WEBVTT - Are Geofence Warrants Sweeping Up Your Cellphone Data? 0:00:03.160 --> 0:00:18.000 This is Bloomberg Law with June Brusso from Bloomberg Radio. Beautiful, beautiful, unethical, dangerous. 0:00:18.960 --> 0:00:22.480 You've turned every cell phone in Gotham into a microphone. 0:00:23.160 --> 0:00:26.400 This is wrong. I've got to find this man, Lucius. 0:00:28.720 --> 0:00:33.159 At what cost? This is an audious He talks with 0:00:33.280 --> 0:00:35.279 a range of any phone in the city. You can 0:00:35.320 --> 0:00:39.720 triangulate his position. I'll help you this one time. In 0:00:39.800 --> 0:00:44.360 the dark night Batman uses an unexplained technology to convert 0:00:44.440 --> 0:00:48.280 cell phones into a citywide tracking system to find the joker. 0:00:48.880 --> 0:00:51.920 That technology may have seemed like science fiction when the 0:00:51.920 --> 0:00:55.200 movie was released more than a decade ago, but now 0:00:55.240 --> 0:00:59.720 it's real and today. Geo fence warrants allowed law enforcement 0:00:59.760 --> 0:01:03.800 to search Google sensor vault database to get location records 0:01:03.840 --> 0:01:07.800 for all mobile phones within a virtual perimeter at specified times, 0:01:08.080 --> 0:01:11.920 raising privacy and Fourth Amendment issues. A robbery case in 0:01:12.000 --> 0:01:14.880 Virginia will be a high stakes legal test for the 0:01:14.959 --> 0:01:18.440 dramatic spike and police use of geo fence warrants to 0:01:18.520 --> 0:01:22.280 identify suspects. The first Fourth Amendment challenge to a geo 0:01:22.400 --> 0:01:25.160 fence warrant in a federal court. Here to explain the 0:01:25.240 --> 0:01:29.560 legal challenges, Ari Ezra Waldman, a professor at Northeastern University 0:01:29.640 --> 0:01:33.400 Law School. Are new figures from Google show a tenfold 0:01:33.600 --> 0:01:36.280 increase in the use of these geo fence warrants in 0:01:36.280 --> 0:01:39.840 the last three years. Explain what they are. Geo fence 0:01:39.880 --> 0:01:44.560 warrants are tools that government uses to take advantage of 0:01:44.600 --> 0:01:48.720 the data that private companies gather about us, like where 0:01:48.760 --> 0:01:51.400 we are, where we use our phone, where we use 0:01:51.440 --> 0:01:55.840 Apple pay, where we buy products, that can essentially just 0:01:55.960 --> 0:01:59.720 like track individuals wherever they are. Think about it as 0:02:00.040 --> 0:02:03.720 kind of a suped up version of getting self site data. 0:02:03.840 --> 0:02:06.040 You know, when you drive down the New Jersey Turnpike 0:02:06.160 --> 0:02:09.480 or you drive down a highway, your cell phone connects 0:02:09.520 --> 0:02:12.160 to different towers and you can identify where a car 0:02:12.200 --> 0:02:14.959 has been or where it's going. A warrant to get 0:02:14.960 --> 0:02:18.400 ge offense data is essentially here a company, where you 0:02:18.400 --> 0:02:21.120 have gathered all this information about what we normally do 0:02:21.320 --> 0:02:24.160 every minute of the day. Give us that information so 0:02:24.240 --> 0:02:27.280 we can track where a potential suspect is. But a 0:02:27.400 --> 0:02:30.840 judge has authorized the warrant based on a finding of 0:02:30.919 --> 0:02:35.720 probable cause. Yeah, police get a warrant when an independent 0:02:35.880 --> 0:02:39.440 judge feels that there is probable cause to that some 0:02:39.600 --> 0:02:44.000 criminal activity is happening. It's often relatively easy to get 0:02:44.000 --> 0:02:46.400 a warrant, But the idea is that at least the 0:02:46.480 --> 0:02:50.920 police have to justify to an independent arbiter like a judge, 0:02:51.160 --> 0:02:54.760 that this information is necessary. But the fact that someone 0:02:54.840 --> 0:02:58.079 got a warrant, that's okay. But you have to ask yourself, 0:02:58.840 --> 0:03:03.280 did individual in giving over this information to private parties 0:03:03.400 --> 0:03:07.600 right and using tools like Google or an iPhone or 0:03:07.639 --> 0:03:10.400 so forth, and using tools where we may expect or 0:03:10.440 --> 0:03:13.160 know that information is being given to private parties, did 0:03:13.200 --> 0:03:16.359 we expect that such information would be so easily obtained 0:03:16.440 --> 0:03:19.720 by government authorities? And I think that's a very different question. 0:03:20.400 --> 0:03:22.960 So in this case, a man accused of a bank 0:03:23.040 --> 0:03:26.880 robbery is challenging the use of data from a GEO 0:03:26.960 --> 0:03:30.200 warrant as evidence in his indictment. And it's the first 0:03:30.200 --> 0:03:33.679 such federal court challenge. So it's the first case that 0:03:33.720 --> 0:03:36.480 I'm aware of. It's not the first case where location 0:03:36.600 --> 0:03:40.280 data is part of an indictment. I'm very important. Supreme 0:03:40.320 --> 0:03:42.640 Court case Carpenter of the United States, which happened just 0:03:42.640 --> 0:03:45.119 a couple of years ago, was based on historical sell 0:03:45.200 --> 0:03:49.800 site location. So police have been using location information from 0:03:50.200 --> 0:03:54.400 cell service companies, from Internet companies for some time, and 0:03:54.800 --> 0:03:58.160 Google said, I think it was last month that geo 0:03:58.240 --> 0:04:02.080 fence warrants now make up something like one quarter of 0:04:02.120 --> 0:04:06.200 all demands of information from the US government to these companies. 0:04:06.600 --> 0:04:09.000 And what that means is, it's not that the government 0:04:09.040 --> 0:04:13.840 is newly using location data in criminal prosecution. It's just 0:04:13.960 --> 0:04:18.200 that the technology that we have is so much better, 0:04:18.720 --> 0:04:21.800 better in the sense that these companies know exactly where 0:04:21.800 --> 0:04:23.680 we are and have the ability to track us in 0:04:23.720 --> 0:04:26.040 real time. So of course the government is going to 0:04:26.120 --> 0:04:29.520 want to use it when trying to arrest suspects or 0:04:29.920 --> 0:04:33.359 crashed down on crime. What is the defendant's basic argument 0:04:33.360 --> 0:04:38.200 about the constitutionality of the warrant? So the argument is 0:04:38.240 --> 0:04:41.520 that the quantity and quality of their multiple arguments, but 0:04:41.600 --> 0:04:44.240 one of the arguments is that the quantity and quality 0:04:44.279 --> 0:04:48.880 of the information that can be provided through geo fence 0:04:48.920 --> 0:04:53.080 warrant is just way too significant, way too much. Normally, 0:04:53.160 --> 0:04:55.839 when you get a warrant, the police will go I 0:04:55.920 --> 0:04:57.880 need a warrant to search your home. I have a 0:04:57.880 --> 0:05:01.760 warrant to search your office. Right there is a finite 0:05:01.800 --> 0:05:05.960 amount of information that's there if police get a warrant 0:05:05.960 --> 0:05:08.080 to search your office and there's a computer in there, 0:05:08.680 --> 0:05:10.640 Normally you have to get a separate warrant to search 0:05:10.680 --> 0:05:15.960 the computer. But a geofense warrant really is it's almost 0:05:16.000 --> 0:05:21.760 like a seven dragnet about a person that allows law 0:05:21.880 --> 0:05:24.800 enforcement to not just see the papers that are in 0:05:24.839 --> 0:05:27.960 the death, it allows them to see pretty much everywhere 0:05:28.000 --> 0:05:31.440 you go, everything you do for however long the warrant lasts, 0:05:31.520 --> 0:05:34.680 and sometimes you can get a significant warrant. And in 0:05:34.720 --> 0:05:37.520 the case the United States Carpenter, the Supreme Court was 0:05:37.680 --> 0:05:42.640 very skeptical of that, very skeptical of these seven dragnet 0:05:43.040 --> 0:05:47.279 surveillance tools, not just because there wasn't warrant, there wasn't 0:05:47.279 --> 0:05:49.640 a warrant, but because of the quantity and the quality 0:05:49.680 --> 0:05:52.680 of the information. So in defending the GEO warrant in 0:05:52.720 --> 0:05:56.120 this case, the Justice Department argues that Google users give 0:05:56.200 --> 0:05:59.599 up their expectation of privacy when they let the company 0:05:59.680 --> 0:06:03.480 collect data on their phone. Do you agree with that, Well, 0:06:03.520 --> 0:06:06.120 that's what the government argued. But as I was saying earlier, 0:06:06.200 --> 0:06:10.279 it's a very big difference first between giving information to 0:06:10.320 --> 0:06:12.760 a private company in order to gain some benefits like 0:06:12.880 --> 0:06:15.560 be able to find your way in a new city 0:06:15.640 --> 0:06:18.680 through Google Maps and having the government be able to 0:06:18.680 --> 0:06:22.320 have access to that information. So that's one of the differences. Second, 0:06:22.839 --> 0:06:25.200 I think it's just plain wrong, even if the government 0:06:25.240 --> 0:06:28.159 were not involved in the story, it's just plain wrong 0:06:28.279 --> 0:06:30.400 to say that we give up our privacy rights the 0:06:30.480 --> 0:06:33.560 moment we share information with a third party. If that 0:06:33.680 --> 0:06:37.000 were true, then the moment we walked out of our houses, 0:06:37.040 --> 0:06:39.920 we would lose our privacy rights. The moment we spoke 0:06:39.960 --> 0:06:42.960 to another person, we would lose our privacy rights. Now, 0:06:43.000 --> 0:06:48.560 of course, the US government, Facebook, Google, large tech companies 0:06:48.760 --> 0:06:52.800 make that exact argument in court all the time. Our 0:06:52.920 --> 0:06:55.920 users have no privacy rights. Individuals have no privacy rights 0:06:55.920 --> 0:07:01.240 because they voluntarily shared information. It's a cynical loy that 0:07:01.560 --> 0:07:07.720 is based on American laws tradition of seeing privacy in 0:07:07.880 --> 0:07:12.360 terms of control. It's a longstanding discourse of what privacy means. 0:07:12.880 --> 0:07:16.680 That is, privacy is the ability to control the dissemination 0:07:16.720 --> 0:07:21.280 of information about you. That definition undergird so much of 0:07:21.320 --> 0:07:25.520 privacy law, whether it's privacy we have against another private 0:07:25.560 --> 0:07:29.120 party like a tech company or another person or the government. 0:07:29.560 --> 0:07:33.320 But the implication of that is that if privacy is 0:07:33.360 --> 0:07:36.760 about controlling the dissemination of your information. Once you share 0:07:36.800 --> 0:07:39.760 that information with a third party, you lost control of it. 0:07:40.040 --> 0:07:42.960 So it's a weak form of privacy that the government 0:07:42.960 --> 0:07:45.440 and tech companies have been taking advantage of for so long. 0:07:45.920 --> 0:07:49.200 That's why we feel like we have no privacy, despite 0:07:49.240 --> 0:07:51.760 all these companies saying we care about your privacy and 0:07:51.880 --> 0:07:55.680 these privacy wizards and these cookie banners. At its heart, 0:07:55.840 --> 0:08:00.400 the law itself is undermining our ability to TechEd our 0:08:00.440 --> 0:08:05.640 privacy because of this individuated control based definition. So in 0:08:05.680 --> 0:08:09.560 another case, concerning a search for suspects in ten fires 0:08:09.560 --> 0:08:14.080 in the Chicago area, a federal judge approved a government 0:08:14.120 --> 0:08:17.840 request for location data from Google. What kind of a 0:08:17.960 --> 0:08:24.080 test did that judge use? Normally, warrants are given where 0:08:24.080 --> 0:08:28.280 there's probable cause that criminal activities occur. So on any 0:08:28.400 --> 0:08:31.320 given case, you know, a judge will get evidence before 0:08:31.440 --> 0:08:34.600 when the when the proper party applies for a warrant, 0:08:34.880 --> 0:08:37.920 and they'll see, Okay, here's the information. This is the 0:08:38.040 --> 0:08:41.040 data that law enforcement wants in order to rest or 0:08:41.240 --> 0:08:45.079 find more information. And therefore, okay, let me determine if 0:08:45.080 --> 0:08:48.960 there's probable cause based on the information before me. So 0:08:49.040 --> 0:08:53.320 that's a one off decision, right, Judges when when determining warrants, 0:08:53.360 --> 0:08:58.040 don't make decisions about how one particular case or one 0:08:58.080 --> 0:09:02.240 particular motion in front of them affects the wider system 0:09:02.320 --> 0:09:05.160 or implicates the wider system of surveillance. So it's a 0:09:05.200 --> 0:09:08.200 one off. The nature of a one off decision is 0:09:08.240 --> 0:09:10.800 that it is made in a vacuum. It doesn't notice 0:09:10.960 --> 0:09:15.040 or doesn't know that, or doesn't care really that the 0:09:15.240 --> 0:09:18.920 quality and the quantity of information that a geofense warrant 0:09:18.960 --> 0:09:23.960 or another database more warrant for data um will gather 0:09:24.520 --> 0:09:28.640 so significant of information that the entire for that the 0:09:28.679 --> 0:09:32.560 person's everything about the person, not just about their criminal activity. 0:09:32.600 --> 0:09:37.040 Potential criminal activity is subject to be known by the police. 0:09:37.160 --> 0:09:40.640 So it's very easy to approve one of these warrants 0:09:40.800 --> 0:09:45.000 considering that the surveillance context in which it sits is 0:09:45.040 --> 0:09:49.439 not really part of the judges determined determination. What's really 0:09:49.480 --> 0:09:51.959 part of the judges determination is just is there a 0:09:51.960 --> 0:09:55.000 probable cause here and does this warrant make sense? And 0:09:55.760 --> 0:09:57.560 it's a lot easier to make that choice than it 0:09:57.720 --> 0:10:00.600 is to say, well, this is part of a larger 0:10:00.640 --> 0:10:04.400 system of surveillance that is uh problematic for the fourth amend? 0:10:05.320 --> 0:10:08.880 Do you have any reason to think that the judge 0:10:08.880 --> 0:10:11.319 in this case is going to rule that the warrant 0:10:11.480 --> 0:10:17.439 was invalid? Well, I can hope. Um. There's a forthcoming 0:10:17.559 --> 0:10:22.360 paper in the Harvard Law Review by professor at the 0:10:22.480 --> 0:10:26.120 University of Utah named Matthew Tocsin, and he's done a 0:10:26.160 --> 0:10:31.000 really great job of taking every single post Carpenter case 0:10:31.440 --> 0:10:36.679 and analyzing how court lower courts, tel courts, disrecord, state courts, 0:10:36.679 --> 0:10:39.680 how they've interpreted Carpenter. And this is going to be 0:10:39.679 --> 0:10:42.600 another one of those data points, because here the judge 0:10:42.640 --> 0:10:45.679 has the opportunity to look at this surveillance, look at 0:10:45.720 --> 0:10:48.480 what the police asked for and what they did, and 0:10:48.600 --> 0:10:54.640 see has this surveillance gathered so much information the so 0:10:54.720 --> 0:10:58.720 called aggregation theory of surveillance or mosaic theory of surveillance, 0:10:59.240 --> 0:11:03.959 such that it provided no privacy whatsoever. When more surveillance 0:11:04.000 --> 0:11:06.440 over and above what would be necessary or what would 0:11:06.440 --> 0:11:10.360 be expected as would be necessary for this particular criminal investigation, 0:11:10.679 --> 0:11:13.880 Now it's kimely possible that the court will you take 0:11:13.920 --> 0:11:17.800 Professor Toxsin's advice and do a nuanced analysis, But more 0:11:17.880 --> 0:11:21.520 often than not, the federal courts, which definitely have a 0:11:21.520 --> 0:11:25.000 conservative tilt, more often than not side with law enforcements. 0:11:25.280 --> 0:11:28.600 So maybe that's just my cynicism, but I don't really 0:11:28.640 --> 0:11:33.600 expect much of this federal bench. But the appellate courts 0:11:33.600 --> 0:11:35.920 of the Supreme Court, you know, when it comes to 0:11:35.920 --> 0:11:41.080 these issues, they don't always fall down traditional ideological lines. 0:11:41.400 --> 0:11:44.840 So it's an open question what might happen as more 0:11:45.040 --> 0:11:49.200 courts start to interpret or think about the constitutionality of 0:11:49.200 --> 0:11:52.280 these types of warms. Are legal experts in the privacy 0:11:52.320 --> 0:11:56.320 area paying attention to this case? Sure, I mean, these 0:11:56.400 --> 0:11:59.600 kind of cases are always come before, we always come 0:12:00.040 --> 0:12:03.360 us our death. We're whether we're teaching about it or 0:12:03.840 --> 0:12:06.319 um talking about it or using them as example of 0:12:06.320 --> 0:12:09.720 in our research. The interesting thing about geo fence warrants 0:12:09.920 --> 0:12:14.480 is that it implicates both It's interesting for scholars who 0:12:14.559 --> 0:12:17.880 scholars of the Fourth Amendment, so government access to information, 0:12:17.920 --> 0:12:20.760 but also people like me, who I mean I do 0:12:20.840 --> 0:12:24.760 I focus much more on the relationships between individuals and 0:12:24.800 --> 0:12:28.600 private companies because this source of the source of all 0:12:28.640 --> 0:12:31.280 this data is not the government gathering the information on 0:12:31.640 --> 0:12:36.800 its own. It implicates our expectations about what a private 0:12:36.800 --> 0:12:40.080 company like Google will do with our data or what 0:12:40.200 --> 0:12:42.600 goes on when we make decisions about the tools that 0:12:42.679 --> 0:12:45.920 we use, the apps that we use, and so forth. 0:12:46.040 --> 0:12:47.840 That really has nothing to do with the government. But 0:12:47.960 --> 0:12:51.480 yet our system allows the government great access to that. 0:12:51.640 --> 0:12:54.559 So I would expect not just Professor Tompson, but I 0:12:54.600 --> 0:12:57.120 would expect that a lot of law professors and a 0:12:57.120 --> 0:13:00.000 lot of legal advocates and pol privacy advocates. I think 0:13:00.000 --> 0:13:04.400 me about this. Albert fox Cohn, who's a privacy advocate, 0:13:04.440 --> 0:13:07.600 runs a nonprofit in New York City. He's written several 0:13:08.000 --> 0:13:12.599 um poignant and uh cojen op eds about g f 0:13:12.679 --> 0:13:15.320 N S Warren's showing how dangerous they are. So this 0:13:15.400 --> 0:13:18.800 is a hot topic right now, and hopefully judges are 0:13:18.800 --> 0:13:23.600 taking note. You've written a book, Industry Unbound, the inside 0:13:23.679 --> 0:13:27.360 story of privacy, data and corporate power. So let me 0:13:27.440 --> 0:13:31.559 ask you, what can the average person do to protect 0:13:31.720 --> 0:13:36.839 their privacy? Because using Google Maps as an example, it 0:13:36.880 --> 0:13:40.679 makes it so easy to get around anywhere in the world. Basically, 0:13:41.160 --> 0:13:45.440 it's hard to give that up for the concept of privacy. Yeah, 0:13:45.440 --> 0:13:48.000 I get this question a lot, and you're right. I mean, 0:13:48.040 --> 0:13:50.480 I barely know how to get from place A to B. 0:13:50.640 --> 0:13:53.800 So I use Google Maps all the time. But I'll 0:13:53.800 --> 0:13:56.160 play a little bit of a law professor game here 0:13:56.200 --> 0:13:59.160 and say that is the wrong question. In fact, what 0:13:59.280 --> 0:14:01.800 can the individual will do is exactly the question that 0:14:01.880 --> 0:14:05.479 companies want us to be asking ourselves, because it implies 0:14:05.559 --> 0:14:08.760 that protecting privacy is something that we can do in 0:14:08.800 --> 0:14:13.319 the world in informational capitalism, in the world that privacy 0:14:13.440 --> 0:14:17.520 law and the law has set up, almost nothing an 0:14:17.559 --> 0:14:21.080 individual can do can protect their privacy. I'm sorry to say, 0:14:21.120 --> 0:14:24.680 but there is nothing that we as individuals can do. Sure, 0:14:24.880 --> 0:14:27.360 you can use a VPN, a virtual private network, You 0:14:27.400 --> 0:14:32.560 can use Firefox instead of Google Chrome, you can say 0:14:32.600 --> 0:14:36.680 no to all personalization cookies. All of that is great. 0:14:36.720 --> 0:14:38.840 Anyone can do that. If you want to go through 0:14:38.880 --> 0:14:42.480 the work of doing all those toggles, your Internet experience 0:14:42.600 --> 0:14:44.640 is not going to change very much, and some of 0:14:44.640 --> 0:14:47.120 your privacy will be protected. But all of that is 0:14:47.200 --> 0:14:51.920 marginal because even if you do all those things, these 0:14:51.920 --> 0:14:56.160 companies are still collecting terabytes of data about you passively. 0:14:56.520 --> 0:14:59.200 Even if you don't accept cookies, you're on their website. 0:14:59.280 --> 0:15:01.880 They know where are, they know what hardware you're using, 0:15:02.040 --> 0:15:04.280 they know where your cursor is they know your purchase 0:15:04.400 --> 0:15:08.560 histories because companies can buy it from data brokers. So 0:15:08.920 --> 0:15:12.240 it's the wrong question to ask what we need to do. 0:15:12.360 --> 0:15:16.280 The only way that individuals will ever be empowered to 0:15:16.400 --> 0:15:21.120 protect their privacy is when the current political economy of 0:15:21.520 --> 0:15:25.280 big tech in the data economy is overturned, or is rejected, 0:15:25.360 --> 0:15:29.520 or is completely reformed such that we actually do have 0:15:29.560 --> 0:15:33.240 those tools. So, although that's very cynical, what we really 0:15:33.240 --> 0:15:35.960 should be asking ourselves is what can we do to 0:15:36.080 --> 0:15:40.560 ensure structural reform, whether that means voting for the right 0:15:40.720 --> 0:15:46.320 political leaders who will actually pass honest reform versus people 0:15:46.400 --> 0:15:49.760 who only talk about big tech for conservative political gain, 0:15:50.280 --> 0:15:53.600 whether it's not just a political leaders that we vote for, 0:15:53.920 --> 0:15:56.920 but what happens in our own schools, Like are we 0:15:57.000 --> 0:16:01.520 okay with our employers, how having a contract with Google 0:16:01.920 --> 0:16:06.080 to allow us to Google docs while also feeling data 0:16:06.120 --> 0:16:09.800 in the process, or would we be more well served 0:16:09.840 --> 0:16:14.520 with a similar product that doesn't include rampant data collection 0:16:14.560 --> 0:16:17.280 like Google Docs. So those are the kind of things 0:16:17.280 --> 0:16:20.200 that we really need to be thinking of, and we 0:16:20.240 --> 0:16:23.440 also need to create a larger ground. So will a 0:16:23.520 --> 0:16:29.040 larger movement for privacy reform because without that, politicians are 0:16:29.040 --> 0:16:33.240 just going to take more big tech money and maintain 0:16:33.800 --> 0:16:37.400 the status quo with some changes around the edges. The 0:16:37.440 --> 0:16:40.680 book is based on four years of research. Tell us 0:16:40.960 --> 0:16:43.680 what you did during those four years, who you talk to, 0:16:43.840 --> 0:16:47.800 how you've got access? Sure, So the book Industry on 0:16:47.920 --> 0:16:51.000 Bound is based on nearly four years of field work. 0:16:51.120 --> 0:16:55.440 And it's not four years five days a year, but 0:16:56.080 --> 0:16:59.960 it's a It's based on interviews with current and four 0:17:00.040 --> 0:17:04.720 UMER employees and current and firmer employees of big tech companies, 0:17:05.040 --> 0:17:11.840 and that include engineers, UM, privacy professionals, product managers, lawyers, 0:17:11.880 --> 0:17:16.200 as well as interviews with law firm partners and associates 0:17:16.320 --> 0:17:21.640 and UM as well, in addition reviews of confidential documents 0:17:21.640 --> 0:17:24.560 that have been redacted. I also had the opportunity to 0:17:24.800 --> 0:17:29.200 be embedded for a couple of days around a week 0:17:29.280 --> 0:17:33.359 er and so in one case inside UM several medium 0:17:33.400 --> 0:17:36.080 size and small tech companies just to see how they 0:17:36.200 --> 0:17:39.719 run their meetings and UH interview some of their people 0:17:40.240 --> 0:17:43.040 talk about how they do privacy law on the ground. 0:17:43.400 --> 0:17:45.480 Getting access was really hard. I had a lot of 0:17:45.520 --> 0:17:48.199 companies just say no, we're not interested in this. So 0:17:48.320 --> 0:17:53.760 I had to find other routes, including snowball sampling, finding 0:17:54.119 --> 0:17:57.240 social network that gives me access to people who formerly 0:17:57.240 --> 0:18:00.280 worked as a company. In fact, Facebook just refused to apply. 0:18:01.320 --> 0:18:05.240 Google insisted that if I talked to anyone, it has 0:18:05.280 --> 0:18:07.800 to be on deep background. I can't quote anyone, And 0:18:07.840 --> 0:18:14.440 in fact Facebook UM eventually replied to multiple emails later 0:18:14.560 --> 0:18:17.240 several years down the line and said that if we 0:18:17.280 --> 0:18:21.560 talk to you, we have to get We require approval 0:18:22.280 --> 0:18:26.600 of all quotes from Facebook employees, as well as approval 0:18:26.640 --> 0:18:30.160 of the manuscript. And whereas that might be that kind 0:18:30.160 --> 0:18:33.800 of access might be helpful for some researchers, that violates 0:18:34.119 --> 0:18:36.919 research ethics. So I ended up having to do a 0:18:36.960 --> 0:18:40.360 lot more work to get access from the back end, 0:18:40.560 --> 0:18:45.040 like through former employees or through current employees at conferences 0:18:45.480 --> 0:18:50.320 UM something we call interface ethnography, where companies have open 0:18:50.880 --> 0:18:53.440 um events where they talk about their products, where you're 0:18:53.440 --> 0:18:56.320 able to ask questions. Those kind of tools, those kind 0:18:56.359 --> 0:19:01.200 of methods really helps paint a picture UM that maybe 0:19:01.240 --> 0:19:04.800 sometimes the company, an official tour by the company would 0:19:04.840 --> 0:19:09.480 not have so correct me if I'm wrong, But you 0:19:09.520 --> 0:19:13.440 contend that the systems the tech companies have to comply 0:19:13.680 --> 0:19:20.760 with privacy laws are designed to intentionally undermine our privacy. 0:19:21.240 --> 0:19:25.520 That's exactly right, there's there's. The argument is broader than that. 0:19:25.600 --> 0:19:30.200 The argument is that the systems in place coops both 0:19:30.240 --> 0:19:35.119 privacy law and people who are who see themselves as 0:19:35.160 --> 0:19:39.399 privacy advocates that are working on the inside on on 0:19:39.680 --> 0:19:45.080 these on these compliance on compliance elements are on design. Essentially, 0:19:45.680 --> 0:19:55.280 the organizational structures inside companies take engineers, privacy professionals, salespeople, designers, advocate, 0:19:55.520 --> 0:20:01.359 um executives, and whomever, whatever they're reasons for coming to 0:20:01.400 --> 0:20:05.000 the company, and even if they care so much about privacy, 0:20:05.040 --> 0:20:09.520 going in the systems inside the company, there their control 0:20:09.600 --> 0:20:13.120 over discourse, their control over the definitions of privacy, their 0:20:13.119 --> 0:20:16.600 control over how people do their work, their control over 0:20:16.640 --> 0:20:21.000 how design functions, and the relationships between designers and lawyers 0:20:21.040 --> 0:20:25.200 and designers and privacy professionals, and the organizational barriers that 0:20:25.280 --> 0:20:29.640 companies put in front of privacy professionals, and the way 0:20:29.680 --> 0:20:34.600 they habituate privacy workers into doing into thinking about privacy 0:20:34.600 --> 0:20:37.200 and narrow ways all of these things, it almost doesn't 0:20:37.280 --> 0:20:41.280 matter if someone is a privacy advocate. It channels all 0:20:41.560 --> 0:20:46.560 work into data extracted ends and when a system of 0:20:46.680 --> 0:20:49.760 law like we have privacy law like the gdp R 0:20:49.840 --> 0:20:52.959 in Europe and all of the proposals that have been 0:20:53.000 --> 0:20:55.879 introduced as the US Congress and the state. When a 0:20:55.920 --> 0:20:59.760 system of law is based on third party compliance, when 0:20:59.760 --> 0:21:05.680 it's based on internal structures to fill out forms, to 0:21:05.840 --> 0:21:09.280 keep records, to fill out to complete privacy impact assessments, 0:21:09.920 --> 0:21:14.320 a system that co opts those, uh, those people and 0:21:14.359 --> 0:21:17.480 those tools is a system that does not protect privacy 0:21:17.520 --> 0:21:20.240 at all. So in that sense, yes, the systems that 0:21:20.280 --> 0:21:24.879 these companies have created are built to purposely undermine our privacy. 0:21:25.080 --> 0:21:27.920 Al Right, Often we get alerts from Google and other 0:21:28.000 --> 0:21:32.240 sites saying we value your privacy, go through these steps 0:21:32.400 --> 0:21:36.080 to help protect your information. I mean, should we bother 0:21:36.240 --> 0:21:40.640 with that? Yeah? Well, part of what that does is 0:21:41.280 --> 0:21:46.320 it create, it maintains or or maintains this myth that 0:21:46.720 --> 0:21:51.160 protecting your privacy is something that is your individual responsibility. 0:21:51.720 --> 0:21:54.640 It's like you have to do the work. You you 0:21:54.800 --> 0:21:57.680 have to click these buttons. Setting aside the fact that 0:21:57.760 --> 0:22:00.119 a lot of these companies don't even provide you with 0:22:00.200 --> 0:22:03.959 the options of doing that. When Google sends you an email, 0:22:03.960 --> 0:22:07.080 it sends you an email and says we value your privacy. 0:22:07.119 --> 0:22:10.560 It's mostly just to notify you have changes the Private 0:22:10.600 --> 0:22:13.880 to their privacy policy that you really have no option 0:22:14.000 --> 0:22:17.200 to opt out. Right, It's just here's the deal, and 0:22:17.240 --> 0:22:21.160 this is what's happening. But as an aside, I mean, 0:22:21.200 --> 0:22:24.560 that's part of a larger campaign, a larger purpose is 0:22:24.840 --> 0:22:28.920 to make you think the privacy is something that we control. 0:22:29.359 --> 0:22:32.479 That these toggle buttons. Every time you go onto your 0:22:32.480 --> 0:22:35.560 iPhone and toggle the button you green to gray or 0:22:35.600 --> 0:22:38.720 great to green, you're turning on something, you're turning off something, 0:22:38.720 --> 0:22:42.720 you're protecting where that information goes. Even though that is 0:22:42.920 --> 0:22:46.840 more of a performance that performance. This this just the 0:22:46.960 --> 0:22:51.120 action of clicking, okay, the action of toggling these buttons. 0:22:51.560 --> 0:22:55.360 It habituates us into thinking that privacy is something that 0:22:55.600 --> 0:22:58.000 we're on, we're in control of, that we're we're in 0:22:58.080 --> 0:23:00.840 charge of when it's back. The options that they give 0:23:00.880 --> 0:23:04.800 us are so minimal, or they're so complex and so 0:23:04.920 --> 0:23:08.320 difficult to actually run through. Imagine trying to manage all 0:23:08.359 --> 0:23:11.440 of your privacy, all the privacy toggles on every app 0:23:11.520 --> 0:23:14.280 on your phone right now, or on every website that 0:23:14.320 --> 0:23:18.160 you've ever visited. That's impossible to do. Yet the company 0:23:18.240 --> 0:23:22.520 frames it in this empowering language. We're putting you in control. 0:23:23.000 --> 0:23:27.520 That kind of control is anything but control. Every time 0:23:27.520 --> 0:23:31.439 the government is going to enforce privacy, let's say the 0:23:31.640 --> 0:23:37.600 settlement agreements they've made with Facebook, Facebook still violates privacy 0:23:37.720 --> 0:23:41.200 rights and then makes another settlement agreement with the FTC. 0:23:41.920 --> 0:23:48.080 Is anyone monitoring what these companies do? Yeah, so the FTC, 0:23:48.440 --> 0:23:52.240 You're absolutely right to note that Facebook is a serial 0:23:52.400 --> 0:23:57.320 violator of not only our privacy, but supposed consent decree, 0:23:57.400 --> 0:24:00.840 but consent increase from the SEC. It's serial violation of 0:24:00.920 --> 0:24:04.119 It just goes to show you how much FTC and 0:24:04.400 --> 0:24:07.320 agreements have been just slaps on the risk. The FEC 0:24:07.520 --> 0:24:09.479 is a weak agency when it comes down to it. 0:24:09.480 --> 0:24:12.120 It's a weak agency. It has better appointees now under 0:24:12.160 --> 0:24:15.320 the Biden administration who hope to empower it, but it's 0:24:15.320 --> 0:24:19.960 a weak agency that for the last thirty years, most 0:24:20.040 --> 0:24:24.160 of the people who sat on the FTC have seen 0:24:24.320 --> 0:24:27.919 their role. It seen part of their role as not 0:24:27.920 --> 0:24:32.840 not to protect privacy, but to protect privacy only so 0:24:32.920 --> 0:24:37.440 much as it doesn't harm innovation. A lot of FTC 0:24:37.520 --> 0:24:41.000 commissioners to said part of their job is to maintain innovation, 0:24:41.080 --> 0:24:44.600 to tell to listen to companies and say and listen 0:24:44.640 --> 0:24:46.480 to them when they say that, oh no, we can't 0:24:46.480 --> 0:24:49.120 do this or don't require us to do this because 0:24:49.160 --> 0:24:52.480 of a harm innovation. And that goes a law that 0:24:52.520 --> 0:24:55.679 goes very far to and I quote some of these 0:24:56.359 --> 0:24:59.840 FEC commissioners and lobbyists and so forth in the book, 0:25:00.040 --> 0:25:02.200 it goes very far to show why the SEC has 0:25:02.200 --> 0:25:06.240 been so so weak. UM and these consent a crees 0:25:06.359 --> 0:25:10.680 allow the company to get off scott free because it's 0:25:10.720 --> 0:25:15.120 basically a settlement. There's no order, there's no UM, there's 0:25:15.160 --> 0:25:22.200 no requirements other than complete this audit or fill out 0:25:22.240 --> 0:25:24.600 this document. But one of the things that I found 0:25:25.119 --> 0:25:30.199 during my research also UM Megan Gray, who used to 0:25:30.200 --> 0:25:34.040 be at Stanford Center for Internet and Society, also found 0:25:34.040 --> 0:25:38.080 this when she reviewed these audits. What I found were 0:25:38.119 --> 0:25:40.680 that a lot of these audit reports that were going 0:25:40.720 --> 0:25:45.080