PRIVACY + SECURITY BLOG

News, Developments, and Insights

high-tech technology background with eyes on computer display

A Disastrous Federal Privacy Bill

Originally posted on Substack

Unlike 160+ countries, unlike almost every industrialized nation, the U.S. has been an outlier because it lacks a comprehensive privacy law. Congress has been trying repeatedly to pass one, without luck, an effort that has faltered because such a law involves many complicated issues that require thoughtfulness and compromise, which don’t exist in Congress these days.

Congress’s latest foray is a new bill called the SECURE Data Act, a piece of garbage cooked up by Republicans as a gift to industry in a climate where the public is deeply concerned about privacy, outraged at the harms tech is causing, and yearning for ways to hold Big Tech accountable.

I can’t stress enough how awful this bill is. On balance, if passed into law, it will do dramatic harm to privacy. It will leave people less protected than if it didn’t exist. I’d call it more of an anti-privacy law than a privacy law.

I’ll briefly provide a few reasons why this bill is terrible and should not be passed.

Continue Reading

Accountability for Technology and AI

Originally posted on Substack

AI and digital technologies have been unleashed upon us, with an unprecedented zeal and recklessness, and a reckoning is long overdue.

The Meta and YouTube $6 million addiction verdict this week is an important milestone. I’m not an expert on the addiction issue, so I won’t opine on the merits of the case. Instead, I want to point out how the case affects the bigger picture of accountability for technology and AI.

Continue Reading

Are Warrants Enough?

Originally posted on Substack

This year, in Chatrie v. United States, the U.S. Supreme Court will decide whether geofence warrants are valid under the Fourth Amendment. The geofence warrant at issue in the case was one that allowed the government to obtain account data from Google of hundreds of millions of users. It’s the equivalent to a digital dragnet, which I’ve long argued contravenes the core purpose of the Fourth Amendment. The Framers of the Constitution hated dragnet searches . . . actually, to be more precise, HATED them.

If the Supreme Court doesn’t find geofence warrants to be invalid, then it’s hard to imagine much left of the already-desiccated Fourth Amendment. But Chatrie is just the tip of the iceberg. Regular warrants under the Fourth Amendment—those that are properly circumscribed based on particularized suspicion—are also not strong enough for our times.

We’re witnessing an unprecedented rise of authoritarianism in the United States. I’ve long argued that warrants are an effective way to protect privacy and also balance interests in law enforcement. But now I don’t think warrants are enough to provide the kind of protection against government power that is necessary.

Continue Reading

Three TV Commercials Show What’s Wrong with Big Tech, Privacy, and AI

Originally posted on Substack

This year’s Superbowl was a showcase for how out of touch tech companies are when it comes to privacy and AI. Several ads demonstrated that tech companies are obtuse about the dystopia they’re creating.

Hopefully, public reaction will get through to policymakers that the tone deafness of tech companies reveals a deeper disconnect between the future they seek to bring about and the future most in society want. Tech companies aren’t going to take us to the promised land; they’ll take us to hell instead unless policymakers take bold steps to ensure they don’t.

Continue Reading

Why Consent Is Broken for Privacy and AI

Originally posted on Substack

The following is an excerpt from my book ON PRIVACY AND TECHNOLOGY where I summarize my thinking on privacy consent:

New technologies pose significant challenges to people’s ability to consent to the collection, use, and disclosure of their personal data. Under most privacy laws, consent makes permissible a wide array of data collection and processing. Websites, devices, and software continually attempt to induce people to consent (or pretend that people have consented) to data practices that are risky, troublesome, and unexpected.

To be meaningful, consent must not be unduly manipulated or coerced. And consent must be informed: people must be able to weigh the costs and benefits of consenting. Unfortunately, most privacy consent falls far short of these goals. In fact, privacy consent could almost be called a complete fiction.

Continue Reading