Data and Goliath (34 page)

16

Social Norms and the Big Data Trade-off

I
n the preceding three chapters, I outlined a lot of changes that need to happen: changes
in government, corporate, and individual behavior. Some of them are technical, but
most of them require new laws or at least new policies. At this point many of them
are unrealistic, at least in the US. I’m not yet living in a country where the majority
of people want these changes, let alone a country where the will of the people easily
translates into legislative action.

Most people don’t seem to care whether their intimate details are collected and used
by corporations; they think that surveillance by the governments they trust is a necessary
prerequisite to keeping them safe. Most people are still overly scared of terrorism.
They don’t understand the extent of the surveillance capabilities available to both
governments and private parties. They underestimate the amount of surveillance that’s
going on and don’t realize that mass government surveillance doesn’t do much to keep
us safe. Most people are happy to exchange sensitive personal information for free
e-mail, web search, or a platform on which to chat with their friends.

Europe is somewhat different—it regulates corporate surveillance more heavily and
government surveillance much less so—but for most purposes the public sentiments are
the same.

Before we get meaningful political change, some of our social norms are going to have
to change. We need to get to the point where people comprehend the vast extent of
surveillance and the enormous concentration of power that flows from it. Once they
do, most people will probably say, “That’s just not okay.” We need to summon the political
will to fight both the law enforcement and national intelligence communities on the
government side, and the government contractors and surveillance industry on the corporate
side. And before any of that can happen, there must be some major changes in the way
society views and values privacy, security, liberty, trust, and a handful of other
abstract concepts that are defining this debate.

This is hard. Public sentiment tends to move towards actual practice. We’re good at
accepting the status quo—whatever that is and however recently it has emerged. (Honestly,
it blows me away that most of this surveillance has emerged in less than two decades.)
We’re growing accustomed to the panopticon. You can see it writ large, when people
shrug and say, “What are you going to do?” You can see it in a microcosm every time
Facebook degrades its users’ privacy options; people complain in the beginning, but
soon get used to it.

What follows in this chapter are all changes in attitude. They’re ways in which we
are going to have to modify our feelings and thoughts if we are ever going to get
beyond the surveillance society.

RECALIBRATE OUR FEAR

The PATRIOT Act was signed into law on October 26, 2001, just 45 days after the terrorist
attacks against the World Trade Center and the Pentagon. It was a wish list of police
and intelligence powers and authorities, passed overwhelmingly in both houses with
minimal debate. No one in Congress read it before voting. And almost everyone in the
country wanted the law to pass, despite not understanding its provisions.

In 2014, I attended a talk in which Tim Duffy, the chairman and chief executive of
the advertising agency M&C Saatchi, tried to improve the messaging of privacy. He
suggested “Where do you draw the line?” as a possible framing. But if listeners are
scared of terrorists, they will draw the line in such a way as to allow a whole lot
of surveillance. Harvard Law
School professor Jack Goldsmith pointed out that when we’re scared, more congressional
oversight yields more NSA authority.

Fear trumps privacy. Fear of terrorism trumps fear of tyranny. If strong enough, it
trumps all the concerns in this book piled together. In the people, it’s fear of the
next terrorist attack. In politicians, it’s that and also fear of being
blamed
for the next terrorist attack. But it’s fear, nonetheless. Recall Prime Minister
Cameron in the preceding chapter. This is what I hear again and again from government
officials when I ask about the obvious ineffectiveness of mass surveillance against
the terrorist threat. Yes, they admit, it hasn’t resulted in any successes; but it’s
an insurance policy. They know that their targeted surveillance efforts will fail
at some point, and they hope that mass surveillance will be there for backup. True,
the odds are low that it will work like that, but they believe they have to do everything
possible—both for the security of the country and for the security of their jobs.

Regardless of the magnitude of the threat, mass surveillance is not an effective countermeasure;
conventional police and intelligence work is. We need to resist the urge to
do something
, regardless of whether or not the proposed action is effective.

Keeping the fear stoked is big business. Those in the intelligence community know
it’s the basis of their influence and power. And government contractors know it’s
where the money for their contracts comes from. Writer and Internet activist Clay
Shirky has noted that “institutions will try to preserve the problem to which they
are the solution.” Fear is that problem.

It’s a fear that’s stoked by the day’s news. As soon as there’s a horrific crime or
a terrorist attack that supposedly could have been prevented if only the FBI or DHS
had had access to some data stored by Facebook or encrypted in an iPhone, people will
demand to know why the FBI or DHS didn’t have access to that data—why they were prevented
from “connecting the dots.” And then the laws will change to give them even more authority.
Jack Goldsmith again: “The government will increase its powers to meet the national
security threat fully (because the People demand it).”

We need a better way to handle our emotional responses to terrorism than by giving
our government carte blanche to violate our freedoms, in some desperate attempt to
feel safe again. If we don’t find one, then, as
they say, the terrorists will truly have won. One goal of government is to provide
security for its people, but in democracies, we need to take risks. A society that
refuses risk—in crime, terrorism, or elsewhere—is by definition a police state. And
a police state brings with it its own dangers.

It’s not just politicians who are to blame for this. The media are culpable, too.
By fixating on rare and spectacular events, they condition us to behave as if terrorism
were much more common than it is and to fear it far out of proportion to its actual
incidence. And we are also at fault, if we buy the propaganda the media are selling.

We also need to counter the notion that modern technology makes everything different.
In the days and weeks after the 9/11 terrorist attacks, as we debated new laws and
new police powers, we heard this sentence: “The Constitution is not a suicide pact.”
It expresses a sentiment based in fear, and its meaning is worth unpacking. What it
says is something like this: “The people who wrote our laws couldn’t possibly have
anticipated the situation we now face. Therefore, the limits they put on police power
and the prohibitions they enacted against surveillance should not apply to us. Our
situation is unique, and we must ignore all of that.” The primary reason for succumbing
to these notions was that we believed that the damage terrorists could cause was so
great that we could not conceivably rely on conventional law enforcement means and
after-the-fact prosecutions.

It’s just not true. It’s a common psychological fallacy to believe that we live in
unique times, that our challenges are totally unlike anything that came before and
necessitate ignoring any of the societal controls we previously put in place to check
the powers of governmental authorities. President Lincoln succumbed to the fallacy
when he suspended habeas corpus during the Civil War. President Wilson did so when
he arrested and deported Socialists and labor leaders just after World War I. President
Roosevelt did so when he interned Americans of Japanese, German, and Italian descent
during World War II. We did it during the Cold War’s McCarthy era. And we are doing
it again after 9/11.

Fear isn’t the only way we can react to these threats, and there are many instances
in history where society did not give up its rights in an effort to remain safe. In
the wake of the horrific 2011 massacre in Norway by Anders Breivik, that country has
largely preserved its core values of
liberty and openness. And, of course, there’s FDR’s famous line “The only thing we
have to fear is fear itself.” Indomitability is the correct response to terrorism.

There’s hope for the US. We don’t always respond to terrorism with fear. Looking back
through recent history, the presidents who stood up to terrorism—Truman, Eisenhower,
Nixon, Reagan some of the time, Bush the elder—achieved better operational and political
results than those who used terrorism as an opportunity for political grandstanding:
Carter, Reagan the rest of the time, Bush the younger. We need to recognize the strength
of politicians who protect our freedoms in the face of risk, and the weakness of those
who cannot solve problems and choose to sacrifice our freedoms instead. More than
a decade after 9/11, it’s well past time to move beyond fear and return to our core
American values of freedom, liberty, and justice. And there are indications that we
are doing so. In 2013, we started seeing a significant shift in Americans’ perceptions
regarding the trade-off between civil liberties and national security.

RECALIBRATE PRIVACY

Our personal definitions of privacy are both cultural and situational. They were different
100 years ago than they are today, and they’ll be different 100 years from now. They’re
different in the US than they are in Europe, Japan, and elsewhere. They’re different
across generations.

Right now, the Internet is forcing our attitudes about privacy to shift as never before.
That’s because one of the main ways we use it is to learn about each other. Lawyers
look up potential jurors. Job seekers look up company executives; company HR departments
look up potential employees. Before a first date, people look up each other. This
sort of thing even has a name: Google stalking.

Online, we are constantly probing, and occasionally violating, one another’s privacy.
This can be pretty uncomfortable. The semi-permanent nature of Internet communications
provides all sorts of opportunities for someone to embarrass you. E-mails you send
to someone in private can easily be forwarded to others. Kids do this to each other
all the time: forwarding private chats, photos, and messages, or showing each other
private postings on social networking sites. One of the reasons apps that
delete messages and photos after a few seconds are so popular among teenagers is that
they help prevent this sort of thing. Old web pages have a way of sticking around.
In 2010, WikiLeaks founder Julian Assange’s old OKCupid dating profile was dug up
for public discussion.

Even worse are people who use the Internet to shame and harass. Revenge porn—for the
most part, ex-boyfriends posting compromising photographs of former girlfriends—is
an extreme example. Mug shot extortion sites turn this sort of thing into a business.
Mug shots are public record, but they’re not readily available. Owners of mug shot
sites acquire the photos in bulk and publish them online, where everybody can find
them, then charge individuals to remove their photos from the sites. It is extortion,
although technically legal. None of this is going away, even if some instances of
it are outlawed in some jurisdictions.

We need to figure this out. Everyone has the ability to buy sophisticated surveillance
gear, so we need social norms that tell us when not to use it. We know more about
one another than any one of us is comfortable with, so we need to develop social norms
around acknowledging what we do know or pretending we don’t. This is essentially the
point of David Brin’s 1998 book,
The Transparent Society
; ubiquitous surveillance is coming and we have to adapt.

The Internet has engendered the greatest generation gap since rock and roll. As Clay
Shirky pointed out, it’s not that the elders were wrong about all the changes rock
and roll would bring; it’s that they were wrong about how harmful they would be. People
adapt. When everyone leaves a public digital trail of their personal thoughts since
birth, no one will think twice about its being there. If technology means that everything
we say—the regrettable accusations, the banalities, all of it—will be recorded and
preserved eternally, we’re going to have to learn to live with that.

The problem is that we’re too good at adapting, at least in the short term. People
who grow up with more surveillance will be more comfortable with it. Some of us went
to schools with ID checks and metal detectors. Some of us work at buildings that demand
daily badge checks. Most of us who fly in the US now accept TSA searches. And all
of us who shop are no longer surprised about massive thefts of credit card numbers.
These are all ways in which we have accustomed ourselves to having less privacy. Like
many fundamental rights, privacy is one of those things that becomes
noticed only when it’s gone. That’s unfortunate, because after it’s gone it’s much
harder to regain.

We have to stop the slide. Fundamentally, the argument for privacy is a moral one.
It is something we ought to have—not because it is profitable or efficient, but because
it is moral. Mass surveillance should be relegated to the dustbin of history, along
with so many other practices that humans once considered normal but are now universally
recognized as abhorrent. Privacy is a human right. This isn’t a new idea. Privacy
is recognized as a fundamental right in the Universal Declaration of Human Rights
(1948) and the European Convention on Human Rights (1970).