Law Commons^™

Privacy Nicks: How The Law Normalizes Surveillance, Woodrow Hartzog, Evan Selinger, Johanna Gunawan

Faculty Scholarship

Privacy law is failing to protect individuals from being watched and exposed, despite stronger surveillance and data protection rules. The problem is that our rules look to social norms to set thresholds for privacy violations, but people can get used to being observed. In this article, we argue that by ignoring de minimis privacy encroachments, the law is complicit in normalizing surveillance. Privacy law helps acclimate people to being watched by ignoring smaller, more frequent, and more mundane privacy diminutions. We call these reductions “privacy nicks,” like the proverbial “thousand cuts” that lead to death.

Privacy nicks come from the …

Femtechnodystopia, Leah R. Fowler, Michael Ulrich

Faculty Scholarship

Reproductive rights, as we have long understood them, are dead. But at the same time history seems to be moving backward, technology moves relentlessly forward. Femtech products, a category of consumer technology addressing an array of “female” health needs, seem poised to fill gaps created by states and stakeholders eager to limit birth control and abortion access and increase pregnancy surveillance and fetal rights. Period and fertility tracking applications could supplement or replace other contraception. Early digital alerts to missed periods can improve the chances of obtaining a legal abortion in states with ever-shrinking windows of availability or prompt behavioral …

Immigration Detention Abolition And The Violence Of Digital Cages, Sarah R. Sherman-Stokes

Faculty Scholarship

The United States has a long history of devastating immigration enforcement and surveillance. Today, in addition to more than 34,000 people held in immigration detention, Immigration and Customs Enforcement (“ICE”) surveils an astounding 296,000 people under its “Alternatives to Detention” program. The number of people subjected to this surveillance has grown dramatically in the last two decades, from just 1,339 in 2005. ICE’s rapidly expanding Alternatives to Detention program is marked by “digital cages,” consisting of GPS-outfitted ankle shackles and invasive phone and location tracking. Government officials and some immigrant advocates have categorized these digital cages as a humane “reform”; …

The Surprising Virtues Of Data Loyalty, Woodrow Hartzog, Neil M. Richards

Faculty Scholarship

Lawmakers in the United States and Europe are seriously considering imposing duties of data loyalty that implement ideas from privacy law scholarship, but critics claim such duties are unnecessary, unworkable, overly individualistic, and indeterminately vague. This paper takes those criticisms seriously, and its analysis of them reveals that duties of data loyalty have surprising virtues. Loyalty, it turns out, can support collective well-being by embracing privacy’s relational turn; it can be a powerful state of mind for reenergizing privacy reform; it prioritizes human values rather than potentially empty formalism; and it offers solutions that are flexible and clear rather than …

Legislating Data Loyalty, Woodrow Hartzog, Neil Richards

Faculty Scholarship

Lawmakers looking to embolden privacy law have begun to consider imposing duties of loyalty on organizations trusted with people’s data and online experiences. The idea behind loyalty is simple: organizations should not process data or design technologies that conflict with the best interests of trusting parties. But the logistics and implementation of data loyalty need to be developed if the concept is going to be capable of moving privacy law beyond its “notice and consent” roots to confront people’s vulnerabilities in their relationship with powerful data collectors.

In this short Essay, we propose a model for legislating data loyalty. Our …

What Is Privacy? That’S The Wrong Question, Woodrow Hartzog

Faculty Scholarship

Privacy has never had a precise meaning. But in the early 1900s, the concept took on new life as a term of art in legal frameworks. The result has been a bit of a mess, as no singular definition has been adequate for all purposes. Daniel Solove, perhaps the most influential privacy scholar of our day, wrote at the turn of the millennium that privacy was “a concept in disarray.”

In this short essay reflecting upon Solove’s impact on the modern study of information privacy, I argue that the chaos and futility of competing conceptualizations of privacy is why Solove’s …

The Covid-19 Pandemic And The Technology Trust Gap, Johanna Gunawan, David Choffnes, Woodrow Hartzog, Christo Wilson

Faculty Scholarship

Industry and government tried to use information technologies to respond to the COVID-19 pandemic, but using the internet as a tool for disease surveillance, public health messaging, and testing logistics turned out to be a disappointment. Why weren’t these efforts more effective? This Essay argues that industry and government efforts to leverage technology were doomed to fail because tech platforms have failed over the past few decades to make their tools trustworthy, and lawmakers have done little to hold these companies accountable. People cannot trust the interfaces they interact with, the devices they use, and the systems that power tech …

A Duty Of Loyalty For Privacy Law, Neil M. Richards, Woodrow Hartzog

Faculty Scholarship

Data privacy law fails to stop companies from engaging in self-serving, opportunistic behavior at the expense of those who trust them with their data. This is a problem. Modern tech companies are so entrenched in our lives and have so much control over what we see and click that the self-dealing exploitation of people has become a major element of the internet’s business model.

Academics and policymakers have recently proposed a possible solution: require those entrusted with people’s data and online experiences to be loyal to those who trust them. But many have concerns about a duty of loyalty. What, …

The Case Of The Nosy Neighbors, Johanna Gunawan, Woodrow Hartzog

Faculty Scholarship

Inspired by companies like Clearview AI, Nextdoor, and Amazon, this case study asks students to assume the role of a high-ranking ethics-focused employee at a (fictional) neighborhood-focused social media company. It involves challenging ethical questions around how social media services and surveillance tools are built and used, and the complicated relationship between companies, their users, and law enforcement authorities. Students should pay particular attention to the values implicated by certain design decisions, and the competing incentives for corporations that might complicate the picture for ethical decision making.

Privacy In Pandemic: Law, Technology, And Public Health In The Covid-19 Crisis, Tiffany Li

Faculty Scholarship

The COVID-19 pandemic has caused millions of deaths and disastrous consequences around the world, with lasting repercussions for every field of law, including privacy and technology. The unique characteristics of this pandemic have precipitated an increase in use of new technologies, including remote communications platforms, healthcare robots, and medical AI. Public and private actors are using new technologies, like heat sensing, and technologically-influenced programs, like contact tracing, alike in response, leading to a rise in government and corporate surveillance in sectors like healthcare, employment, education, and commerce. Advocates have raised the alarm for privacy and civil liberties violations, but the …

Fixing Informational Asymmetry Through Trademark Search, Jessica Silbey

Faculty Scholarship

I call this paper a “Levendowski special.” It follows the signature format of much of Professor Levendowski’s prior work which, as in the latest article, recruits a legal tool typically aimed at one set of problems for the purpose of cleverly addressing a different set of problems. Her past articles harnessed copyright law to “fix artificial intelligence’s implicit bias” (2018) and to “combat revenge porn.” (2014). This paper draws on Professor Levendowski’s expertise working in private practice as a trademark attorney to address the problem of surveillance technology opacity. It is a primer on how to investigate trademark …

A New Compact For Sexual Privacy, Danielle K. Citron

Faculty Scholarship

Intimate life is under constant surveillance. Firms track people’s periods, hot flashes, abortions, sexual assaults, sex toy use, sexual fantasies, and nude photos. Individuals hardly appreciate the extent of the monitoring, and even if they did, little can be done to curtail it. What is big business for firms is a big risk for individuals. The handling of intimate data undermines the values that sexual privacy secures—autonomy, dignity, intimacy, and equality. It can imperil people’s job, housing, insurance, and other crucial opportunities. More often, women and minorities shoulder a disproportionate amount of the burden.

Privacy law is failing us. Our …

Digital Health Privacy In Active-Aging Settings: Will The Law Let You Age Well?, Tara Sklar, Richard Carmona, Kathie Insel, Christopher Robertson

Faculty Scholarship

What is privacy and how are our interpretations of it changing with advances in technology? This question, and concerns around potentially violating a person’s right to privacy, have been emerging across industries around the world. Senior living providers have increased their exposure to privacy risks with the shift to implementing sensors throughout their communities. Typically located in digital health devices that can be worn on the body or placed in the environment, these sensors are capable of collecting and tracking data relevant to a person’s health and well-being on a continuous monitoring basis.

There are privacy laws and a growing …

The Public Information Fallacy, Woodrow Hartzog

Faculty Scholarship

The concept of privacy in “public” information or acts is a perennial topic for debate. It has given privacy law fits. People struggle to reconcile the notion of protecting information that has been made public with traditional accounts of privacy. As a result, successfully labeling information as public often functions as a permission slip for surveillance and personal data practices. It has also given birth to a significant and persistent misconception — that public information is an established and objective concept.

In this article, I argue that the “no privacy in public” justification is misguided because nobody knows what “public” …

The Inconsentability Of Facial Surveillance, Evan Selinger, Woodrow Hartzog

Faculty Scholarship

Governments and companies often use consent to justify the use of facial recognition technologies for surveillance. Many proposals for regulating facial recognition technology incorporate consent rules as a way to protect those faces that are being tagged and tracked. But consent is a broken regulatory mechanism for facial surveillance. The individual risks of facial surveillance are impossibly opaque, and our collective autonomy and obscurity interests aren’t captured or served by individual decisions.

In this article, we argue that facial recognition technologies have a massive and likely fatal consent problem. We reconstruct some of Nancy Kim’s fundamental claims in Consentability: Consent …

Body Cameras And The Path To Redeem Privacy Law, Woodrow Hartzog

Faculty Scholarship

From a privacy perspective, the movement towards police body cameras seems ominous. The prospect of a surveillance device capturing massive amounts of data concerning people’s most vulnerable moments is daunting. These concerns are compounded by the fact that there is little consensus and few hard rules on how and for whom these systems should be built and used. But in many ways, this blank slate is a gift. Law and policy makers are not burdened by the weight of rules and technologies created in a different time for a different purpose. These surveillance and data technologies will be modern. Many …

Searching Places Unknown: Law Enforcement Jurisdiction On The Dark Web, Ahmed Ghappour

Faculty Scholarship

The use of hacking tools by law enforcement to pursue criminal suspects who have anonymized their communications on the dark web presents a looming flashpoint between criminal procedure and international law. Criminal actors who use the dark web (for instance, to commit crimes or to evade authorities) obscure digital footprints left behind with third parties, rendering existing surveillance methods obsolete. In response, law enforcement has implemented hacking techniques that deploy surveillance software over the Internet to directly access and control criminals’ devices. The practical reality of the underlying technologies makes it inevitable that foreign-located computers will be subject to remote …

Privacy's Trust Gap, Neil M. Richards, Woodrow Hartzog

Faculty Scholarship

It can be easy to get depressed about the state of privacy these days. In an age of networked digital information, many of us feel disempowered by the various governments, companies, and criminals trying to peer into our lives to collect our digital data trails. When so much is in flux, the way we think about an issue matters a great deal. Yet while new technologies abound, our ideas and thinking — as well as our laws — have lagged in grappling with the new problems raised by the digital revolution. In their important new book, Obfuscation: A User’s Guide …

Spying Inc., Danielle K. Citron

Faculty Scholarship

The latest spying craze is the “stalking app.” Once installed on someone’s cell phone, the stalking app provides continuous access to the person’s calls, texts, snap chats, photos, calendar updates, and movements. Domestic abusers and stalkers frequently turn to stalking apps because they are undetectable even to sophisticated phone owners.

Business is booming for stalking app providers, even though their entire enterprise is arguably illegal. Federal and state wiretapping laws ban the manufacture, sale, or advertisement of devices knowing their design makes them primarily useful for the surreptitious interception of electronic communications. But those laws are rarely, if ever, enforced. …

Surveillance As Loss Of Obscurity, Woodrow Hartzog, Evan Selinger

Faculty Scholarship

Everyone seems concerned about government surveillance, yet we have a hard time agreeing when and why it is a problem and what we should do about it. When is surveillance in public unjustified? Does metadata raise privacy concerns? Should encrypted devices have a backdoor for law enforcement officials? Despite increased attention, surveillance jurisprudence and theory still struggle for coherence. A common thread for modern surveillance problems has been difficult to find.

In this article we argue that the concept of ‘obscurity,’ which deals with the transaction costs involved in finding or understanding information, is the key to understanding and uniting …

Promoting Innovation While Preventing Discrimination: Policy Goals For The Scored Society, Danielle K. Citron, Frank Pasquale

Faculty Scholarship

There are several normative theories of jurisprudence supporting our critique of the scored society, which complement the social theory and political economy presented in our 2014 article on that topic in the Washington Law Review. This response to Professor Tal Zarsky clarifies our antidiscrimination argument while showing that is only one of many bases for the critique of scoring practices. The concerns raised by Big Data may exceed the capacity of extant legal doctrines. Addressing the potential injustice may require the hard work of legal reform.

Making Smart Decisions About Surveillance: A Guide For Communities, Chris Conley, Matthew Cagle, Peter Bibring, Jessica Farris, Linda Lye, Mitra Ebadolahi, Nicole Ozer

Faculty Scholarship

California communities are increasingly grappling with whether to deploy new surveillance technologies ranging from drones to license plate readers to facial recognition. This is understandable, since public safety budgets are tight, technology vendors promise the ability to do more with less, and federal agencies or industry sponsors may even offer funding.

But surveillance can be both less effective and far more costly to local agencies and to the community at large than initially imagined, leaving communities saddled with long-term bills for surveillance that doesn't end up making the community safer. Surveillance can also be easily misused, leading to the erosion …

Metadata: Piecing Together A Privacy Solution, Chris Conley

Faculty Scholarship

Imagine the government is constantly monitoring you — keeping track of every person you call or email, every place you go, everything you buy, and more — all without getting a warrant. And when you challenge them, they claim you have no right to expect this kind of information to be private. Besides, they’re not actually listening to what you say or reading what you write, so what’s the big deal anyhow?

Unfortunately, this scenario is more real than imaginary. Government agencies ranging from the NSA to local police departments have taken advantage of weak or uncertain legal protections for …

A Shattered Looking Glass: The Pitfalls And Potential Of The Mosaic Theory Of Fourth Amendment Privacy, Danielle K. Citron, David Gray

Faculty Scholarship

On January 23, 2012, the Supreme Court issued a landmark non-decision in United States v. Jones. In that case, officers used a GPS-enabled device to track a suspect’s public movements for four weeks, amassing a considerable amount of data in the process. Although ultimately resolved on narrow grounds, five Justices joined concurring opinions in Jones expressing sympathy for some version of the “mosaic theory” of Fourth Amendment privacy. This theory holds that we maintain reasonable expectations of privacy in certain quantities of information even if we do not have such expectations in the constituent parts. This Article examines and explores …

Mission Creep: Public Health Surveillance And Medical Privacy, Wendy K. Mariner

Faculty Scholarship

The National Security Agency's domestic surveillance program has parallels in the growth of disease surveillance for public health purposes. This article explores whether laws requiring health providers to report to government names and identifiable information about patients with infectious or chronic diseases may be vulnerable to challenge as an invasion of privacy. A shift in the use of disease surveillance data from investigating disease outbreaks to data mining and analysis for research, budgeting, and policy planning, as well as bioterrorism, tests the boundaries of liberty and privacy. The Supreme Court has not reviewed a disease reporting law. Its few related …

The Magic Lantern Revealed: A Report Of The Fbi's New Key Logging Trojan And Analysis Of Its Possible Treatment In A Dynamic Legal Landscape, Woodrow Hartzog

Faculty Scholarship

Magic Lantern presents several difficult legal questions that are left unanswered due to new or non-existent statutes and case law directly pertaining to the unique situation that Magic Lantern creates. ²⁵ The first concern is statutory. It is unclear what laws, if any, will apply when Magic Lantern is put into use.²⁶ The recent terrorist attacks in the United States have brought the need for information as a matter of national security to the forefront. Congress recently passed legislation (i.e. USA PATRIOT Act) ²⁷ that dramatically modifies current surveillance law, thus further complicating the untested waters of a …