
In 2005, while participating in a planning event for the first-ever BULWARK DEFENDER Exercise – a Department of Defense exercise designed to test the military’s preparedness against cyber attack – a lively debate ensued between military attorneys, senior civilians and military planners. There was considerable disagreement concerning military authorities and permissible response actions to defend against such an attack. A persistent theme of the dialogue centered on the frequency in which attacks could not be attributed – that is, the inability to identify the source responsible for launching or sponsoring the attack. Under prevailing nation-state sovereignty rubric of international law, such attribution is widely regarded as a condition precedent to invocation of self-defense principles
Other legal issues also emerged, such as whether a cyber incident amounted to an “armed attack” – the critical factual trigger for self-defense authority. There was also debate over whether the Department of Defense was even authorized to respond to a domestic cyber incident, and if so what amount of harm and national security nexus were required. The most common cyber threats in 2005 were denial of service attacks, network intrusions, and data extraction from sensitive networks. Against this cyber incident factual background, an espionage analogy emerged: because espionage had occurred throughout the history of the Nation with no perceived necessity nor authority for a military response to espionage threats. Accordingly, some asserted a military response was equally inappropriate in response to the standard fare of cyber threats in 2005.
Since 2005, the world has witnessed a tangible change in the known risks from cyberspace, which have morphed from hypothetical to actual. Indeed, the security posture of a nation has now actually been threatened from cyberspace. In 2007, hackers attacked the vestiges of government legitimacy and economic viability in Estonia – occurring at a time of increased tension between Estonia and Russia. Georgia’s critical communications and other key resources were disabled in 2008 in concert with a Russian armed attack of Georgia. More recently, the highly sophisticated worm Stuxnet – widely reported as produced by a nation – targeted industrial control systems associated with the nuclear industry in Iran. And, just a week ago, the entire country of Myanmar was knocked offline just as the nation’s elections were to start.
November 9, 2010 at 1:26 pm
Posted in: Cyberlaw, Privacy, Privacy (National Security)
Print This Post
6 Comments
Surveillance State Accelerates: Fusion Centers and Beyond
posted by Frank Pasquale
My co-blogger Danielle Keats Citron and I have recently posted our draft article on “fusion centers” (forthcoming in the Hastings Law Journal). As we state in the abstract:
A new domestic intelligence network has made vast amounts of data available to federal and state agencies and law enforcement officials. The network is anchored by “fusion centers,” novel sites of intergovernmental collaboration that generate and share intelligence and information. Several fusion centers have generated controversy for engaging in extraordinary measures that place citizens on watch lists, invade citizens’ privacy, and chill free expression. In addition to eroding civil liberties, fusion center overreach has resulted in wasted resources without concomitant gains in security.
We began our work by holding (along with Priscilla Regan of GMU) a roundtable on fusion centers in April, 2009. Citron convened a panel on fusion centers at AALS in New Orleans. Since then, we’ve repeatedly found ourselves astonished by the pace of advances in domestic intelligence operations. In roughly reverse chronological order:
1) The Obama administration is now pushing for “Congress to require all services that enable communications — including encrypted e-mail transmitters like BlackBerry, social networking Web sites like Facebook and software that allows direct “peer to peer” messaging like Skype — to be technically capable of complying if served with a wiretap order.” The insistence on a “backdoor” here recalls the UAE/Saudi ban on Blackberrys—not exactly regimes the US should be emulating. Julian Sanchez and the ACLU provide more background.
Read the rest of this post »
September 28, 2010 at 1:15 pm
Posted in: Anonymity, Government Secrecy, Military Law, Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement), Privacy (National Security), Technology
Print This Post
No Comments
Cato Debate on Surveillance
posted by Frank Pasquale
Today brings news that the “Electronic Privacy Information Center [has] filed a request under the Freedom of Information Act for documents related to any agreement between Google and the NSA” on cybersecurity and related matters. The controversy over the request reminds me of an excellent recent debate on the digital surveillance state at Cato Unbound. Glenn Greenwald leads off by documenting an array of intrusive surveillance practices:
[T]he Bush administration . . . ordered the National Security Agency to eavesdrop on American citizens without the warrants required by law and without any external oversight at all. Despite the fact that the 30-year-old FISA law made every such act of warrantless eavesdropping a felony, “punishable by a fine of not more than $10,000 or imprisonment for not more than five years, or both,” and despite the fact that all three federal judges who ruled on the program’s legality concluded that it was illegal, there was no accountability of any kind. . . .
[Medical] “files” are maintained through a 2005 law which, the Government claims, authorizes it to monitor and record all prescription drug use by all citizens via so-called “Prescription Drug Monitoring Programs.” And there is a slew of other under-discussed surveillance programs whereby the U.S. government stores vast data on our private activities: everything from every domestic telephone call we make to “risk assessment” records based on our travel activities. A bipartisan group of Senators is currently promoting mandated “biometric ID cards” for every American as a purported solution to illegal immigration.
Paul Rosenzweig responds that there are several programs internal to federal agencies designed to protect privacy, including DHS’s “statutorily required Privacy Officer” and “Officer for Civil Rights and Civil Liberties.” Julian Sanchez insists that, regardless of these formal protections, the overall architecture of communications and data storage has enabled a quantum leap in surveillance:
Read the rest of this post »
September 14, 2010 at 8:33 am
Posted in: Anonymity, Google & Search Engines, Government Secrecy, Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement), Privacy (National Security), Technology, Uncategorized
Print This Post
No Comments
Sending Out an e-SOS
posted by Dave Hoffman
My colleague Duncan Hollis has a new article up on SSRN, An e-SOS for Cyberspace. In the article, Duncan argues that the “conventional response” to cyberthreats (e.g., hacking, e-espionage, cyberwar, and hacktivistism) isn’t working. Though “cybercrime laws proscribe individuals from engaging in unwanted cyberactivities[, such laws fail because] anonymity is built into the very structure of the Internet. As a result, existing rules on cybercrime and cyberwar do little to deter. They may even create new problems, when attackers and victims assume different rules apply to the same conduct.” Instead of traditional proscriptive approaches, Duncan proposes that “states adopt a duty to assist victims of the most severe cyberthreats. A duty to assist works by giving victims assistance to avoid or mitigate serious harms. At sea, anyone who hears a victim’s SOS must offer whatever assistance they reasonably can. An e-SOS would work in a similar way. It would require assistance for cyberthreat victims without requiring them to know who, if anyone, was threatening them.”
I read e-SOS in draft and found it fascinating, even though I have little intrinsic interest in international law or cybersecurity issues. Duncan does a terrific job of storytelling – did you know that the CIA allegedly tampered with the computer control system of a Soviet gas pipeline in 1982, causing the largest non-nuclear explosion in history? Or that the United States recently rescued North Korean sailors from pirates on receipt of an SOS? The article is full of such nuggets. And I think the proposal is pretty clever, and borderline workable. That’s high praise for a law review article.
Anyway, I advise that you download it before some cyberbully manages to hack SSRN and replace it with a trojan horse. And then come back here, follow me after the jump, and enjoy a classic Police video.
September 3, 2010 at 8:16 pm
Posted in: Cyberlaw, International & Comparative Law, Privacy (National Security), Web 2.0
Print This Post
9 Comments
Book Review: The National Security Presidency – A Primer with Provocation (Reviewing Denvir’s Freeing Speech: The Constitutional War Over National Security)
posted by David Skover
Freeing Speech: The Constitutional War Over National Security, by John Denvir. New York University Press, 2010, Pp. 189 pp., $45 (cloth).
If the volume of political dissent alone were the measure of a healthy democracy, then America has been thriving since 9/11. The roaring avalanche of critical perspectives on the “war on terrorism”— propelled by thousands of books, law review and political journal essays, and newspaper and magazine articles – might suggest that the state of our political discourse and of the constitutional order that it supports is fundamentally sound. Ironically, of course, this outpouring aims largely to prove the opposite: that unfounded claims of inherent executive authority to preserve national security imperil our free-speech system and tip the delicate balance of our tri-partite federal governmental powers.
To this resounding chorus of critique, John Denvir, the Research Professor of Constitutional Policy at the University of San Francisco School of Law, now adds his voice. Freeing Speech introduces Denvir’s concept of a “National Security Presidency” (NSP), explores several interrelated factors that have given rise to the phenomenon, and suggests political and judicial reforms as counter-forces to the excesses of the NSP. In all of this, Denvir hopes to contribute to a revitalization of democratic debate, a reanimation of political activism, a reaffirmation of constitutional safeguards – and, ultimately, to the reactivation of legislative and judicial checks on presidential overreaching in the name of national security.
Freeing Speech organizes its arguments by way of a triadic structure. After an introduction that discusses competing notions of the term “constitution,” the first three chapters of the book address the “problem” – that is, the complex of policies, practices, and pressures that have enabled Executive claims of extraordinary powers in the realm of national security. The final three chapters of the book then present the “solution” – that is, the reconfiguration of legislative and judicial responsibilities to secure the limitation of presidential power and the expansion of democratic discourse. As Denvir succinctly puts it: “The primary problem is the president’s ability to dominate debate on national security; the solution is a First Amendment that makes sure that opposition voices are heard.”
The “Problem”
The most potent vision of the NSP, as Denvir outlines it in Chapter 1, holds that the Executive has an inherent and largely unchecked constitutional duty to protect American lives and interests. Whether or not Congress sanctions his conduct either ex ante or ex post facto, the president may discharge his constitutional duty by acting on his own authority, given that time may be of the essence or secret information may not be disclosed. Moreover, neither legislative mandates nor individual constitutional rights should stand in his way. This NSP vision evolved through both Republican and Democratic administrations, beginning with Abraham Lincoln’s exercise of “emergency war powers” in the wake of the firing on Fort Sumter and continuing through the decades until its fullest blossoming in George W. Bush’s initiation of the current “war on terrorism.” Assured by the Justice Department’s Office of Legal Counsel that Congress cannot “place any limits on the President’s determinations as to any terrorist threat, the amount of force to be used in response, or the method, timing, and nature of the response,” Bush claimed powers to singlehandedly terminate treaty obligations, to employ “aggressive” interrogation techniques on suspected terrorists, and to issue “signing statements” authorizing underenforcement of legislative provisions that infringed on his constitutional authority, among other actions.
August 31, 2010 at 8:00 pm
Posted in: Book Reviews, Constitutional Law, First Amendment, Privacy, Privacy (National Security)
Print This Post
No Comments
Fourth Amendment Pragmatism
posted by Daniel Solove
William James
I just posted my new forthcoming essay on SSRN called Fourth Amendment Pragmatism, 51 Boston College Law Review __ (forthcoming 2010). Here’s the abstract:
In this essay, Professor Solove argues that the Fourth Amendment reasonable expectation of privacy test should be abandoned. Instead of engaging in a fruitless game of determining whether privacy is invaded, the United States Supreme Court should adopt a more pragmatic approach to the Fourth Amendment and directly face the issue of how to regulate government information gathering. There are two central questions in Fourth Amendment analysis: (1) The Coverage Question – Does the Fourth Amendment provide protection against a particular form of government information gathering? and (2) The Procedure Question – How should the Fourth Amendment regulate this form of government information gathering? The Coverage Question should be easy to answer: The Fourth Amendment should regulate whenever government information gathering creates problems of reasonable significance. Such a scope of coverage would be broad, and the attention wasted on the Coverage Question would be shifted to the Procedure Question. This pragmatic approach to the Fourth Amendment is consistent with its text and will make Fourth Amendment law coherent and comprehensive.
Here’s a brief excerpt from the introduction: Read the rest of this post »
August 30, 2010 at 10:14 am
Posted in: Criminal Procedure, Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement), Privacy (National Security)
Print This Post
7 Comments
Naked Lies and the Airport Body Scan
posted by Daniel Solove
Despite many objections, the TSA has been moving forward on using new airport body scan machines that show people’s naked bodies. I blogged about these machines here. “Never fear,” they told us. “We care about privacy. We really care! And so we promise we won’t store the images.”
So much for that promise. From CNET:
For the last few years, federal agencies have defended body scanning by insisting that all images will be discarded as soon as they’re viewed. The Transportation Security Administration claimed last summer, for instance, that “scanned images cannot be stored or recorded.”
Now it turns out that some police agencies are storing the controversial images after all. The U.S. Marshals Service admitted this week that it had surreptitiously saved tens of thousands of images recorded with a millimeter wave system at the security checkpoint of a single Florida courthouse.
The government never seems to be able to be honest when it comes to surveillance and privacy.
August 4, 2010 at 7:01 pm
Posted in: Privacy, Privacy (Electronic Surveillance), Privacy (Law Enforcement), Privacy (National Security)
Print This Post
2 Comments
