Digital Search & Seizure | Jim Dempsey | Talks at Google

Hi, I'm Alan Davidson. I head up Google's policy office in Washington D.C. great to see you all. And it's a great pleasure for me to be here to introduce one of the country's great experts on privacy and a former colleague of mine, Jim Dempsey. I'll say we're probably preaching to the choir. If you're listening to this talk, you know that privacy is a huge issue for our country and it's a huge, huge issue for our company. You know, the issue of the government's access to information about us is a particularly difficult question in the information age. It's also a really hard question for us at Google because our whole cloud computing model relies in some ways on people taking that sort of leap of faith of giving over their personal information and spending, putting it in our hands. And as I'm sure you'll hear from Jim, our law has not kept up with that change and our need to ask people to take that leap of faith. I could think of nobody better to try and give us a little bit more of an overview and a kind of in depth look at this issue than Jim Dempsey. He is actually sort of, I'm sorry for gushing, but one of the really like one of the country's treasures in some ways because he is really one of our great experts in this area in a very complicated area. Before coming to Google, I was associate director at the center for Democracy and Technology, which is where Jim is now. And I was there for nine years. Jim and I worked together, I think, for seven of those nine years, which is kind of shocking and a huge amount of what I know about how Washington works and how to get things done on Capitol Hill. I learned from Jim, who had spent about a decade in the House Judiciary Committee on Capitol Hill before working at the National Security Archives and then coming to cdt. And he is one of the authors of the CALEA Communications Assistance for Law Enforcement Act. Very important law having to do with how law enforcement gets access to digital networks. He's deeply knowledgeable about electronic surveillance law and actually has surfaced some of the. One of the first people to surface some of the really difficult problems that have come up as we've moved information online. And I'll say on a personal note, Jim and I worked closely on something that I thought was actually the hardest assignment I've ever had in my professional life, which was to be working for a civil Liberties organization on September 12, 2001, which is how do you think about your role in the world after a tragedy like that? Especially if we were working quite hard for many years to raise these issues of personal privacy, it's very hard to do that in an environment where the whole country is so concerned about our physical well being. I'll say Jim was a tremendous role model for all of us at CDT in terms and in the civil liberties community for thinking about how you think about your role in the system. We spent six very, very hard weeks after September 11th trying to make the Patriot act the best law that it could be for this country. I think in retrospect, a lot of people have realized that it wasn't all it could be and we can talk more about that. But Jim is really one of the great experts on these issues and I'm so excited to have him here today talking again. So thanks.

Well, Alan, thank you. I think I'm hooked up here. Alan, thank you very much. And thank you also to Nicole Wong and Andrew McLaughlin and Rishi Jaitley, all of whom sort of have said over the years that I should come and give this talk. So I'm pleased to be here. Now, my task today, as I see it, is threefold. First of all, I'll tell you something you don't already know. Secondly, to talk about the law without getting so into the weeds that I lose you. And thirdly, not to embarrass myself and CDT in terms of the simplicity of the way I discuss the technology. So with that sort of caveat, let me say that as Alan had previewed and had anticipated, that the theme of my talk today is the way in which technology is outpacing the laws in ways that seriously erode privacy. In fact, in ways that make the Patriot act almost seem minor. You could say that the changes in the Patriot act were marginalized compared to the effect the technology is having now. At one level, this is not anything new, but I hope to show you today the pace of it is expanding. Now, the good news is there is a solution space here. The bad news is we have to move pretty quickly in order to take advantage of it. Now, you're the rocket scientist, so here's the sort of policy framework and I'm going to blow through a lot of stuff here, but hopefully give you something that will give you a way to think about what you're doing as you're building this amazing technology that you're building. Now here's the starting place. The Fourth Amendment to the Constitution, 1791. Call it noble, call it sweeping, call it archaic, call it ambiguous. I think that the wording is powerful and it's waiting to be interpreted. If you look at the terms and the phrases here, there are multiple issues that we could talk about. Persons, houses, that's easy enough. Papers. And then effects and thinking about the meaning of effects in the 21st century, it only applies to searches and seizures. A big question is what is a search or seizure? One of the big questions now is if only a computer looks at your data, is it a search? Of course the fourth Amendment only prohibits unreasonable searches and seizures. So what is unreasonable? Lawyers couldn't even probably define for you what is probable cause, which is the whole basis of the warrant. But it is the highest standard that the government has to meet in order to intrude into your privacy. A warrant based upon probable cause makes a search reasonable. And the fourth amendment was partly intended, as you know from high school history, was partly intended to prohibit general searches which had been used by the British pre revolution. And now in the context of data mining capabilities, what does particularity mean? How do you particularly describe the place that you're searching or the things that you are seizing? Now, despite all the ambiguity of the language, some things are clearly settled. This laptop, the data stored on my cell phone, anything in your wallet, anything in your home, regardless of technology, is fully protected by the fourth Amendment. The government, in order to get it, needs a search warrant issued by a judge based upon a finding of probable cause to believe that a crime has been, is being or is about to be committed and the evidence to be seized is relevant to the investigation of that crime. And you get notice at the time of the search. So it works just the way you see it on TV. Knock knock. This is before 24. Knock knock. Police open up, we have a warrant. They come in, they show you the warrant, it was issued by a judge. That paradigm is the basic paradigm for interpretation of fourth Amendment. And it clearly applies to my laptop, clearly applies to digital. We've gotten over that. We're not so stuck on papers. The problem is, what about this? How do we deal with this context? I should have put the Google logo in the cloud. Now that Alan mentioned the cloud. So how do we get from this language, persons, houses, papers and effects, what is a surgeon's seizure? How do you describe something with particularity to this? Now the Supreme Court sort of muddled through this and didn't get very far in the first half of the 20th century. But in 1967 it broke free of where it had been before, which had been stuck on a property concept of privacy and the concept of trespass and the house. And it Said in the Katz case, the Constitution protects people, not places. And it said that your telephone conversation as it crosses the wire is fully protected by the fourth Amendment requiring a judicial warrant in order to intercept it. So even though it's intangible, even though it leaves your home and comes under the control of the network operator, even though the network operator, for systems maintenance purposes, can listen in on your phone call, the Supreme Court said it is fully protected by the Constitution. That was sort of the high watermark of communications privacy protection. The Supreme Court began to step back down from that summit in the 1970s when it held that records data at rest outside your home is not protected by the Constitution at all. So data on the wire, fully protected, data at rest in the hands of a third party, not protected at all. This is known as the business records or third party doctrine. Now, that was of limited significance in an age when most of your data, most of the business records were stored on paper, hard to retrieve, transfer and analyze in large volumes. The sort of practical limitations upon exploitation of this doctrine were significant. Now the Supreme Court also made a further sort of step back from this notion and said that even certain data in transit over the wire is not protected. When it drew a distinction between content and signaling or routing data, and in 1979 held that the dialed numbers, at that time it was rotary dial numbers on a telephone were not protected under the Constitution at all. It could be intercepted without a court order just upon the willingness of the phone company or upon some lower standard. Now, again, not that significant. The Supreme Court based this decision said, well, transactional data doesn't tell you very much. Again, it's hard to answer. It was still all in analog form. You would end up in the early days with a bunch of holes printed, punched on a tape to indicate the numbers being dialed. And it was also assumed that it was easy to tell the difference between content and non content. Now one of the questions that this leaves unanswered, you've got communications on the wire protected data in storage unprotected. Where does that leave communications, the actual content of communications when they are in storage on the network? Now, it wasn't so important back in the days of telephone when there wasn't much stored at the center of the network. At most you would record something at the edges, but very little was stored at all. And what was was stored locally. Now, Congress responded to all of this Supreme Court ruling holding that your health records, your insurance records, your bank records, are completely unprotected by the Constitution. Congress responded with this Sort of Alphabet soup of legislation, a bunch of sectoral privacy laws, and just trying to map them is an exercise in and of itself. We've tried to do this visually at CDT in a couple of different ways. This is one effort. This chart actually goes further east and further south, taking it sectorally. Your credit records, your financial, medical, educational. Ironically, your video rental records are among the most protected records you have. It's also very interesting in a sectoral approach, it really does say videotape rental. Fortunately, someone managed to put the words in or other similar media, so probably covers DVD rentals too. But you end up with this crazy quilt of rules. And a single item of information can be subject to five different standards in its course. And as you sit here typing an email to somebody that's fully protected, it's on your laptop. In order for the government to get it, they've got to come to you, serve you with a warrant in order to seize your computer while that email is in transit over the wire, it's also fully protected. In fact, the legislation that Congress adopted after the Katz case actually has a few little extra protections to it. Once the email reaches storage on the server of the party to whom you're sending it, the protection drops off. Once that stored email is more than 180 days old, the protection falls off even further and the government no longer needs to get even a court order. They can issue subpoenas. A subpoena is basically a piece of paper signed by a prosecutor saying, give me everything you have or go to jail if you don't. No judicial approval. And then the transactional data, the to and from line of that email, the IP address, the timestamp, other information in the packet header is subject to yet a fifth standard. So again, even with respect to, I mean, here, different categories of data are treated differently. Here, the same item of information is treated five different ways depending upon, or four and a half different ways depending upon where it sits in the network. Couple other quick things. Identity not very well protected. The government asking you, insisting that you give your identity is not a search or seizure. One of those critical terms, not that important, when all the government could do was to get your ID one at a time by stopping you and asking you. Not much privacy in public places. Certainly the government can track your automobile as you drive on the public roads. Again, not that important. Back in a time when most of what you did in public was ephemeral and not easily identifiable. Even though your face is exposed to the public, it wasn't captured and it wasn't easy to figure out who you were just based upon your face. So you have these four dominant dichotomies in the way the law is structured. Held in the home or on the person, highly protected, held by a third party, not protected at all by the Constitution and only a little bit protected by statute. Sectorally, no statute. For example, for your travel records, no statute. For your book purchase records, et cetera, in transit on the network, highly protected, stored on the network, less protected content, highly protected. Non content, not protected at all. Things that you keep hidden, protected. Things that are exposed to the public, not protected. Now we face six wonderful, powerful, impressive, useful technologies that completely blow apart this paradigm. Now, you could quibble with me about how I've grouped these. It's probably easy to come up with a seventh or an eighth, but for now let's stick with these six, which I think you would have to say are sort of dominant trends of where technology is going today. Of course, the storage revolution is no mystery and no surprise to you. Gmail launched in August 04, 1 gigabyte free, expanded in August, I mean April 05 to 2 gigabytes. And it's been going up, I think, ever since. Again, the email that used to sit on my laptop or which used to be quickly deleted from the server of an isp, now stored. Wonderfully convenient. Don't have to worry about backup, get it from any computer I want, but out of the home, off of the laptop, onto the network. My travel history now stored, all nicely arranged for me. I can go back at any time. My wife's book purchases. She's a major user of Amazon.com, everything she's bought, all the way back to 1997, nicely cataloged and stored here again, though, under the control of Amazon, nobody has to come and look at the books on her library shelf. They could get it from Amazon. DVDs are here, games are here, toys that she's bought for her nephews are here. Flickr, of course, take those photographs out of the. You know, we used to keep them in shoeboxes in the closet. Now, nicely stored, convenient, available to be shared on the network. Social networking, of course, huge phenomenon. Delicious. You know, I used to put my bookmarks here on my laptop. I still do, but if you want, you can now again take those bookmarks off of the laptop onto the network. Google Desktop. Wonderful search across computers. How does it work? Well, here you actually take the data off of the laptop, copy it onto the network. So taking it out of this clear fourth amendment paradigm and putting it out There where it's not so clear. Wonderful service, great convenience, so great that other people of course are going in that direction. Salesforce.com, a network based customer relations management system for putting information on there and having it available from any place. Google Spreadsheets Sun Grid computing Get the whole power of the sun network for startups, huge amount of computing power, but it involves taking your data, putting it on the sun computer. And as John Gage said, he said this back in the 90s, the network is the computer. There's also a huge change not only in the way email is treated but now the way voice is treated. So voice over ip, it's just digits like anything else, which means it's easier to store. And now increasing number of services are being offered, in fact being promoted on the basis of you must have this, that record that which had previously been record as a matter of course, that which had previously been ephemeral, the telephone conversation. And record it not always on something that you control, but on the server of the offeror of the product. So all of this data which inside the home is fully protected, outside the home, not protected. That is a dichotomy that takes on huge significance as stored data moves off the laptop out of the home and onto the computers of service providers. Another one obviously that you don't need any introduction to. I mean this is sort of a presentation intended for a wider audience. But you know, simply search as you know, has changed the way in which we access information, the way we think about finding information and the way we approach newspapers, all the traditional media as well as the new media. And of course you know what anybody is searching and it's kept and it's stored. And if you sign up for Google personalized service, you can get access to your own searches. This is Alyssa Cooper, our policy analyst. Huge though power to find out what she was doing any given day of her life. Not surprisingly, of course, the government has figured this out and has come asking for this information. And again this notion that data that sits outside of the house takes on huge significance when search queries and all they reveal about a person's activities is we all become sort of wedded to this device in our work. Obvious implications, you know, we're all carrying a location tracking device. It can be triangulated even just when the phone is on, it's as you know, sending out its registration signal, basically saying here I am. For purposes of call processing. Now increasingly being built with a GPS capability. Sprint is now of course offering family locator where you can find out where any of your family members are. Nice service. You know, you can look up other kids home yet aren't they home? Where are they? Have they gone to a friend's house? And they say they're at one place and the online map says they're someplace else. But again, it's a network based service. OnStar is the GPS system in the GM cars. Uses a cell phone as the communications channel, but it's a gps. IBM has its product, Lotus. It's basically a collaborative workspace product. It comes with a social networking capability and that comes with a location capability so you can map the location of all of your colleagues as you're working. Dodgeball, another kind of social networking service now owned by Google, now owned by Google huat. What's remarkable is most of the people in the room didn't know that, but who at another sort of social networking location based site. Now these are where people voluntarily register where they are. But again, you are taking this location, this where I am, and you're providing it to a network service provider who then makes it available to your friends with your permission. But then of course, the government knows that it's there and the government comes calling for this information as well. And again, the fact that there's this distinction between content on the wire, which is highly protected, and non content, which is much less protected, takes on added significance when you get to something like location information and you want to figure out, well, is that content or not? The courts have split on the issue. This is actually an old list. Basically seven or eight lower courts have said that the government cannot, with a low standard of a pen, register get access to real time location tracking information. They need a court warrant. Said these eight or so judges, a number of other judges have gone the other direction. The Justice Department is obviously waiting for, as I say, a terrorist, drug dealer, child abuser case that they will take up on appeal in order to try to get a favorable ruling on this. Huge changes, of course, in the way identification is, the way identity is created, the way identification is managed. This is a very large RFID chip. It's a pretty old picture, but obviously you have rfid, you have biometrics. One of the huge bases of this technology is going to be the digital driver's license. Your former state attorney general said, look, we've got 32 million digital photographs in our database. That digital makes them somewhat easier to compare. Why not use them? What's the point of having the pictures of 32 million people if you don't use them? By taking people off of surveillance cameras and beginning to match their faces. Huge amount of work being done on this technology. Facial recognition, facial matching, still not there yet. But one thing that's really fascinating is this, which is just a little bit from a page or a report, a website of some folks at one university who are working on video facial recognition. It actually turns out that it's going to be possibly more easier to match faces off of video than it is off of still photographs. Because on the video, you know, you get with a moving picture bunches of points and you can do a better job of making the match that you want to match. And as you'll see when you put that together with the sensor networks that are being created for video cameras, you get to see a very different picture than the one contemplated by the Supreme Court when they said, well, it's no big deal that what you display on the street is not privacy protected. Just the cookies on my computer, just a few of them. And again, the ability to match the cookie with my browsing activity, with my IP number. Sometimes a two step process, but still again, an expansion of what is becoming identifiable. This one, when I first heard about it, I didn't believe it. I thought it was an urban myth. But it turns out that on the color laser printers, the Secret Service has actually worked with the manufacturers to build a little small dot matrix identifier into each of the color printers that identifies the serial number of the color printer. So that when you buy a color printer at the store, and of course the serial number of the one that you bought is recorded, the government can ultimately trace back based upon the documents that come out of that printer. By finding the code that's buried in it, Secret Service confirmed it. I thought this was like, I thought it was an urban myth. I didn't believe it when I first heard about it. And they said, yeah, no, it was for anti counterfeiting. Because of course the color printers are so good that you can make stuff that looks like real money despite all the efforts to improve the dollar bills. But they built it into the printers. It had been built into the copiers, I think for a long time. But this goes to the printer level. How did that happen? How did all the printer manufacturers. I'm not sure it was all, but it was a lot of the big ones. But the Secret Service went to them and said, do you want to help us stamp out counterfeiting? Do you want to be. They agreed to do it. And again, you know, look, the government has legitimate needs here. Certainly post 9, 11. We were just upstairs in the other building at a conference on child online abuse. So there are compelling governmental interests at stake here. And there's, as you can see here, a willingness of companies to cooperate. A lot of what I've talked about has been consumer driven and market driven. This one here, of course had no market application. It was purely at the behest of the government uk, which is ahead of us on a lot of surveillance issues. If you want to find out what's going to happen in the United States in three years, go to UK today. And increasingly, here's a co op store using fingerprints as a payment verification device. Instead of a PIN number, people use their fingerprint. But again it involves creating a database of fingerprints. We're creating a database of photographs through the driver's license system. There are at least six ID card projects at the federal level, all of which involve some form of biometrics, all of which involve some form of a back end database. And then, you know, there's a lot of work going on in the sensor network area. This is just an example of how you could program your portable device, your Bluetooth, in this case a Bluetooth enabled cell phone to program in some of your preferences that I like books about engineering or I like books about travel or cooking. And then when you walk into the bookstore, your phone, which is always sending out signals all the time anyhow, even when you're not making a call, could send out the signal of your interest and little lights would go off on top of the books in the bookstore that you might be interested to. The people at the MIT lab think this is really cool, and it is, but it's part of this trend to build sensor networks out into society. I love my fast track, you know, I just love it. But the intelligence highway system of course, is a sensor network, automatic license plate number readers. This one is cool because it was a company developing the anpr, which for example may soon be installed in downtown San Francisco. If they go to sort of a pollution control system. And you can only drive your car into the city if your license plate ends in an odd number, an even number, et cetera, or you may only be authorized to drive your car into the city so many days. This one was just sort of cool because it's using Arabic, Arabic numerals. And so obviously there's a worldwide market for this kind of technology. So to build a set of license plate readers on the road for pollution control purposes, traffic control purposes, et cetera. This is an example in I think, oh, Missouri they're also doing it in Baltimore and probably elsewhere again using the cell phone for traffic monitoring purposes. Picking up the ein at milepost one and then picking it up at milepost two and being able to say, well, the traffic is going so many miles an hour. This is just some of the video cameras in downtown Chicago, just a couple block area. There are maps that people have done for a lot of cities in the country, some private, some governmental, and of course increasingly digital, increasingly possibly networked. So you know, in a way, I don't have a picture for this. I couldn't find one quickly enough. But you know, the greatest sensor network is that 16 year olds with cell phone cameras. I mean you just think about that in terms of a distributed network of data collectors. Now this principle that you have not much privacy in public places, that your travel on the public highways is not protected obviously takes on huge significance. Interoperability is just quickly, number six, I don't have a lot on this one either, but this is just a bread recipe in xml. And I can't believe that they say it takes only five minutes to prepare it. But they knew more about code writing than they knew about bread making. But the point is all of this data that previously sat in disparate databases, disparate formats is increasingly becoming easy to aggregate, to search across disparate databases. Of course a lot of people have put money into aggregating data. This is just the data flow from public records through the information resellers back to government agencies and other users. And obviously a huge ecology has been created here. I love, you know, the ability to take the Google Map API and to take any database of address based data and mash it together and you get all this kind of stuff, you know, the happy hours and so on. The one I like actually in my old sort of middle age kind of way is someone took the FEC data, the Federal Elections Commission contribution data, which has the address of everybody who gives money to candidates, mashed it up so you can put your home address in and find who your neighbor. I don't even know the name of most of my neighbors. I mean, I like most people, but I know whether they have a red button, a little sticky pin or a blue sticky pin next to them and then I can click on that and of course get the data in terms of who they contributed to. Okay, there actually is a solution space here. Again, if we act quickly. Technology design is really at the top of this, that the people, including you folks who are building the technology, you need to think about what are you collecting? How long are you keeping it? How are you storing it? Is it personally identifiable or not? Does it have to be? Whatever you keep, the government will come and get. Whatever you collect, the government has a right to get. Sometimes under very low standards. Users need to have choices. Users need to be educated about what this technology does and how they can to some extent, to some extent control their control, the disclosure of their information industry best practices and law. We're working hard. We had pre 911 actually had bipartisan support for addressing a number of the issues that I've talked about here and actually clarifying and to some extent strengthening the standards on governmental access. That got blown out of the water with a lot else. Of course on 911 we have not gotten that effort back on track. We've been fighting defensive action ever since. The technology changes, of course, have continued, if anything accelerated now. Supreme Court Justice Breyer said, and this I think is important for all of us. Serious, complex legal change is made in the context of a national conversation involving engineers, designers, business, the people coming up with the business models. And this is done through meetings and symposia and law reviews and the press and Congress and the courts. And it's really what CDT is calling for, what I'm trying to generate, what we've been working for now for a number of years, and we really want to try to accelerate, is this conversation that can lead us to a context in which we really do take the words of this constitutional provision and give them meaning. Give some meaning to your effects as you leave this information about yourself to break out from the sort of trespass based or property based concept of what your papers are, are and where they reside. And. We need to have this sort of understanding between technologists and policymakers, this sort of understanding between Silicon Valley and Washington, D.C. between Silicon Valley and Sacramento. CDT is working in coalition with some of the other privacy groups and we have a working group that I want to sort of bring now to the west coast to work with scientists, engineers, business people to come up with the solutions for this. So that's it. And I look forward to your questions.