Notes from a Privacy Salon
At Harriet's place, in Oakland, California, August 7 2005
See the Privacy Salon topic in the Privacy and Civil Rights Tribe for more background
Introductions
Harriet: instilled in me since I was a kid -- my Dad always told me not to share my SSN (social security number) because it's a unique ID. As I got older, I started to wonder why I should be concerned -- we're all hiding the same kinds of things! If people were more open about what they do, so that we'd have less to hide -- would this change the dynamics?
gxaoui (sometimes referred to as 'G' in the notes): don't have a strong opinion, just here to discuss ...
Ed: also on Tribe; I'm on the radical right (so far right that I start to look left sometime). To me the war on terrorism really began with targeting the survivalists -- Timothy McVeigh and OKC changed a great deal.
Ryan: journalist, contributing writer for Wired News, covering privacy and civil liberties for a couple years. Fascinating subject -- Google complicates the whole question about what's private and what's public; war of terrorism makes quesitons of pers info, power critical. Not going away -- we'll be talking about it for 20 years.
Jon: researcher from MSR, interested in securiy privacy, etc. Oh, and Deborah's significant other.
NOTE: JON IS TAKING NOTES. Apologies for any mistakes!
Michael Michael (often 'MM'): involved with fringe culture for years -- Cacaphony Society, Burning Man (on the board) (often 'BM'), culture jamming, SRL. "Know a lot of things that I shouldn't know". BM is arguably the first global community, and it's open and free. There's a great advocay for openness and not being secret; in a society like this, there's no need for secrecy and protection -- as long as you're confident that you're not going to be harmed, in a society with complete communications where there's enough connections that you can feel secure. An experimental model for a future society? If we could reach the communities that feel they have to destroy something, you can change things: total freedom, and then you don't need privacy.
Eric: I was kind of ignorant about privacy until I became friends with Deborah ... interested in hearing other viewpoints.
David: wakethefuckupnews (blog/forum on tribe). also interested in open source software ... complete openness doesn't work in society today, because the government isn't sufficiently open
Deborah (often 'D'): my first privacy experience: I was 7, and had a diary ... and kept it under lock and key. Also, my Dad told us over and over again: "don't read other people's mail." That's always stayed with me: there are things that are personal and belong with you; if I want to share them with you, I will; if not, I won't. As a privacy attorney, I mostly look at how people interact with governments and corporations -- what regulates their behavior, what recourse do we have?
Note: if anybody came in after this: I tried to introduce everybody at least a little bit when they first participated, but if not, my apologies
Deborah's intro
In Enemy of the State, Will Smith's character got tied up in a situation where the gov't thought he was something that he wasn't. I saw this movie with some EFF friends, and an ex-DoD person ... who gave us running commentary. Whenever a piece of technology came up, he'd say "we can do that" or "we can almost do that". Example: trackingg him by the tags in his shoes (now, we'd call them RFID tags). You really can zero in on a person and track them as they're walking down the street, driving down the street. That brings me to today.
Things from my email box over the last few days (see References for links):
A woman who was a victim of identity theft; she was stopped by the police who had a warrant (for the other person), they wouldn't make a call to verify -- threw her in jail, strip searched, etc., before her husband started making calls and she got released
Bob Barr: Pentagon more involved with domestic surveillance
TSA lied about using commercial data to test Secure Flight -- didn't report it in the privacy act or federal register
NY subway bag searching -- haven't found anything; very expensive, yielded no arrests of any kind
RFIDs: entrepreneur (ex-CIA) is putting together a "Sorting Door" project (a la Sorting Hat in Harry Potter): the door can use whatever RFID tags that are on you and decide "are you a good person". What are the surveillance capabilities? Are there positives (e.g., convenience for consumers)?
What I see is a lot of abuse of personal information and data (by corporations, government). We don't have strong rules in this country; and the rules we have keep getting watered down by fear of terrorists.
I think things would be simplified if we got around the idea of privacy as a fundamental human right -- it's a dignity rightv.
Harriet: what if we were able to develop more tolerance for the differences?
D: agreed; and I think we're heading there -- but different people have different level of tolerances.
Civil disobedience
Harriet: Should we as a society be more accepting of acts of civil disobedience? For example, pot: maybe if people took more of the line "pot is wrong", then we could get things discussed at the societal level.
Deborah: but there have been a lot of movements in society against civil disobedience -- e.g., the Denver police force taking down information. What ends up happening is that people try to conform. I fly a lot, and look to see what people are wearing in lines, and it's almost down to a uniform: shoes that come off easily, pants with no metal. The ones who get pulled out of line are the ones who don't conform. I like the diversity.
general comments: [Tension between civil disobedicance and convenience.
Jon: What about the first amendment "free speech cages" at the conventions?
Various topics
Ryan: BM has been an interesting tradition
MM: push boundaries. Concepts not just of morality and legality/illegality very different from culture to culture. Rural Western frontier locale in Nevada ... with possibly the most diverse culture in the world. Basic premise: from the community's POV, you can do anything you want as long as you don't harm anybody else.
Ed: what people are trying to do now is moving more and more towards wars and ideology -- outlawing hate speech, it's a slippery slope. Today in England: glamorizing terrorism. What stops it from extending to sexual orientation? Guerilla movements in other countries?
MM: defintions. What's the definition of harming someone? And then, you're accepting the risk of serious injury/death just by being there. Downside: we run into localized standards of behavior. Land is both gov't and Pershing county (6K people) -- local laws dominated by the moral standards of a single town. In the immediate town, and Reno, "different" people are more accepted; but working at an info booth in the county seat, there's a lot of misinformation -- trying to convince them that BM values freedom just as they do.
Ed: will the backlash against terrorism be even more damaging than terrorism -- undoing the increased support for diversity since the 60s, increasing gov't control?
MM: because of 9/11, there's more risk and danger expressing yourself and being free
Ryan: to what extent should a society be morally obligated to tolerate calling for its destruction? e.g., British gov't wants to kick out imams who are advocating the destruction of the gov't
Ed: I'd draw the line at plotting a specific crime.
?: There's a faction of people out there who wants to change the status quo; that's always going to be the case -- the Christian right, for example (or Quakers, Mormons, anarchists). To say that all of a sudden, there's only one group ... that's just not realistic. Making a crime out of should be the distinction -- it's one thing to pamphlet somebody, another to blow up a church.
Ryan: Britain has gone further than the US. here, the rule is that your not allowed to provide material support for a named terrorist org.
Jon: definitional issues again
Ed: where do you draw the line at who's giving "material support"? web master? Attorney? [Lynn Stewart is one example, there may be others ...]
Lifestyle and medical privacy
Ryan: as a society over the last 30 years, we've changed a lot about how we think about illnesses: it used to be that we as a society couldn't talk about cancer, HIV, alcoholism. How do we feel about those revelations being a voluntary thing -- as opposed to something that's mandated? Should there be registries for people who have communicable diseases?
Profiling
NYC subway:
- if they found pot, would they let it go? The wouldn't have to; see John Perry Barlow's case.
Ed: if we're really intent on searches to help with terrorism, it seems that it might be better to have laws excluding use of things found in the searches for non-terrorist-related crimes.
Deborah: currently, "plain view" doctrine means that this can be used in any situation]
Ryan: Daniel Solove brings up the question: even if it's just theater and makes people feel better, is it worthwhile?
What's people's reactions to this the subway search? Articles in New Yorker and TV coverage imply that most people are comfortable -- is this representative?
Expecation of Privacy -- how do you view your email?
Harriet: from the Supreme Court's perspective, there's a key question as to whether people have a reasonable expectation of privacy in a particular area. Does this mean that if we say (for example) "let your email be open", then the police can get at anything?
Deborah: based on current law, yes; that's why a fundamental right is important. We'd need to get a lot of different perspectives on this -- sociologists, lawyers, marketers, etc.
Harriet asks everybody: how do you view your email?
Harriet: I use discretion in my email.
David: ECPA basically says your email isn't private. Many ISPs and web sites are is known for being very compliant with law enforcement agencies
Ryan: you may have more rights if you're running your own ISP
Ed: NASA Ames is running a big database for CAPPS. Is it because they're a big internet peering place and they can scan all the networks?
[Ryan: CAPPS was a profiling system, predecessor to SecureFlight. The gov't doesn't want to release the watch list -- because the 'bad guys' on it would know and try to get off
MM: technology is changing things; email as communication extends the notion of "self"
Ed: is text communication that idfferent from voice communications?
Harriet: yes, from a legal standpoint
MM: yes, because we're no longer speaking but yelling -- others can hear it
Ryan: even if you take the gov't out of it, everybody's had the weird moment when a conversation is forwarded
G: a long time ago, I learned that if you wrote something down, and don't want anybody else to read it, you need to destroy it. Not to say that it should, but that's reality. A phone conversation, today, probably has the same likelihood of being recorded.
Harriet: this reminds me of the definition between slander (something that's said) and libel (something that's written)
Steve [who went to law school with Harriet] Ahhhhhh
Ed: do people need a warrant to get at email?
David: they should, but I used to work at an ISP -- they often cooperated
Jon: ah, the Councilman case -- still up in the air.
Ryan: the defense here was that it wasn't spying on a communication in transit; he was actually looking at stored messages, so he didn't violate the law against wiretapping. The privacy community and the justice department are allied and are appealing the description. All the anecdotal evidence is that ISPs do turn info over for subpena's and even informal requests
Ed: what about IP Telephony?
Ryan: it seems like the FTC is going to require VoIP to require inclusion of wiretapping. It'll be interesting, because Skype is already out there
G: how much is the ease of the technology -- with email, it's easy to turn things over; with wiretapping, there's a lot more and it needs to happen real time.
Ryan: the FBI is still under minimization rules for wiretapping. If you've seen the Sopranos, you know that people talk about their kids for 2 1/2 minutes, then the real stuff for 30 secs, and then go back to the kids
David: rumors of a massive computer monitoring all communications and using voice recognitions
Ryan: Echelon is pulling down every signal they can and thinking about ways to use it. but government really distinguishes between american citizens and non-citizens.
David: as tech support, we all had access to people's passwords and emails. none of us spend time with this
Jon: cop stalking ex-wife
Ed: one of my concerns is that gov't gets more powerful and arrogant ... it becomes easier to taint or trash people
MM: we had an issue with LEO agents going into people's tents and arresting them for drugs -- they didn't know the laws about search and seizure and domicile. all the citations got thrown out. but as we try to extend our rights, we get a lot of pushback; and so we use a lot of the same techniques
harriet: Chicken Jones was saying to me today that the ultimate need we need for privacy is to allow us to discuss (if necessary) overthrowing the government. What if the government is corrupt? Should we expect more privacy?
Ed: when you get socially conservative powers-that-be wanting to disclose things on yourlifestyle...
Information collection
Ryan:in Europe, once you turn over info to a company, they can't use it for other purposes than they required ("no secondary uses"); law enforcement can only get it with a warrant. Here in the US, there's no such restriction -- which is one of the reasons that gov't can get info about phone records (since a commercial company has them, you no longer have a privacy interest). Warranty cards go to Choicepoint (often 'CP') et. al. ... there's two purposes of this:
1) background check file, for corporations and law enforcement
2) marketing. when you sign up for a magazine [or the ACLU!] they sell stuff
With a fundamental privacy right, none of this happens. Is this something we really want to stop? Sometimes it's useful to share the information (I subscribe to New Yorker, so I get a mailing from the Atlantic -- that's good)
Is what we're worried about power?
MM: I've got so many emails about breast enhancement, my email's become worthless
D: we need to trade -- I get viagra mail!
David: spam is untargeted
Jon: need to figure out what it is we like, and how it's possible to get it in this other world -- e.g., for magazines, voluntarily registring your interests could get all the benefits while keeping privacy
D: the FBI just got put into their privacy act that they can collect data without any requirement that it's accurate or relevant or minimized to particular purpose
David: it would be easy to retarget this at other gorups -- survivalists
Harriet: wouldn't that be challenged?
Jon: they've set up the ground rules so that a challenge wouldn't succeed
D: and whoever would challenge it wouldn't necessarily know, or have a budget to challenge ...
Ed: gov't seems to be moving towards preemption -- identifying possible opponents
David: preemption is good, but not the way they're doing it
D: just how random is the NY subway search?
MM: people coming into BM, all vehicles are searched. [Ryan: that's BM, not the police.] We're only searching for people trying to get in without paying, or searching for dogs or animals or vehicles; we're not going to bother somebody bringing in pot or explosives. The reason: public safety or economic survival of the community.
D: but you're searching everybody; so that's not profiling. this is the reason they can have metal detectors at airports: everybody's searched.
Eric: what happens if they find something other than weapons?
Jon: you're arrested. you lose.
G: at a big club/disco, where they've got metal detectors to find guns, we'd often find metal things where people hid their drugs (like a bullet). it puts security people in a weird position: you don't want to put the club's license at risk, but you also want this person to come in and spend money. [You often decide this by deciding whether or not there's a threat.]
David: it's a contract between people going ot the club and the club owners -- two private parties
D: no, the state is involved as well
MM: we have what we call a "stupid tax": if somebody tries to sneak in and we catch them, they have to buy the ticket -- plus pay an additional tax (of 200/300 dollars). the people helping also have to pay full price.
Harriet: I was at Cody's, and they had this petition: "is somebody reading over your shoulder?" Librarians don't want to give out what info people are reading ... I just don't care that much; I feel safe.
Jon: my Mom's a librarian, and their viewpoint is that it's fine if you make a choice to share all this information, but the law takes away the choice from everybody and catches librarians in the middle
Eric: why do you feel safe?
Harriet: I feel that I'm an honest citizen of the country, and if I read something rebellious, I have the best interests of the country at heart.
David: most Americans feel like they don't have anything to hide -- and the authors of the patriot act probably ahd that in mind. but where does this drift, for people who want to shape public opinion?
D: it can lead to intimidation
Ryan: there's a lot of activity that's not illegal that people don't want somebody to know about -- pornogrpahy, for example
David: or look at the sex offenders -- a pic of your kid can get you arrested
Eric: my dad went to a fotomat to develop a picture taken of me when I was 4 ... he felt it was very risky
Eric: now I'm really conscious that what I say on the net is readable by everybody and never going away ... but back in the 80's, on newsgroup servers ... hmm ...
harriet: I used to post under a pseudonym about (something illegal that I never did but am interested in). But that's okay; I can stand by it -- I revealed things about myself and can life with it
Eric: you feel like you can live with it today. but what if things change?
Ed: and also look at people in politics -- the question about Roberts and his adoption records
Ryan: one of my favorite thinkers about privacy is Daniel Solove. He argues that we should be less worried about "Big Brother" than we should about Kafka. There's still a strong drive in gov't to use predictive technologies, which can do weird things: how did I get on the no-fly list? How can I get off? We're not really worried that an FBI agent busts through the door right now (we live in a free society) ... it's more like you lose your job in the factor becaues people discvover you're a smoker [in Wisconsin -- reference?]. In one of the eric rudolph bombing's in atlanta, a gay nightclub, they interviewed surivivors on TV -- and a woman got fired when her boss saw her. "She's gay"
David: sexual orientation isn't protected -- legislation at the federal level got voted down
Ryan: but is the "big brother" thing happening now? is this something we worry about in the near future?
Ed: we're getting more powerful cops with more secrecy, and I don't like that -- more cops, without more power, would be better
David: Big Brother's not going to happen overnight, but we're moving in that direction ... and we won't realize that it's happened until it's too late. It's the slow bludgeoning of people's rights; they get taken away, they get used to it.
MM: much of my activities are directed to pushing the freedom boundary out, to create an environment, culture, community in a way that we can recreate the government
Ed: in the 60s/70s, where there was all the activity that today we'd call terrorism, there was also a strong free speech movement -- and that's not happening now
David: much of what goes on at BM is isolated there; mid-america doesn't see this
Jon: it's an experiment
MM: we're also pushing back on consumerism; one of our fears is that corporations will wake up and see this as a threat
D: I do think it's more of a Kafka scenario. A whistleblower at CP got my report for me and a colleague (didn't even need my SSN); it's about 20 pages, I'll pass it around ... if I ended up on a watch list because of this, how would I know?
Ryan: CP is a data aggregator, who pulls info from a bunch of different places
Harriet: but so much of it is wrong -- should people be relying on it?
Ed: they are.
Eric: suppose the only thing that's right is your neighbors -- and they're the ones who get hassled
Ryan: orgs working with kids (Big Brothers, Big Sisters) use this to background check people who are working with kids. Two risks: the wrong names can be flagged (Kafka-esque -- "oh, the other Ted Kennedy"), or people can rely too much on the data and miss the real sex offenders just because the report doesn't put it up.
Eric: I just had this with a standard credit thing. I lost a job because they ran a credit report that listed me as working for a religious organization -- not sure whether this was because they're afraid of the religious org, or because I didn't list it ... but I lost the job
D: their big customers are corps and gov'ts, not the consumers. if we call in to try to correct hings, they ignore it
David: the consumer has no power
D: right. and unlike my financial instituation -- where I have a relation -- I've got no relation with them
Ryan: for secureflight, they want to figure out terrorists not on watch lists; e.g., shared residences
David: this is one of the things that went into the guy who was killed by mistake -- he was flagged because he had the same address as a terrorist
Ryan: what about where db's are useful: sex offender registries?
David: somebody in my neighborhood, now in a wheelchair; people discovered that 10 years ago he had committed a sex offense, and people put flyers up everywhere and demonized him. eventually he shot himself. police never investigated ... if we want people to get healthier, we don't ostracize them further by making them feel even more out of line. This is one of the very hardest privacy issues ... my feelings might be different if I had kids ...
Ed: cameras in public are similar. I kinda like the way it works in britain -- if the police use it to solve the crimes afterwards
Harriet: what about cameras in high-crime areas
Eric: like the Western Addition
Jon: no evidence that this prevents crime or helps crime cleanup
Harriet: but does it make people feel better?
<all>: Yes!
David: they're hooking things up to use facial recognition systems
Ryan: technology isn't there yet (Jon and Ryan discuss Tampa experience and ACLU's FOIA requests). as a society, how do we decide: you can use it after the crime has happened? humans need to watch it? pervasive?
David: I like what the DMV is doing. people in the police dep't have access to it, and can pull up criminal histories. but they're real sticklers: there was an article with a pic of a license plate, and some bored person looked it up ... within five minutes, there were cops in his office, and she almost lost her job.
Eric: my dad in texas was an insurance agent, and he could tap into law enforcement dbs
David: not here
Wrapping up ...
Eric: Dept of Public Safety pulled my license for a medical condition ... so they're clearly able to access medical records. How'd that information cross over?
Ryan: interesting battles shaping up between private insurance and medical privacy. I was just at a conference devoted to geographical data. If you have a policy to protect your car against theft, and they say they'll give you $25 off to install a GPS, most people will say yes. Health insurance is interesting: if you apply on your own (not through a company) when you disclose preconditions, they send to the Medical Insurance Bureau so that it can be compared next time.
D: especially with medical records, you get to a "what's good for the public" issue: if I start to feel like my info is going everywhere, I might not tell my doctor -- in fact some doctors even tell their patients not to do this (since they're bound by law). At what point does this start to hit public healt?
Jon: on the GPS: people have told stories about getting tickets for computers checking that they're going toof fast ... might be apocryphal
Ryan: a rental car company in CA used GPS to track people driving the car out of state and socked them with big fees; now, as a result, rental car companies are restricted as to how they can use this. Will we see "good driver discounts"?
G: but you can still put in a burnt fuse
Jon: but that would be technically illegal
G: we'd all still do it
D: gov't is working on putting RFID's in passports -- basically, to make it easier to track you. The disclosure says if there's any kind of malfunction, your passport is invalid -- and you've got the responsibility to pay for the new one. So what happens if there's a law for your car that says "if anything breaks, you're liable"?
Ed: one fo the things that concerns me is that the gov't isn't revealing what they're doing -- the methodology (Ryan: "sources and methods") behind the cases is the reason for all the secret tribunals
Ryan: the question is that as citizens of a country that's being targeted by people who want to kill us ... how do we feel about this? this is the gov'ts big problem with transparency
David: a lot of this is people covering up mistakes
D: this is why I ahve an issue with David Brin. he basically argues "let's just give everybody cameras", on the theory that
Ryan: RNC -- many of the people arrested got off
Jon: but that didn't equalize things; they were still arrested and had a big hassle. Abu Ghraib is another example.
MM: burning man is like that
Eric: I've heard 5th hand that there are issues with law enforcement at burning man confiscating cameras
MM: I've heard that to. we don't think this kind of confiscation is legal
G: the internet -- and ability to exchange information -- has brought community together: model train enthusiasts, transsexual. blogs, personal web sites, IM ... you're not the only person out there
Ed: radicalism is now devalued in US
Ryan: "the only good revolution was the american revolution"
Ryan: there's a stasis (republicans/democrats): in the 20s and 30s, there was a vibrant left wing of anarchists
Ed: we're now suspicious, resentful, distrustful of the fringe, where it used to be respected and idealized
G: the whole american dream has changed since then ... is that's a whole differnet conversation?
Jon: not completely diffeerent. reinvention used to be part of the american dream; there's an interview with CEO of CP where he says "that's going to be lost"
Ryan: his vision is to use info to make the entire world like a small town. for some people, that's very appealing -- get away from the city where we don't know anybody, get away from the wild west
G: in an urban environment, things are much more transitory
Ed: there's not the trust built up over time ...
Ryan: one of the other things that CP CEO argues is that over time, as everybody's foibles are showing, we'll become more tolerant: you shouldn't worry so much about things that were on their record in the past
Eric: and you see that in presidential elections with drugs -- nobody cares any more
Jon: sure -- easy for the CEO to say. and maybe nobody cares whether people running for president have done drugs, but the rest of us can still get in trouble for this
G: and all that information that's out there, a ton of it's inaccurate ... so suppose there's something horrible on your record. people google your record, and the top 10 things are all negative ...
D: the CP CEO also says that he feels that CP -- the corporation -- should have a voice in what the rights and responsibilities of the citizen are, and I don't know if I'm comfortable about that
MM: it has a lot to do with who's valuing the information
D: but I have no recourse against corporations
Ryan: a good point; and they're generally much less open than gov't
Jon: and their interests aren't necessarily aligned.
harriet: I look forward to the discussion continuing -- in tribe, on blogs. I'm not ready to let my email go!
References
Five stories from Deborah's inbox
Some other topics covered