For more information about the event, see Unlawfulaccess.ca, and register for the event on Facebook. You can also download/print/share copies of the poster for the event. This will be a really great event, and the mixture of formally separated technical and political panels should do a great job in outlining the range of issues that lawful access legislation touches upon.

Other posts you might be interested in:

1. Announcement: Lawful Access Report Now Available
2. (Un)Lawful Access: Vancouver Premiere & Panel Discussion
3. Lawful Access, Its Potentials, and Its Lack of Necessity

Image by mattwi1s0n

New surveillance powers are typically framed using benevolent and/or patriotic languages. In the United States, we see the PATRIOT Act, the Stored Communications Act, and National Security Letters. Powers associated with this surveillance assemblage have been abused and people have been spied upon in violation of the law, bureaucratic procedure, and regardless of demonstrating real and present dangers. The UK has the Regulation of Investigatory Powers Act (RIPA), which significantly expanded the capabilities of police and intelligence to monitor citizens in previously illegal ways. This legislation is also used improperly, as revealed in the yearly reports from the Interception Commissioner. In Canada, the Canadian government has publicly stated its intention to press ahead and introduce its lawful access legislation despite concerns raised by the public, members of the advocacy and academic community, and the information and privacy commissioners of Canada. Here, we can also expect uses of lawful access powers to overstep stated intents and infringe on Canadians’ rights, intrude upon their privacy, and injure their dignity.

Over the past months I’ve been actively involved in working with, and talking to, other parties about lawful access legislation. This has included speaking with members of the media, publishing an op-ed, and conducting various private discussions with stakeholders around Canada who are concerned about what this legislation may (and may not) mean. Today, in the interests of making public some of the topics of these discussions, I want to address a few things. First, I quickly summarize key elements of the lawful access legislation. Next, I note some of the potentials for how lawful access powers will likely be used. None of the potentials that I identify depend on ‘next generation’ technologies or data management/mining procedures: only technologies that exist and are in operation today are used as mini-cases. None of the cases that I outline offer significant insight into the operational working of stakeholders I’ve spoken with that can’t be reproduced from public research and records. I conclude by questioning the actual need for the expanded powers.

What is Lawful Access?

Lawful access legislation enhances policing and intelligence powers. As recognized by Ontario’s Information and Privacy Commissioner, Ann Cavoukian, “it is highly misleading to call it “lawful.” Let’s call it what it is – a system of expanded surveillance.” In general, there are three classes of access powers associated with such legislation: search and seizure provisions, interception of privacy communications powers, and production of subscriber data. On the basis of past lawful access legislation that has been tabled, but not passed, we can expect forthcoming legislation to ‘modernize’ the existing criminal code to accommodate several of these powers.

To begin, the legislation is expected to require telecommunications service providers (such as Internet service providers, web forums, bloggers, etc) to be able to decrypt any communications they are responsible for encrypting. Such encryption services might be used to ensure customer privacy, such as by offering secured communications between parties. While communications may generally be secure they cannot legally be made secure from the government by a service provider offering a turnkey encryption solution. In effect, communications will thus be pseudoencrypted: protected against adversaries with the same level of power as the services’ users, but unprotected against the more powerful agents such as the state.

In addition, telecommunications service providers (TSPs) will need the ability to retain data on subscribers for up to 90 days. TSPs may be served with preservation orders, which would require them to retain data on specific individuals. Preserved data would be transferred to authorities once they have secured a production order from a judge and issued the order to the TSP. The TSP could then delete/destroy the preserved data.

Whereas preservation orders are used to require storage of the content of communications, police can access subscriber information without first receiving a court order. A wide variety of information may be disclosed, including:

• name
• address
• telephone number
• electronic mail address
• Internet protocol address
• mobile identification number
• electronic serial number
• local service provider identifier
• international mobile equipment identity number
• international mobile subscriber identity number
• subscribe identity module card number associated with the subscribers’ service and equipment

This information lets authorities definitely identify individuals and the records held on them by the TSPs used in the communications process. Accompanying the no-warrant-required elements of the bills is a capacity for authorities to install ‘number recorders’ in TSPs’ communications hubs in exigent circumstances. As noted by the National Post’s Kathryn Blaze Carlson:

A number recorder, which records the telephone numbers associated with outgoing and incoming calls, would be installed remotely by a telecommunications provider at their call centre hub. The installation can last up to 60 days, but it could be extended to one year if a warrant is obtained and if the investigation involves organized crime or terrorism.

The legislation also introduces the ability to activate and/or monitor the signals emitted from location-enabled devices that Canadians carry with them or are in regular contact with. Police can do this today but lawful access legislation would permit them to activate disabled locational systems (e.g. your phone’s GPS) including in covert ways. Such actions could be undertaken with court supervision or, potentially, in instances of emergency or exigent circumstances. It should be noted that access to geolocatational information is more expansive than just your physical location at a particular time: the legislation is also intended to let authorities discover the location of ”transactions such as geo‐tagged comments or photos from private sector service providers.” (.pdf source).

It is unlikely that a targeted Canadian will be made aware of lawful access-enabled surveillance unless charges are brought to bear. As noted in the letter that was sent to the Prime Minister’s Office in August 2011 (.pdf), and re-confirmed in Blaze’s piece, there are elements of the legislation that impose ‘gag’ orders on anyone who is ordered to comply with lawful access powers. Specifically,

Clause 6(2) permits the government to impose, in regulations, sweeping and categorical confidentiality obligations on service providers that will apply across all interception warrants. Second, under Clause 71, any telecommunications service provider obligated to comply with a warrantless seizure request will be subject to the secrecy provisions in proposed section 7.4 of PIPEDA. Proposed section 7.4 of PIPEDA prevents organizations from disclosing the fact of their cooperation with state efforts to spy on their customers. The sweeping nature of the secrecy measures envisioned by these provisions is in stark contrast to existing practice, where gag orders must be requested from a judge and justified on a case by case basis. The problem with such measures is that they will prevent individuals from challenging abuses of the powers granted in this Bill.

Lawful Access, In Summary

As I wrote in an op-ed in the Vancouver Sun in October, this legislation can be summarized as requiring:

• Corporate surveillance. Internet service providers, mobile phone providers, and even the websites that Canadians visit could become agents of the state, forced to preserve records of Canadians’ actions at the request of authorities (Source);
• Minimal oversight. Audit powers will be offloaded to privacy commissioners without corresponding material or legislative resources to effectively conduct audits and limit abuse (Source);
• Warrantless disclosures. Internet users’ subscriber information will be disclosed to authorities, regardless of the information’s usefulness or uselessness to an investigation (Source);
• Secrecy orders. Authorities might collect Canadians’ private information without those Canadians ever knowing about the collection or the reasons for collecting it (.pdf Source).

Lawful Access in Practice

A large number of Canadians who look at these proposals may feel some unease but then quickly assert that the legislation is ultimately innocuous. The standard rhetoric is that “If you have nothing to hide then you shouldn’t fear this legislation.” Such a statement obfuscates the realities of both contemporary policing and what studies demonstrate about how people actually versus rhetorically understand privacy. To begin, contemporary policing is deeply invested in identifying deviant behaviour and acting upon it in an ‘actuarial’ manner. David Lyon, a world-leading scholar on the topic and issue of surveillance, presciently wrote the following back in 2003:

As with database marketing, the policing systems are symptomatic of broader trends. In this case the trend is towards attempted prediction and pre-emption of behaviours, and of a shift to what is called “actuarial justice” in which communications of knowledge about probabilities plays a greatly increased role in assessments of risk (Lyon 2003: 15-16).

Thus, mistakenly being situated in a wrong category can have significant implications on one’s life regardless of whether a person has ‘something to hide’ or not. The degree to which one is public is (arguably) secondary to the ‘types’ of people one knowingly and unknowingly associates with, whom their associates are connected to, and the risk profiles that are assigned to those communicative partners and their colleagues. To make this somewhat clearer, consider the following: In college/university/your private life you likely communicate with individuals who have, or presently do, agitate peacefully against certain state behaviours. You may or may not be aware that those individuals agitate. Perhaps you have/do engage in discussions with those people online, either on websites that those opposed to certain state behaviours, or in the comments section of newspaper articles, or other electronic formats. Should the police be interested in tracking the individuals invested in an issue (e.g. legalization of marijuana, legal issues surrounding sex work in Canada, protest against federal decisions concerning Sri Lanken immigrants, etc) then they may request available subscriber records for all who have participated in the online discussion.

Now, let’s again assume that you were not supportive of opposition to an official government position and thus aren’t necessarily of direct interest to authorities. Regardless, your subscriber data and that of everyone else engaged in these discussions might be requested by the police. No warrant is required to provide this information. Let’s assume that you used a unique pseudonym and throwaway email address. The authorities would gain access to your IP address and email address. They would get the same information for every participant of the discussion. With this information they could turn to whomever provided the email account, as well as contact the ISP who provisioned the IP address at the specific time that you posted your message. With information from the email provider they may be able to definitely identify the ISP that you use and, from there, your name, address, and so forth. Thus, you as ‘hungrybunny19′ are identified as ‘John Smith’ who was involved in discussion with individuals who authorities are interested in monitoring for some reason or another. John Smith, you, are subsequently added into a database as associating with persons the authorities find questionable. Mr. Smith will never know that he was added into such a database because the service provide could not legally disclose that the information had been released and, as a result, Mr. Smith’s life prospects may change for legally associating and speaking with those who were similarly engaged in legal speech and association.

Perhaps you insist that this doesn’t describe you: you would never communicate about anything in any electronic environment with any person that would ever be of interest to authorities (and, if you can make and stand by these claims, you’re vetting the people that you speak with using intelligence-service-level thoroughness!). Perhaps you have a cellular phone and you have passed near major events that the police have an interest in monitoring. For example: you may have been involved in peacefully assembling during the G20 in Toronto, been a passive spectator at the Vancouver riots, visited an Occupy camp, or may simply pass by union members who are protesting working conditions in a public space several times a day as you walk around your city conducting legitimate personal business. In all cases, the authorities may have an interest in monitoring individuals associated with such groups. Using a technology known in the United States as ‘Stingray’ or, more precisely, IMSI catcher surveillance equipment, police can impersonate a cellular tower and capture all the IMSI numbers within several kilometers of the catcher (.pdf source). The IMSIs, or International Mobile Subscriber Identity numbers, can be taken to a mobile phone provider and used to compel the subscriber data associated with the caught IMSI numbers. Thus, should one of these catchers be deployed by authorities ‘just in case’ an individual may find their personal information sent along to police on the basis of their physical presence during a legal public event. The capacity to acquire IMSI numbers en masse, combined with legal powers to compel subscriber information, creates the perfect framework for mass fishing expeditions based on where citizens are physically present.

Canadians may be uncomfortable with these propositions but immediately follow up with the position that such concerns are hyperbolic. Unfortunately, a brief reflection on the history of surveillance in Canada and present actions taken by our allies (depressingly) suggests that these concerns are practically banal. During the Vancouver Olympics authorities spent incredulous amounts of money on security, an element of which was allocated towards monitoring legal associations of citizens. As disclosed in memos there were no specific, credible, terror threats against the Vancouver Olympics. Despite these threat assessments, citizens who had specific political and economic concerns were routinely placed under surveillance. In effect, citizens conducting legal actions that might lead to disruptions of the games became targets of a surveillance apparatus designed to prevent the next Munich massacre. Surveillance and intelligence gathering did not solely focus on citizens involved in protesting government actions or others associated with the Olympics, but also their contacts, friends, students, former partners, and academic and professional acquaintances. Efforts were also made to recruit neighbours, friends, and acquaintances to spy on suspected activists, and the RCMP tried to legally shield itself from fulfilling FOI requests under the guise of operational security. Under lawful access legislation, the lines of inquiry could expand beyond police associations of people online – the aforementioned people communicating in Web forums – to using technologies like IMSI catchers to identify who is often nearby citizens-under-suspicion. Having coffee with a work friend who advocates for social justice on the weekends could lead to unsuspecting, and utterly uninvolved, citizens being stuck in the same net as their law-abiding colleagues who are caught in the web of actuarial justice.

Further, Canadian authorities have a history of monitoring those who are often the least-advantaged in our society. Consider that Military Intelligence places native communities under intense surveillance. As reported in the Globe and Mail, eight reports were generated in just 18 months. Surveillance was conducted to record Natives’ concerns surrounding new tax policies, potential to blockade Highway 401, and possible future protests, lobbying activities, and lawful associations. The group responsible for this surveillance was a counter-intelligence body charged with “identifying, investigating and countering threats to the security of the Canadian Forces and the Department of National Defence from foreign intelligence services, or from individuals/groups engaged of espionage, sabotage, subversion, terrorism, extremism or criminal activities.” At no point in the reports is it evident that native groups fell under the latter set of descriptors. With the introduction of lawful access legislation other authorities could have become involved in the surveillance and compelled telecommunications providers to disclose the contents of communications. Further, using previously mentioned tactics embedded in the legislation, subscriber information and who was communicating with who could have been determined without warrant or court oversight.

In short, it is entirely plausible that lawful access could be utilized to expand existing surveillance practices conducted by Canadian authorities. There are serious oversight concerns. Specifically, the Office of the Privacy Commissioner of Canada would be hamstrung in auditing the surveillance conducted and its motivations, and the legislation fails to extend the powers of that Office to accommodate the expansion of police powers. Further, where local or provincial police conduct surveillance, audit responsibilities would fall to provincial commissioners and they similarly lack the resources to mount full-scale audits of authorities’ proposed expansive surveillance practices. This position is forcefully stated the Information and Privacy Commissioner of Ontario, Dr. Ann Cavoukian. She poignantly writes that,

Canadians must press the federal government to publicly commit to enacting much-needed oversight legislation in tandem with any expansive surveillance measures. Intrusive proposals require, at the very least, matching legislative safeguards. The courts, affected individuals, future Parliaments and the public must be well informed about the scope, effectiveness and damaging negative effects of such intrusive powers.

The Need for Lawful Access

Over the past months I’ve had the opportunity to speak with counsellors, engineers, privacy officers, and policy staff for telecommunications service providers. This has ranged the gamut from ISPs to an ex-VoIP provider employee to webmasters responsible for large online environments to policy wonks for massive Internet-based corporations. The various parties I’ve spoken with have held varying opinions on the previously proposed lawful access legislation; everything from cost issues, to rights problems, to implementation woes, to issues of being identified as a ‘problem’ in the policing process.

All, however, have told me in almost every case that data is requested on exigent circumstances grounds it is, in fact, disclosed.

What, specifically, is the need driving the legislation then? Authorities have routinely insisted that lawful access powers would only be used when investigating the most serious of crimes (e.g. see this audio interview with the CBC’s ‘Spark’) but in other jurisdictions we regularly have seen expanded surveillance used to investigate less serious offences. For extensive documentation of such ‘expanded uses’, see Priest’s and Arkin’s Top Secret America: The Rise of the New American Surveillance State, allegations that the FBI conducted dragnet surveillance to trace bank robbers, claims that routine conversations lead individuals to be labeled as potential terrorists in government databases, inappropriate monitoring of hundreds of people each year, yearly monitoring of over 500,000 people’s communications records, or the usage of terror-based surveillance provisions to ensure children are registered in correct school districts. I cannot state emphatically enough: this is a very small sampling of how widely used lawful-access style legislation is used by our closest of close economic, political, and military allies. There is no reason that Canadian authorities won’t demonstrate the same types of behaviour.

British Columbia’s Information and Privacy Commissioner, Elizabeth Denham, has asserted that authorities have not demonstrated evidence that investigations have been thwarted under existing access powers. Authorities have failed to provide empirical data that reveal a clear and present need for enhanced powers contained in past, or forthcoming, lawful access legislation. Authorities have noted concerns with warranting processes and if these concerns are legitimate (insofar as they can be documented using empirical datasets) then perhaps Parliament should consider modifying the warranting process or increase resources so that warrants can be processed more rapidly. If, however, authorities are simply looking abroad and finding their power lacking in comparison – and cannot clearly outline why they need their compatriots’ powers to protect us from truly serious crimes – then they should not be granted expanded powers. Police and other authorities should not be permitted to infringe upon Canadians’ rights and further erode expectations of communicative privacy, associative privacy, or basic dignities on the basis of cross-jurisdictional envy.

Other posts you might be interested in:

1. Publication: (Un)Lawful Access, Its Potentials, and its Lack of Necessity
2. (Un)Lawful Access Forum in Ottawa
3. The Anatomy of Lawful Access Phone Records

Image Courtesy of Harvard University Press

The Offensive Internet: Speech, Privacy, and Reputation is an essential addition to academic, legal, and professional literatures on the prospective harms raised by Web 2.0 and social networking sites more specifically. Levmore and Nussbaum (eds.) have drawn together high profile legal scholars, philosophers, and lawyers to trace the dimensions of how the Internet can cause harm, with a focus on the United States’ legal code to understand what enables harm and how to mitigate harm in the future. The editors have divided the book into four sections – ‘The Internet and Its Problems’, ‘Reputation’, ‘Speech’, and ‘Privacy’ – and included a total of thirteen contributions. On the whole, the collection is strong (even if I happen to disagree with many of the policy and legal changes that many authors call for).

In this review I want to cover the particularly notable elements of the book and then move to a meta-critique of the book. Specifically, I critique how some authors perceive the Internet as an ‘extra’ that lacks significant difference from earlier modes of disseminating information, as well as the position that the Internet is a somehow a less real/authentic environment for people to work, play, and communicate within. If you read no further, leave with this: this is an excellent, well crafted, edited volume and I highly recommend it.

The Internet and Its Problems

Solove kickstarts the collection with his essay, ‘Speech, Privacy, and Reputation on the Internet.’ His general argument (and that of many other contributors) is that there must a ‘rethink’ on notions of privacy, insofar as privacy must be re-calibrated against freedoms of speech to better balance the two principles. With the rise of Web 2.0 there is a sliding scale of what is considered worthy of publication; in the early-mid 20th century journalists may have focused on issues and topics that were in the general public interest but, as everyone becomes a publisher, what constitutes ‘general interest’ is increasingly focused on smaller and smaller audiences. As a result, more is being written about those of (relatively) inconsiderable import and when such writings are defamatory, hurtful, or otherwise harmful the authors of the speech are protected under Section 230 of the Communications Decency Act from potential legal rejoinders. To rebalance privacy and free speech – with the argument being that free speech is presently over-privileged – Solove suggests adopting a notice and takedown system akin to that included in the Digital Millennium Copyright Act (DMCA). While the DMCA is oft-criticised for being overly broad and inappropriately used by rights-holders to chill speech, Solove insists that similar problems would not arise because:

1. abusing takedowns should be penalized;
2. whereas copyright interests are well-resourced this is not often the case with defamation and privacy complainants.

It is important that some kind of rebalancing/effective redress system is adopted, in Solove’s argument, because there is no guarantee that exposing the foibles of one another will lead to a shift in social ideals to accept such foibles. Instead, it is just as likely that there will simply be more people hurt – the exposure of others does not necessarily mean that one changes their own perceptions of the nature of social norms. His concerns echo those of Mayer-Schonberger’s book, Delete: The Virtue of Forgetting in the Digital Age.

Whereas Solove emphasizes a take-down approach, Keats Citron explores the destructive nature of online mobs and how the Internet magnifies harmful behaviour. She rejects the notion that individuals can, and should, combat mobs alone and instead argues that “robust protection of cyber civil rights would promote more valuable speech than it would inhibit” (33). Drawing on literature of group behaviours, she identifies four central ways in which the Internet aggravates cyber mob behaviour:

1. groups with homogeneous views tend to become more extreme when they deliberate;
2. group members often lack a sense of personal responsibility for their acts;
3. groups are more destructive when they dehumanize their victims and are more aggressive when authority figures support efforts;
4. “Cyber mobs see victims as digital images that can be eviscerated without regret” (37).

Whereas criminal law and civil torts cannot reach the harms experienced by individuals, groups, or society as a result of mob behaviour, civil rights laws do address such shortcomings. Given that self-expression is key to autonomy there should be minimal protection of expression that is primarily (or even solely) meant to extinguish others’ expressions. This may mean that website operators are held accountable for facilitating anonymous attacks, and this may in fact lead to the protection of groups’ civil rights by limiting the capacity for the mob to form in the first place.

Picking up on the challenges that can arise from anonymous online speech, Levmore tries to tackle the issue in “The Internet’s Anonymity Problem.” Specifically, he argues that the novelty and free speech claims that have protected the Internet from legal regulation have resulted in excessive costs to the targets of offensive speech. Such costs might be diminished by moving to an Internet that integrates identification or notice-and-takedown policies. Given that Section 230 of the Communications Decency Act was put into place in the 1996 to let the Internet grow – the Internet was, at the time, a nascent space that could have had its growth stunted by onerous or overzealous laws – the present ‘mature’ state of the Internet suggests that it is time to repeal this section. Today the Internet suffers from both juvenile and hurtful comments, as well as from a high noise-to-signal ratio that imposes costs to find, filter, and manage information online. In shifting to a ‘non-anonymous’ Internet Levmore believes that there would be fewer of these hurtful comments and a better signal-to-noise ratio, though he does grant that a ‘simple’ notice-and-takedown system may be appropriate for some online venues. Ultimately, however, he asserts that Section 230 should be repealed and that Internet providers be recognized more like newspapers by becoming liable if they do not impose or enforce takedown, notice, or non-anonymity principles and laws.

Nussbaum’s contribution to the book, titled “Objectification and Internet Misogyny,’ asserts that the online community must confront objectification when it occurs online, especially when such actions relate to the historical (misogynistic) objectification of women as instrumental for male pleasure. In particular, she finds that the key facets of objectification as it relates to online mob-like behaviour aim to:

1. reduce to body;
2. reduce to appearance;
3. silence.

Each of these elements are key to ‘shame justice’, which is “justice by the mob: the dominant group are asked to take delight in the discomfort of the excluded and stigmatized” (73). To those who make assertions that misogyny and shame are ‘typical’ or ‘historical’ practices she responds as such: “To say, “It’s traditional,” and “It’s part of culture” is not to dispense with the need for an account” (75). Thus, in investigating the case of misogyny online we (re)articulate underlying problems surrounding the social conditions of masculine development, the legitimacy of using shame to hijack the agency of a person’s mind, social relationships, and access to employment, and the relationship between online misogynistic behaviour and gender-based hate crimes. Ultimately, she avoids making the strong policy claims of the other contributors to this section, instead arguing that it is key to educate men about the acceptability of weakness, to educate men of the inherent value of women, and to dissolve or reform modernistic assumption of male identity in order to address the roots of misogynistic violence and harms.

Reputation

Cass Sunstein’s “Believing False Rumors” continues his project of articulating the harms that arise when individuals engage in discourse. His work is excellent, though (arguably) derivative of his books Infotopia: How Many Minds Produce Knowledge and On Rumors: How Falsehoods Spread, Why We Believe Them, What Can Be Done. In essence, the liberal ideal that the marketplace of ideas will sort out falsehoods is demonstrably incorrect, especially when applied to the Internet. As a result, some kind of chilling effect on false statements of fact is important to establish, both to limit harm inflicted onto others and to enhance the functioning of democratic discourse. A danger, noted by Pasquale in his “Reputation Regulation: Disclosure and the Challenge of Clandestinely Commensurating Computing,” is that the spread of information online (sometimes including false facts and rumors) can be incorporated into reputation systems that impact citizens and customers. As a result, he argues that legislation is required to make such systems more just. Legislation must:

1. “…ensure that key decision makers reveal the full range of online sources they consult as they approve or deny applications for credit, insurance, employment, and college and graduate school admissions” (108);
2. address the use of reputation score systems to avoid black-box evaluations that defeat the aims of accountability and transparency of choices made.

Speech

Brian Leiter’s contribution, “Cleaning Cyber-Cesspools: Google and Free Speech,” argues that the potential chilling effects of overturning Section 230 of the Communications Decency Act are overstated and unduly protect low-speech at the expense of people’s dignity. He defines the cyber-cesspool as

an amalgamation of what I will call “tortious harms” (harms giving rise to causes of action for torts such as defamation and infliction of emotional distress) and “dignitary harms,” harms to individuals that are real enough to those affected and recognized by ordinary standards of decency, though not generally actionable. (155)

Identifying Mill (the theoretical source of many of the claims that the marketplace of ideas/speech will sort out falsehoods) as a radical empiricist on the basis that he insists that all truth and knowledge are a posteriori, Leiter maintains that there is some speech (e.g. Jane Doe ought to be forcibly sodomized) that  is absolutely without moral standing. Online, harms from speech are made worse by Google and the protection Section 230 affords to intermediaries (e.g. blog operators). The repeal of this section would not impact “the ability of individuals to speak freely, just in their ability to exercise that purported right to speak freely in cyberspace” (167).

Leiter emphasizes Google’s role in making content from cyber cesspools highly accessible to casual web surfers, and argues that Section 230 should be repealed and make Google liable “for its negligence in disseminating tortious material” with an addendum that a “more radical proposal would make Google liable for disseminating material constituting dignitary harms as well; I remain agnostic on whether that would be advisable” (171). To avoid liability Google ought to set up a “panel of neutral arbitrators who would evaluate claims by private individuals that Google is returning search results that might constitute tortious or dignitary harms” and second that “the Google panel would have authority to provide several possible remedies in the event it concurs with the complainant that the material in question is more likely that not to constitute actionable material or a dignitary harm” (170). I remain unclear as to why, exactly, Google should be required to establish such panels and make private decisions about the nature of free speech; it seems like this is a task for the judiciary. Shouldn’t the Department of Justice, to follow his claims, be responsible for assigning a team of judges to determine each and every claim of harm and assure that their decision falls within the confines of existing case law? Further, the position that Google somehow ‘disseminates’ information like a newspaper fails to acknowledge the fundamental difference between ‘push’ and ‘pull’ modes of delivering content: unlike a broadcaster, Google’s expressions of speech (which are, effectively, what algorithmic search is equatable to) are called upon by users rather than imposed on the individual using the Web. They are not curators of the Web but instead rely on the claims of others to assert their own suggestions based on search terms; broadcasters, on the other hand, are curators. That individuals have chosen to see Google as a curator does not make Google a curator any more than people choosing to believe that I am a professor makes me an actual professor.

Stone’s “Privacy, the First Amendment, and the Internet” is based around the argumentative point that “[i]f speech is sufficiently valuable to merit First Amendment protection when it is spoken over a backyard fence or published in a local newspaper, then (at least presumptively) it is also sufficiently valuable to be protected when it is disseminated on the Internet … as a matter of first approximation, the fact that speech on the Internet can cause more harm than speech in a local newspaper is not a reason to accord it any less protection under the First Amendment. The balance between value and harm remains more or less constant” (175-6, emphasis added). In considering what kinds of speech are actionable he rightly notes that it is important to be careful about what is meant by a ‘threat’ under the law (and that thus is illegal speech). Specifically, “incitement to commit unlawful conduct does not mean statements that might cause others to commit crimes or even statements that are intended to encourage other to commit crimes … for speech to be punishable as incitement, it must expressly incite unlawful conduct” (186, emphasis added). Regardless of the nature of the law, social and technological change means that privacy laws cannot effectively address non-newsworthy invasions of privacy (though they may be able to address some of the worst threats online). Referring to Brandeis and Warren’s tort, Stone notes that “… even if the First Amendment itself is not sufficient in principle to “swallow the tort,” the combination of the First Amendment and social and technological change has, for all practical purposes, gobbled it up completely. To argue otherwise is simply to tilt at windmills” (193).

Expressly engaging with the issue of collective privacy rights – where the rights of members of a collective are in contradiction – Strahilevitz suggests that privacy laws begin to recognize, and courts adopt, constructive partition. Such a partition fragments a collective resource and assigns elements of it to the collective’s members. Admittedly this is an imperfect solution – sometimes interests are inextricably linked – but at least offers a way to address some of the collective privacy issues involved in FOIA requests.

Privacy

Rodrigues’ essay rounds out the book, and it really is one of the absolute highlights. In “Privacy on Social Networks: Norms, Markets, and Natural Monopoly” he argues that there are privacy issues with social networks and that a key way of addressing them involves encouraging competition between networks so that privacy (in effect) becomes one of many points these networks compete on. He acknowledges that while people share personal information on social networks it is predominantly shared for ‘semi-public’ purposes; in most cases, controls and mitigating elements preclude the information’s absolute sharing of information. To conceptualize the elements of privacy-based competition in social networks he identifies the following facets:

1. Privacy policies – reflective of contractual relationships between the site and user(s);
2. Privacy practices – how the privacy policies are actually implemented;
3. Privacy controls – means by which users can control their personal information;
4. Data security – how diligent the site is in actually securing data from outside forces.

Rodrigues points to Facebook as the incumbent ‘natural monopoly’ that is largely dependent on its vast network effect to achieve financial success and usefulness for its users. The worry is that a monopolist may raise switching costs by locking users in, while simultaneously exploiting its monopoly power to erode past privacy practices “in exchange for greater income by directly reselling personal information and contact information, despite the interests of its entrenched users” (245). To alleviate the power of the natural monopoly he suggests that the government establish data portability regulations, enabling users to freely move between networks and thus enabling competitors to rapidly scale if the monopolist (or other competitor) acts in a manner contrary to users’ privacy desires. While some might point to the ‘successful’ petitions that Facebook users launch when the company initiates particularly onerous and privacy invasive changes to the service, Rodrigues argues that these petitions happened with competition “lurking in the background”; “in the end the profitable alternative will be the path that Facebook takes” (255).

Issues and Concerns

Laden throughout the book is a (legitimate) concern for the harms that can befall people who are defamed, mobbed, or targeted online in disingenuous ways. Many authors take issue with Section 230 of the Communications Decency Act, arguing that without the protections afforded by this section the law would be better resourced to persecute those engaged in hate crimes, defamation, and so forth. In most of these cases, authors assert that what would suffer is largely ‘low value’ speech instead of ‘high value’ speech, and that abuse of a notice-and-takedown or identification regime would likely be marginal at best. It is important to recognize claims these for what they are: normative assertions of the value of particular venues and modes of speech. Under proposed changes, sites like 4chan.org would be almost immediately dissolved, to say nothing of many IRC channels, and website owners would suddenly face liability if they refused to take down content on First Amendment grounds. In essence, proposals to remove Section 230 will arguably see a massive increase in the already large number of Strategic Lawsuits Against Public Participation (SLAPP) suits. What happens when a company begins to go after individuals who have injured its corporate personhood? While many authors emphasize that only individuals could file suit against one another, I worry that this is just the thin edge of the wedge – corporate interests will flock to expand how the proposed changes can be utilized by their own well-resourced legal departments.

Despite this problem, it is perhaps either one of naivete or a case of my projecting pessimism upon the argument. Of greater concern is a point underscoring many of the contributions of the book, and that is only explicitly made manifest by Leiter when he asks:

What precisely are the contributions to human knowledge and well-being that are attributable solely to [blogs, chatrooms, and Google], that would have been impossible without [the Internet's] existence in its current, unregulated form? It is far from obvious that there are any, at least in otherwise democratic societies. (168)

Leiter is focused on the harms that these things have led to – statements that have seriously impacted people’s lives and livelihoods – but in rhetorically asserting a lack of primary value to any of these key facets of the Internet he demonstrates a lack of awareness of what the Internet is, and has done, for many individuals. Indeed, Leiter and Nussbaum in particular seem to have carefully separated the ‘real’ world from the ‘fictional’ world of the Internet and assigned primacy to the former, and denigrate the value of the latter. Such is unsurprising – neither are so-called ‘digital natives’ – and so see the Internet as a tool or ‘other space’ instead of an element of their very existence. Sherry Turkle’s work, which carefully maps the close linkage between online and offline worlds to recognize that neither is necessarily discrete to the minds of those growing up with the Internet, is a better way to approach and understand the domains of agency associated with the virtual and virtually real. Either domain can be perceived or realized as discrete, but they can also been seen as mutually overlapping and integrated. Indeed, with the expansion of the digital into the analogue life we live in the West, notions of the Internet and Web as somehow ‘fictitious’ or needing to assert their primary and unitary value as opposed to ‘traditional’ analogue modes of communication are increasingly anachronistic. One imagines that similar complaints were made when the yellow press was launched, radio began, television launched, and so forth.

Conclusion

I am not a fan of repealing Section 230, nor am I in favor of establishing an ‘identified Internet’ in an effort to somehow convey ‘respectability’ on the online world (as suggested by Levmore). I worry that many of the essays in the book are so focused on alleviating (very real!) harms that they miss the broader impacts of modifying how the Internet is regulated by the United States. I also am concerned that the aim is to draw regulation of the Internet into the ‘traditional’ justice system (and not significantly update, or address how to update, a system that is dependent on access to counsel) or into a privatized system of judgement (e.g. Google evaluations of whether content is defamatory or tortious).

Despite my own concerns, this book contains incredibly well articulated arguments for further regulation of the Internet and a host of (disgusting and depressing) examples of the specific harms that individuals have, and continue to, face at the hands of online aggressors. I would highly recommend the text to anyone working on the ‘darker’ sides of the Internet from policy, legal, or general studies points of view: this is one of 2011′s ‘must reads’.

Other posts you might be interested in:

1. Review: Internet Architecture and Innovation
2. Review: Surveillance or Security?
3. Review of The Googlization of Everything

Photo by Richard Eriksson

I don’t like violence, vandalism, or other actions that generally cause destruction. Certainly there are cases where violent social dissent is a sad but important final step to fulfil a much needed social change (e.g. overthrowing a ruinous dictator, tipping the scale to defend or secure essential civil rights) but riotous behaviour following a hockey game lacks any legitimating force. Unfortunately, in the aftermath of game seven between the Vancouver Canucks and Boston Bruins a riot erupted in downtown Vancouver that caused significant harm to individuals and damage to the urban environment.

The riot itself is a sad event. What is similarly depressing is the subsequent mob mentally that has been cheered on by the social media community. Shortly after the riot, prominent local bloggers including Rebecca Bollwitt linked to social media websites and encouraged readers/visitors to upload their recordings and identify those caught on camera. In effect, Canadians were, and still are, being encouraged by their peers and social media ‘experts’ to use social media to locally instantiate a human flesh search engine (I will note that Bollwitt herself has since struck through her earliest endorsement of mob-championing). Its manifestation is seemingly being perceived by many (most?) social media users as a victory of the citizenry and inhabitants of Vancouver over individuals alleged to have committed crimes.

Perhaps unsurprisingly, I have significant issues with this particular search engine. In this post, I’m going to first provide a brief recap of the recent events in Vancouver and then I’ll quickly explain the human flesh search engine (HFSE), both how it works and the harms it can cause. I’m going to conclude by doing two things: first, I’m going to suggest that Vancouver is presently driving a local HFSE and note the prospective harms that may befall those unfortunate enough to get caught within its maw. Second, I’m going to suggest why citizens are ill-suited to carry out investigations that depend on social media-based images and reports.

Riotous Behaviour Comes to Vancouver

Following the conclusion of Stanley Cup final, downtown Vancouver was overcome by riotous behaviour. Cars were set ablaze. Violent altercations between emergency services and rioters occurred. Citizens fought with one another, as some tried to protect property that was being targeted by looters and malfeasants. Riot police were out in force. The city sky was laden with the smoke of meaningless destruction.

Photo by Matthew Grapengieser

Initial reports suggested that only a handful of people were involved, but it was quickly evident that a substantial number of people were taking part in the mayhem. While a considerable amount of damage was done we can hope that companies’ and individuals’ insurance policies will cover the physical losses. While many were administered to hospital there seem to have been surprisingly few serious injuries, with most being administered to hospital because of exposure to pepper spray and tear gas.

During and following the riot, Vancouver Police Department (VPD) has requested that citizens provide photos and video of riotous behaviour so that the cops can conduct investigations and bring charges. Importantly (and responsibly) the VPD asked for images and video to be shared directly with them; they don’t want individuals publicly posting images and video. There are at least two reasons for this kind of request:

1. Preserving the chain of evidence. When you upload photos to Facebook, as an example, it strips the metadata off the images. As a result there is a more labor intensive process to verify the legitimacy and accuracy of images located on Facebook. I can guarantee that clever defence attorneys will point to a flawed chain of evidence stemming from lack of metadata information as reasons that social media-based imagery and videos should be disallowed from the courts.
2. Understanding the danger of the mob. The VPD clearly recognizes the potential harms that arise when a mob races off to identify and convict, in the court of public opinion, individuals who allegedly engaged in illegal behaviour. I say allegedly because even if an image shows a person seemingly lighting a car on fire, until the court has evaluated and verified the evidence, and the person in the image has a chance to defend themselves (or admit their guilt) they are allegedly guilty. This presumption of innocence before the courts, regardless of evidence that exists to ground a case, is a fundamental cornerstone of our democracy and we should be mindful and respectful of it.

Unfortunately, our politicians have been less thoughtful. We’ve seen them call on citizens to publicly publish images using social media networks such as Twitter. This isn’t particularly surprising: I doubt that many of the politicians making such calls are trained in the retention of evidence, nor do I expect them to have thought about the longer-term impacts of associating names and images with people who may be acting like idiots whilst simultaneously not breaking the law (e.g. posing before a flaming car may be stupid but ought not to be automatically interpreted as being responsible for lighting the vehicle aflame). Especially when you consider how rarely some people are tagged in photos on the public Internet, and that many websites are associating names with photos on sites that Google spiders crawl, permanent images of stupidity may be misread long into the future as images of illegality. Such contextual inferences may negatively impact people for the rest of their lives. This is not a good thing: the Internet doesn’t forget and you simply cannot assume that a border guard or employer is going to spend the time (or have the wherewithal) to search for the context of stupid but not illegal images.

The Human Flesh Search Engine

The Human Flesh Search Engine (HFSE) is an engine driven by humans to find humans. It often involves the collection of open- and closed-source intelligence to find individuals who have allegedly broken a law or violated some social norm. Open-source intelligence is “freely available on the Internet through groups with open memberships or simply posted to websites” whereas its closed counterpart “is not publicly available and is associated with information security operations, intelligence gathering, “softer” business, and professional relationships” (PDF Source). The HFSE is in regular operation throughout Asia (and especially China and South Korea) and is used for what may be seen as admirable aims (ferreting out government corruption and perpetrators of illegal actions) and far less admirable aims (identifying and shaming individuals who are violate social norms or break incredibly minor laws). Regardless of the end result – which one might consider positive or negative – the means of arriving at that end tend to do violence to the individuals under ‘investigation’.

As examples, after information about a person is made public they are often subject to illegal forms of harassment, including hate mail, threatening phone calls, death threats, and other forms of psychic and physical harms. To be clear: the HFSE operates on a fuel of vigilantism that is bereft of legal or operational legitimacy. To be yet clearer: the ends, no matter what they happen to be, do not justify the means of arriving at them. Conducting an illegal form of investigation that lacks legal legitimacy and that may in fact taint the ability to lay legal charges against potential criminals because of potential evidence misuse/mishandling/fabrication is not a good thing. The rise of smartmobs, while certainly an interesting phenomenon from a scholarly point of view, are not something that we as a society necessarily should be condoning, supporting, or encouraging.

Vancouver’s Newest Search Engine

Within hours of the riot in Vancouver, locals were turning to social media and began to collate images and videos of individuals who were seemingly engaged in riotous behaviour. In addition to posting images there are public efforts to both identify

From Vancouver Riot Pics Facebook Group

individuals in photos and take a direct form of justice on them: rather than simply providing information to the police social media users were actively punishing suspected criminals. Photos were transmitted to employers, or intentionally made public so that future searches for those individuals would bring up the images/videos along with uncorroborated commentary. One blog, titled ‘Public Shaming Eternus‘, saw its owner (who refuses to publicly reveal themselves and instead operates under the pseudonym ‘Captain Vancouver’) write the following:

These young men and women IF they get prosecuted will most likely be given probation, perhaps fines, community service etc. If they do end up with a criminal record, they will also (if given a savvy enough lawyer) be able to have that black mark removed.  At the end of it all, the consequences are minor.

Public shaming however reveals their faces, their names and ultimately has longer lasting effect.  There are those who would say that our court system is for the public record to view.  When was the last time the average person sat in on a trial and read court transcripts?  They are all there for the viewing to see.  Public shaming thru the use of social media and blogging shall place them into a world that is engraved into history.  It shall be chiseled into the hard stone of the internet and last eternally.

When a person’s name is typed into google or any search engine, especially if they are relative nobody’s, they do pop up on the first page during the search.  More and more of today’s employers are googling the names of the people who apply for jobs. I know when I run my company, I wouldn’t hire the people I saw rioting in the streets of my city.  So if they show up in a search 5 years from now, let them explain in their job interview’s how they’ve “all grown up now”. Roll the dice and see if they still get the job.

The politics of shame should not be the ‘solution’ to criminal activity as it strikes to the heart of a person’s dignity instead of striking towards the (lack of) integrity of their actions. Our system of justice is not designed to ‘brand’ individuals with social-media inspired scarlet letters. Those that actively attempt to cause harm to others outside of the judicial system should at the very least have the courage to conduct their shaming actions publicly so that they can ‘enjoy’ the prospect of future civil litigation. What’s good for the goose is good for the gander, right?

In addition to attempts to permanently ‘brand’ individuals who may or may not eventually be found guilty of criminal actions, there are calls for violence to befall individuals pre-trial. The below screenshot from the Vancouver Riot Pics Facebook group is commonplace throughout the social media landscape at the moment.

From Vancouver Riot Pics Facebook Group

Posing before wreckage is not in itself a crime, though citizens are clearly posting the images with the implied assumption that those posing are guilty of a crime. Further, one poster is advocating the hanging of the individuals in the photograph using language reminiscent of the Ku Klux Klan’s racially motivated hate killings. I ask: would Mr. Griffin use the language he did were he privately communicating with the police to convey information about people who he suspected of criminal behaviour? I suspect that he would not.

In some respects, of course, social media is behaving similar to the morality plays that go on everyday on talk radio: a key (if unspoken) element of the mob-usage of social media is to rearticulate the community’s social norms. This isn’t to suggest that local Vancouver norms are to hang prospective criminals, but instead that there is a permissiveness to “Othering” certain people who are merely suspected of wrongdoing, or who are perceived as ‘less real’ or ‘unclean’ in comparison to the community’s membership. The language of the noose is unfortunate in many respects, both in the sense that it articulates a glee for vengeance and the acceptability of drawing on racist overtures in the Othering of photographed individuals.

The language and articulation of shame towards alleged rioters is commonplace in social media environments right now, though it is perhaps best captured by Ms. Kashino’s decidedly non-unique statement:

From Vancouver Riot Pics Facebook Group

The celerity at which individuals engage in what is the digital equivalent of ‘water cooler talk’ – discussions that were historically informal, rarely thought out, hidden from a wider public audience, and non-permanent – and the longevity of such comments are common problems with social media. These are issues that have been discussed widely within academic, policy, and public circles and are far from being resolved. Personally, I tend to agree with Dan Solove in The Future of Reputation: online social networking environments lack traditional media’s norms of restraint (though I’m not arguing traditional media has been much better) and that the “less-well-developed-norms” of social networking need to be reconstituted with a widely held code of ethics that sees people reflect and filter their comments online prior to uttering/writing them. This isn’t meant to suggest that individuals should censor their language, but that they should be considerate in the language that they utter. If in their considered opinion racist, misogynistic, or homophobic language is appropriate then let them utter it, though one hopes that in their moment of reflection they realize and acknowledge the harms associated with such modes of verbal violence.

Citizens Are Not Trained Investigators

Statements made on social media have the ability to leave long-lasting scars on individuals as well as misdirect anger and the human flesh engine more generally. Consider the early reports of a Bruin’s fan being discovered bleeding on the ground:

While I would agree that this is a sad image, the full story is that the Bruin’s fan began a physical altercation and was subsequently knocked down by a pair of local security guards. Should the guards have their images circulated for using excessive force, given their own lack of legal authority to cause bodily harm? Or are they heroes for protecting property and individuals? Or, in fact, is the ethical situation around this image (along with many, many other photos and video clips) far more complicated? Are citizens ideally situated to evaluate the legalities and ethics of how these violent altercations were, and should have been, resolved?

While this was a case where the managing editor of a citizen-journalism site did a followup on claims, in doing so he demonstrated the value of journalistic ethics and integrity. Most citizen-journalists lack the ethical training and vetting processes that professional journalists go through. I’m not, of course, saying that to post something online one must have gone to journalism school: the point is simply that the alacrity at which citizen-journalists will press ‘post’, ‘like’, or ‘tweet this’ when the implications are potentially far-reaching will often diverge from the alacrity of a principled, ethical, and well-trained journalist. Further, one would not expect a journalism site to advocate for identifying and shaming individuals who have allegedly been involved in criminal acts. The same cannot routinely be said for citizen-journalists.

Beyond the notion of ethics and reserve that are often lacking when people turn to social media, there is the simple fact that citizens are not trained investigators. As such, it is entirely possible that in conducting their ‘investigations’ to trace and identify individuals in photos that they may behave in illegal or unethical manners themselves. Further, the processes used to identify individuals may in fact contaminate their very findings: while you may learn who John or Jane Doe are, if in the process you illegally collected information then those defendants are likely to argue that the means of identification are inadmissible and try to leverage that to avoid a guilty verdict. Of course the success of any such legal maneuver will vary, but that it is even possible is the result of untrained individuals using questionable methods as part of the Human Flesh Search Engine.

Finally, I would simply note that citizens are incredibly poor in conducting and acting on surveillance footage. In cases where normative or decisional actions are part of the surveillance process the untrained are often more of a hindrance than asset; they are truly best at identifying black/white kinds of evidence and then alerting trained investigators to the evidence. To clarify: watching a border or photos to identify illegal acts and individuals responsible involve normative and decisional processes that citizens are unqualified to responsibly and professionally engage in. Recognizing that a photo or video might be useful to authorities and passing it on – and letting them take action on the content – is a case of black/white identification. Effectively, if you outsource policing to amateurs you get amateur results that could bungle broader investigations and criminal proceedings.

Conclusion

I conclude by taking pains to largely reiterate the earliest statements of this post. I in no way support, condone, or like the riotous behaviours that were evidenced in Vancouver, and nothing in this is intended to absolve the individuals responsible for it of their guilt. Instead, I simply warn that a human flesh search engine that functions per the logics of vigilantism and shame are in clear violation of the norms and ethics of Canadian policing and judicial procedure, can cause harm far in excess of an action captured by a digital recording, and potentially undermine authorities’ capacity to prosecute alleged criminals. Further, citizens are not trained to analyze open source intelligence, nor are they ideally suited to know the full extent of what they can and cannot do to identify and name someone. The intent to cause harm in excess of the judicial system is not only detrimental to those targeted by members of the Human Flesh Search Engine but, potentially, to those members should they face tort-based legal challenges in the future. While the reaction of social media users to identify and shame alleged rioters is unsurprising this doesn’t mean that the practices should go unchallenged or left free of critique. The actions taken to identify, name, and shame alleged rioters is the beginning of a slide towards a state of mind and looseness of ethics that have been proven to cause harm abroad: I see no reason, based on those experiences, why we should import known, failed, modes of citizen surveillance and investigation into the Canadian experience.

Other posts you might be interested in:

1. Technology: CBC’s Search Engine and Traffic Shaping
2. Search and Privacy
3. Forthcoming Talk at Social Media Club Vancouver

Immediately after my presentation, Kris Constable of PrivaSecTech gives a privacy talk on social media that focuses on the inability to control personal information dissemination. Following his presentation, the two of us take questions from the audience for twenty or thirty minutes.

Other posts you might be interested in:

1. References for Traffic Analysis, Privacy, and Social Media
2. Forthcoming Talk at Social Media Camp Victoria
3. Forthcoming Talk at Social Media Club Vancouver

By Stephanie Booth

During my presentation last week at Social Media Club Vancouver – abstract available! – I drew from a large set of sources, the majority of which differed from my earlier talk at Social Media Camp Victoria. As noted earlier, it’s almost impossible to give full citations in the middle of a talk, but I want to make them available post-talk for interested parties.

Below is my keynote presentation and list of references. Unfortunately academic paywalls prevent me from linking to all of the items used, to say nothing of chapters in various books. Still, most of the articles should be accessible through Canadian university libraries, and most of the books are in print (if sometimes expensive).

I want to thank Lorraine Murphy and Cathy Browne for inviting me and doing a stellar job of publicizing my talk to the broader media. It was a delight speaking to the group at SMC Vancouver, as well as to reporters and their audiences across British Columbia and Alberta.

Keynote presentation [20.4MB; made in Keynote '09]

References

Bennett, C. (1992). Regulating Privacy: Data Protection and Public Policy in Europe and the United States. Ithica: Cornell University Press.

Bennett, C. (2008).  The Privacy Advocates:  Resisting the Spread of Surveillance.  Cambridge, Mass:  The MIT Press.

Carey, R. and Burkell, J. (2009). ‘A Heuristics Approach to Understanding Privacy-Protecting Behaviors in Digital Social Environments’, in I. Kerr, V. Steeves, and C. Lucock (eds.). Lessons From the Identity Trail: Anonymity, Privacy and Identity in a Networked Society. Toronto: Oxford University Press. 65-82.

Chew, M., Balfanz, D., Laurie, B. (2008). ‘(Under)mining Privacy in Social Networks’, Proceedings of W2SP Web 20 Security and Privacy: 1-5.

Fischer-Hübner, S., Sören Pettersson, J. and M. Bergmann, M. (2008). “HCI Designs for Privacy-Enhancing Identity Management’, in A. Acquisti and S. Gritzalis (eds.). Digital Privacy: Theory, Technologies, and Practices. New York: Auerbach Publications. 229-252.

Flaherty, D. (1972). Privacy in Colonial England. Charlottesville, VA: University Press of Virginia.

Hoofnagle, Chris; King, Jennifer; Li, Su; and Turow, Joseph. (2010). “How different are young adults from older adults when it comes to information privacy attitudes and policies?” available at: http://www.ftc.gov/os/comments/privacyroundtable/544506-00125.pdf

Karyda, M., Koklakis, S. (2008). ’Privacy Perceptions among Members of Online Communities‘, in A. Acquisti and S. Gritzalis (eds.). Digital Privacy: Theory, Technologies, and Practices. New York: Auerbach Publications, 253-266.

Kerr, I., Barrigar, J., Burkell, J, and Black K. (2009). ‘Soft Surveillance, Hard Consent: The Law and Psychology of Engineering Consent’, in I. Kerr, V. Steeves, and C. Lucock (eds.). Lessons From the Identity Trail: Anonymity, Privacy and Identity in a Networked Society. Toronto: Oxford University Press. 5-22.

Marwick, A. E., Murgia-Diaz, D., and Palfrey Jr., J. G. (2010). ‘Youth, Privacy and Reputation (Literature Review)’. Berkman Center Research Publication No. 2010-5; Harvard Law Working Paper No. 10-29. URL: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1588163

O’Reilly, T, and Battelle, J. (2008), ‘Web Squared: Web 2.0 Five Years On’. Presented at Web 2.0 Summit 2009, at http://www.web2summit.com/web2009/public/schedule/detail/10194

Steeves, V. (2009). ‘Reclaiming the Social Value of Privacy‘, in I. Kerr, V. Steeves, and C. Lucock (eds). Privacy, Identity, and Anonymity in a Network World: Lessons from the Identity Trail. New York: Oxford University Press.

Steeves, V, and Kerr, I. (2005). ‘Virtual Playgrounds and Buddybots: A Data-Minefield for Tweens‘, Canadian journal of Law and Technology 4(2), 91-98.

Turow, Joseph; King, Jennifer; Hoofnagle, Chris Jay; Bleakley, Amy; and Hennessy, Michael. (2009). “Contrary to what marketers say Americans reject tailored advertising and three activities that enable it,” Available at: http://graphics8.nytimes.com/packages/pdf/business/20090929-Tailored_Advertising.pdf

Turow, Joseph. (2007). “Cracking the Consumer Code: Advertisers, Anxiety, and Surveillance in the Digital Age,” in The New Politics of Surveillance and Visibility. Toronto: University of Toronto Press

Other posts you might be interested in:

1. References for Traffic Analysis, Privacy, and Social Media
2. Forthcoming Talk at Social Media Camp Victoria
3. Recording of ‘Traffic Analysis, Privacy, and Social Media’

There is a full list of references below, as well as a downloadable version of my keynote presentation (sorry powerpoint users!). As you’ll see, some references are behind closed academic paywalls: this really, really, really sucks, and is an endemic problem plaguing academia. Believe me when I say that I’m as annoyed as you are that the academic publishing system locks up the research that the public is paying for (actually, I probably hate it even more than you do!), but unfortunately I can’t do much to make it more available without running afoul of copyright trolls myself. As for books that I’ve drawn from, there are links to chapter selections or book reviews where possible.

Keynote presentation [4.7MB; made in Keynote '09]

References:

Breyer, P. (2005). ’Telecommunications Data Retention and Human Rights: The Compatibility of Blanket Traffic Data Retention with the ECHR‘. European Law Journal 11: 365-375.

Chew, M., Balfanz, D., Laurie, B. (2008). ‘(Under)mining Privacy in Social Networks’, Proceedings of W2SP Web 20 Security and Privacy: 1-5.

Danezis, G. and Clayton, R. (2008). ‘Introducing Traffic Analysis‘, in A. Acquisti, S. Gritzalis, C. Lambrinoudakis, and S. D. C. di Vimercati (eds.). Digital Privacy: Theory, Technologies, and Practices. New York: Auerback Publications. 95-116.

Elmer, G. (2004). Profiling Machines: Mapping the Personal Information Economy. Cambridge, Mass.: The MIT Press.

Friedman, L. M. (2007). Guarding Life’s Dark Secrets: Legal and Social Controls over Reputation, Propriety, and Privacy. Stanford: Stanford University Press. [Excellent book review of text]

Gandy Jr., O. H. (2006). ‘Data Mining, Surveillance, and Discrimination in the Post-9/11 Environment‘, in K. D. Haggerty and R. V. Ericson (eds.). The New Politics of Surveillance and Visibility. Toronto: University of Toronto Press, 79-110. [Early draft presented to the Political Economy Section, IAMCR, July 2002]

Kerr, I. (2002). ‘Online Service Providers, Fidelity, and the Duty of Loyalty‘, in T. Mendina and B. Rockenback (eds). Ethics and Electronic Information. Jefferson, North Carolina: McFarland Press.

Mitrou, L. (2008). ’Communications Data Retention: A Pandora’s Box for Rights and Liberties‘, in A. Acquisti, S. Gritzalis, C. Lambrinoudakis, and S. D. C. di Vimercati (eds.). Digital Privacy: Theory, Technologies, and Practices. New York: Auerbach Publications, 409-434.

Rubinstein, I., Lee, R. D., Schwartz, P. M. (2008). ‘Data Mining and Internet Profiling: Emerging Regulatory and Technological Approaches‘. University of Chicago Law Review 75 261.

Saco, D. (1999). ‘Colonizing Cyberspace: National Security and the Internet’, in J. Weldes, M. Laffey, H. Gusterson, and R. Duvall (eds). Cultures of Insecurity: States, Communities, and the Production of Danger. Minneapolis: University of Minnesota Press, 261-292. [Selection from Google Books]

Simmons, J. L. (2009). “Buying You: The Government’s Use of Forth-Parties to Launder Data about ‘The People’,” in Columbia Business Law Review 2009/3: 950-1012.

Strandburg, K. J. (2008). ’Surveillance of Emergent Associations: Freedom of Associations in a Network Society‘, in A. Acquisti, S. Gritzalis, C. Lambrinoudakis, and S. D. C. di Vimercati (eds.). Digital Privacy: Theory, Technologies, and Practices. New York: Auerbach Publications. 435-458.

Winner, L. (1986). The Whale and the Reactor. Chicago: University of Chicago Press. [Book Review]

Zittrain, J. (2008). The Future of the Internet: And How to Stop It. New Haven: Yale University Press. [Book Homepage]

Other posts you might be interested in:

1. Recording of ‘Traffic Analysis, Privacy, and Social Media’
2. References for ‘Putting the Meaningful into Meaningful Consent’
3. Forthcoming Talk at Social Media Camp Victoria

See below for the full abstract:

Supplementing Privacy Policies with a Privacy Ethic

Social media platforms are increasingly common (and often cognitively invisible) facets of Western citizens’ lives; we post photos to Facebook and Flickr, engage in conversations on Orkut and Twitter, and relax by playing games on Zynga and Blizzard infrastructures. The shift to the Internet as a platform for mass real-time socialization and service provision demands a tremendous amount of trust on the part of citizens, and research indicates that citizens are increasingly concerned about whether their trust is well placed. Analytics, behavioural advertising, identity theft, and data mismanagements strain the public’s belief that digital systems are ‘privacy neutral’ whilst remaining worried about technological determinisms purported to drive socialized infrastructures.

For this presentation, I begin by briefly reviewing the continuum of the social web, touching on the movement from Web 1.0 to 2.0, and the future as ‘Web Squared’. Next, I address the development of various data policy instruments intended to protect citizens’ privacy online and that facilitate citizens’ trust towards social media environments requiring personal information as the ‘cost of entry’. Drawing on academic and popular literature, I suggest that individuals participating in social media environments care deeply about their privacy and distrust (and dislike) the ubiquity of online surveillance, especially in the spaces they communicate and play. Daily experiences with data protection – often manifest in the form of privacy statements and policies – are seen as unapproachable, awkward, and obtuse by most social media users. Privacy statements and their oft-associated surveillance infrastructures contributes to a broader social malaise surrounding the effectiveness of formal data protection and privacy laws.

Given the presence of this malaise, and potential inability of contemporary data protection laws to secure individuals’ privacy, what can be done? I suggest that those involved in social media are well advised to develop an ethic of privacy to supplement legally required privacy statements. By adopting clear statements of ethics, supplemented with legal language and opt-in data disclosures of personal information, operators of social media environments can be part of the solution to society’s privacy malaise. Rather than outlining an ethic myself, I provide the building blocks for those attending to establish their own ethic. I do this by identifying dominant theoretical approaches to privacy: privacy as a matter of control, as an individual vs community vs hybrid issue, as an issue of knowledge and agency, and as a question of contextual data flows. With an understanding of these concepts, those attending will be well suited to supplement their privacy statements and policies with a nuanced and substantive ethics of privacy.

Other posts you might be interested in:

1. Forthcoming Talk at Social Media Camp Victoria
2. Recording of ‘Traffic Analysis, Privacy, and Social Media’
3. References for Traffic Analysis, Privacy, and Social Media

I’ll be talking about the use of traffic analysis and data mining practices that can be used to engage in massive surveillance of social networking environments and the value of drawing links between users rather than investigating the content of communications. The argumentative ‘thrust’ is that freedoms of expression and association may offer a approach to secure privacy in the face of weakened search laws. The full abstract can be read below.

Abstract:

Citizens are increasingly moving their communications and forms of expression onto social media environments that encourage both public and private collaborative efforts. Through social media, individuals can reaffirm existing relationships, give birth to new and novel communities and community-types, and establish the classical political advocacy groups that impact government decisions and processes. In coming together online for their various reasons, citizens expect that their capacity to engage with one another should, and in some respect does, parallel their expectations of privacy in the analogue world.

In this presentation, I first outline expectations and realities of privacy on and offline, with an emphasis on data traffic (i.e. non-content) analysis born from Signal Intelligence (SIGINT), and SIGINT’s use in civilian governmental practices. I then proceed to outline, in brief, how social media generally can be used to identify associations and a few reasons why such associations can undermine the communicative privacy expected and needed for the long-term survival of vibrant constitutional democracies. Rather than ending on a note of doom and gloom, however, I suggest a novel way of approaching privacy-related problems stemming from massive traffic data analysis in social media networks. While the language of freedom from unjustified searches is often used to resist traffic analysis, I draw from recent privacy scholarship to suggest that freedom of expression and association offers a novel (and possibly superior) approach to defending privacy interests in social media from SIGINT-based surveillance.

Other posts you might be interested in:

1. Forthcoming Talk at Social Media Club Vancouver
2. Recording of ‘Traffic Analysis, Privacy, and Social Media’
3. References for Traffic Analysis, Privacy, and Social Media

First, let me speak to the motivation behind the Bill. Social networking environments are increasingly becoming the places where individuals store key information – contact information, photos, thoughts and reflections, video – and genuinely becoming integrated into the political. This integration was particularly poignantly demonstrated last year when the American State Department asked Twitter to delay upgrades that would disrupt service and stem the information flowing out of Iran following the illegitimate election of President Ahmadinejad. Social networks have already been tied into the economic and social landscapes in profound ways: we see infrastructure costs for maintaining core business functionality approaching zero and the labor that was historically required for initiating conversations and meetings, to say nothing of shared authorship, have been integrated into social networking platforms themselves. Social networking, under this rubric, extends beyond sites such as Facebook and MySpace, and encapsulate companies like Google and Yahoo!, WordPress, and Digg, and their associated product offerings. Social networking extends well beyond social media; we can turn to Mashable’s collection of twenty characteristics included in the term ‘social networking’ for guidance as to what the term captures:

Collaboration: Ask not what the Internet can do for you, but what you can do with other Internet users. – Jonny Rose

Network: Social media is a phenomenon which creates a personalized network for sharing digital content among all people in the cyberspace. - Rohan Aurora

Conversation: Tools or platforms that allow anyone/everyone to share information or engage in conversation. – Veena Mathew

Sharing: Social media = Sharing information through conversation. – Scot Chisholm

Relationships: Relationshipping on steroids. – Pat Graham-Block

Multi-dimensional: Social media is a multi-dimensional communication information system connecting people to people. -Peter Feuersenger

Inclusive: It’s a conversation in an instant with anyone, anywhere, anytime that gives control back to the individual & consumer in unpredented ways.” – Charles Ubaghs

Information: Information funneled to users from all angles. – Sarah Thomson

Community: Set of updated communication tools that allow us to build new communities at a time when our local community had almost been lost. – Jerry Daykin

Personalization: It is the ability to connect and see the world in your own way. The personalization of one of the greatest human achievements: communication! – Benjamin Fischbein

Empowering: Social media is an online renaissance empowering people with influence to facilitate conversations around shared ideas. – Mark Blackman

A Radical Shift in Communication: The radical shift from one-way broadcast type communications to dialog and conversation using web based tools. - Joe Buhler

Real-time: “Social Media is on-demand, real time interaction, that uses technology to enable genuine engagement with others around media vs simply sharing data with them.” – Corina Newby

People: Social Media is the instantaneous aggregation and creation of content by the people, of the people, for the people, on the social web. – Eric Pena

Content Distribution: Social media consists of online technologies that facilitate the creation and distribution of content. – David J. Perdue

Self-expression: Social Media’s my friend. I can finally broadcast my belief in God, my likes in music, my emotional state & my dinner all from my fingertips – E. A. Freire

Unity: The never ending drive for humans desire to unite. – Sean Farrell

Dynamic: Social media is dynamic user-generated content coming from the bottom up, which bypasses static media forms through adding a social layer. – Anees Younis

Discovery: Social media is communication, friending, family, media, learning and discovery at one click. – Glenn K. Bolton

Power of the Crowd: Social media is the ability to put out a message and having worldwide responses via email, text, tweet, or whatever form in a matter of seconds. – Lilian Ongelungel

While never specifically stated or enunciated, it was in light of these kinds of characteristics that the Computers, Freedom, and Privacy participants developed the Social Networking Bill of Rights:

1. Honesty: Honor your privacy policy and terms of service
2. Clarity: Make sure that policies, terms of service, and settings are easy to find and understand
3. Freedom of speech: Do not delete or modify my data without a clear policy and justification
4. Empowerment : Support assistive technologies and universal accessibility
5. Self-protection: Support privacy-enhancing technologies
6. Data minimization: Minimize the information I am required to provide and share with others
7. Control: Let me control my data, and don’t facilitate sharing it unless I agree first
8. Predictability: Obtain my prior consent before significantly changing who can see my data.
9. Data portability: Make it easy for me to obtain a copy of my data
10. Protection: Treat my data as securely as your own confidential data unless I choose to share it, and notify me if it is compromised
11. Right to know: Show me how you are using my data and allow me to see who and what has access to it.
12. Right to self-define: Let me create more than one identity and use pseudonyms. Do not link them without my permission.
13. Right to appeal: Allow me to appeal punitive actions
14. Right to withdraw: Allow me to delete my account, and remove my data

Those familiar with data protection policies and laws will recognize that many elements of FIPS, OECD guidelines, and national regulations are latent and/or guiding many of these rights. The point is that these rights are the minimum expectations that companies should guarantee social networking users; dropping any particular right leads to a strong deficiency in what individuals can expect from companies and do to their own data. In light of the use of these systems for democratic organization, to announce illegal or oppressive social conditions, and increasingly use of the networks to replace traditional telephony it is key that the social facet of the bitscape is provided protections from onerous corporate control, manipulation, or aggressive anti-privacy monetization schemes. Now, it may seem somewhat absurd that corporations should be required to mediate how they use data they’ve aggregated, but corporations can either choose to adopt some modicum of reasonableness when it comes to how they aggregate data and clearly inform users of aggregation, utilization, and dissemination policies or else be regulated by government forces. If Facebook had a set of principles that strongly reflected the Bill of Rights, a set of principles they adhered to, then the Office of the Privacy Commissioner of Canada might not have issued a decision concerning Facebook and its (failed) privacy practices. In effect, adopting the Rights denoted above could limit regulatory intrusions while also letting companies compete on the metric of privacy and freedom.

While the user communities could experience positive benefits were social networking companies to adopt the Bill, the process by which the Bill has been created and ratified is itself somewhat problematic. While the conference attracted a diverse set of individuals, those individuals were far from reflective of the world user-community of social networking services. This leads to concerns surrounding the diversity of points of view that were (or, more importantly, were not) included in the drafting and finalization process. Further, no element of the Bill includes a reflexive characteristic that enables modification of stated Rights, nor does the Bill state that Rights can be added or subtracted depending on contributions from others. Instead, there is an up or down ‘vote’ of the Bill: in a conference that regularly noted the challenges surrounding binary access controls we are left with a binary acceptance/refusal metric. We are faced with a ‘dead’ or static Bill: it’s failure to incorporate reflexivity and closedness to the diversity of discursive possibilities emerging as others enter into discussions about the Bill leads to it failing Habermasian and Kantian demands for being a legitimate constitutional document. As such, we are left not so much with a Bill of Rights as a closed Statement of Rights. The former would have been truly exciting, whereas the latter is strategic and useful, but is disingenuously appropriating the term ‘Bill of Rights’ for rhetorical purposes.

Does this mean that the Bill/Statement is necessarily doomed? Of course not, though even participants at the conference recognized that the Bill will likely operate more as a point for subsequent regulatory filings and rhetorical turns than a binding agreement that social networks will consent to. Further, another Bill of Rights for Users of the Social Web was produced three years ago and, despite the attention that document received in the blogosphere, I don’t think that it ever really entered either the public mind or that of major social networking companies. I have doubts that the most recent Bill/Statement will be any more successful. To move it forward will require buy-in from major social networks and, to date, Facebook is the largest and only company to respond to the Bill/Statement proper (and in a lukewarm manner, at best). Nothing (that I know of) has been heard from other social networking companies in anything more than a ‘we support privacy, and have privacy policies available on our websites.’ As a result the prospects for moving the Bill/Statement forward seem dim, though perhaps another person or group will successfully convince companies to adopt the document and thus extend its range of possible uses beyond filings and rhetorical spins.

Other posts you might be interested in:

1. Social Networking – Why We Need to Educate Youth
2. Social Networking: The Consumption?
3. Recording of ‘Traffic Analysis, Privacy, and Social Media’