Topic: Telecom, Internet & Information Policy

The Fourth Amendment in the Supreme Court This Week

Prior to the development of trade and commerce, movable property was “not esteemed of so high a nature, nor paid so much regard to by the law,” Blackstone tells us in his commentaries on the laws of England. Such property in transit was routinely confiscated by authorities or tariffed at exorbitant rates.

When commercial relations expanded, the quantity and value of personal property increased, and the law “learned to conceive different ideas of it.” Legal protection for movable property increased.

In parallel to the growth of commerce in movables centuries ago, commerce in information is on the rise today. It may be time to “conceive different ideas of it” as well—different ideas that accord information similar protection. This is what a group of amici have encouraged the Supreme Court to do in a brief on an important privacy case being argued this week.

In Clapper v. Amnesty International, the Gun Owners Foundation, Gun Owners of America, Inc., the U.S. Justice Foundation, the Downsize D.C. Foundation, DownsizeDC.org, and the Conservative Legal Defense and Education Fund have argued that the Court should recognize a property interest in confidential communications. Doing so would more clearly establish the standing of the respondents in this case to challenge the global wiretapping program Congress established in the FISA Amendments Act of 2008.

William J. Olson, lead counsel on the brief, articulated the issues well in an email distributing it:

Our amicus brief in the Clapper case extrapolates from the court’s holding in Jones and identifies the property interests at stake in this case as confidential communications that are critical to the practice of law and of the enterprise of journalism. Using a property analysis, the citizens in Clapper have a protectable property interest in their electronic communications as they do in their written communications. Thus, even though plaintiffs are not “targeted” by the Government, the Government’s contention that their search and seizure of plaintiffs’ communications is only “incidental” is unavailing.

Jones v. United States, of course, is the case decided in January, in which government agents tracked a suspect’s car for four weeks using a GPS device without a valid warrant. The Supreme Court found unanimously that this violated the Fourth Amendment. My article in the most recent Cato Supreme Court Review (2011-12) analyzes the case, and you can get a taste of that analysis in the most recent Cato Policy Report (September/October 2012).

I also discussed the Fourth Amendment status of communications in the Cato Institute’s brief in Florida v. Jardines, which is also being argued in the Supreme Court this week. The Court found Fourth Amendment protection for postal mail in an 1877 case, but stumbled when faced with the next iteration of communications technology.

In the year this Court decided Ex Parte Jackson, both Western Union and the Bell Company began establishing voice telephone services. Gerald W. Brock, The Second Information Revolution 28 (Harvard University Press, 2003). Now, instead of written messages in the post, representations of the human voice itself began moving across distance, at light speed, in a way few people understood. This is the technology this Court confronted in Olmstead v. United States, 277 U.S. 438 (1928).

The Court handled this technological development poorly. Chief Justice William Taft fixed woodenly on the material things listed in the Fourth Amendment’s search and seizure clause. Wiretapping had not affected any of the defendants’ tangible possessions, he found, so it had not affected their Fourth Amendment rights. Olmstead, 277 U.S. at 464. In dissent Justice Butler noted how “contracts between telephone companies and users contemplate the private use” of telephone facilities. “The communications belong to the parties between whom they pass,” he said. Olmstead, 277 U.S. at 487 (Butler, J., dissenting). Cf. Ex Parte Jackson, 96 U.S. 727 (1877) (“Letters and sealed packages … are as fully guarded from examination and inspection … as if they were retained by the parties forwarding them in their own domiciles.”).

Florida v. Jardines is not a communications case. The issue is whether the sniff of a trained narcotics-detection dog at the front door of a house is a Fourth Amendment search requiring probable cause. Cato’s brief invites the Court to dispense with the unworkable “reasonable expectation of privacy” test, using the plain meaning of “search” instead.

Black’s law dictionary defines “search” as “looking for or seeking out that which is otherwise concealed from view.” Smells that only trained dogs can detect are indeed otherwise concealed from humans.

Familiar though ordinary pet dogs are, a trained dog is a chromatograph. The Court should follow the Fourth Amendment’s language and precedents like Kyllo v. United States to find that a drug-dog’s sniff is a search.

A companion to Jardines, Florida v. Harris, is being argued the same day. That case will examine the sufficiency of drug-dogs as evidence of wrongdoing, an issue that has not received careful examination in the past.

So it’s a big week for the Fourth Amendment in the Supreme Court. Stay tuned for developments.

Free Speech Week, Day 3

Today, check out Cato work related to the defense of electronic speech:

E-Mail Privacy Laws Don’t Actually Protect Modern E-mail, Court Rules

In case further proof were needed that we’re long overdue for an update of our digital privacy laws, the South Carolina Supreme Court has just ruled that e-mails stored remotely by a provider like Yahoo! or Gmail are not communications in “electronic storage” for the purposes of the Stored Communications Act, and therefore not entitled to the heightened protections of that statute.

There are, fortunately, other statutes barring unauthorized access to people’s accounts, and one appellate court has ruled that e-mail is at least sometimes protected from government intrusion by the Fourth Amendment, independently of what any statute says. But given the variety of different types of electronic communication services that exist in 2012, nobody should feel too confident that the courts will be prepared to generalize that logic. It is depressingly easy, for example, to imagine a court ruling that users of a service like Gmail, whose letters will be scanned by Google’s computers to automatically deliver tailored advertisements, have therefore waived the “reasonable expectation of privacy” that confers Fourth Amendment protection. Indeed, the Justice Department has consistently opposed proposals to clearly require a warrant for scrutinizing electronic communications, arguing that it should often be able to snoop through citizens’ digital correspondence based on a mere subpoena or a showing of “relevance” to a court.

The critical passage at issue in this case—which involves private rather than governmental snooping—is the definition of “electronic storage,” which covers “temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof” as well as “any storage of such communication by an electronic communication service for the purposes of backup protection of such communication.” The justices all agreed that the e-mails were not in “temporary, intermediate” storage because the legitimate recipient had already read them. They also agreed—though for a variety of reasons—that the e-mails were not in “backup” storage.

Some took this view on the grounds that storage “by an electronic communication service for the purposes of backup protection” encompasses only separate backups created by the  provider for their own purposes, and not copies merely left remotely stored in the user’s inbox. This strikes me as a somewhat artificial distinction: why do the providers create backups? Well, to ensure that they can make the data available to the end user in the event of a crash. The copy is kept for the user’s ultimate benefit either way. One apparent consequence of this view is that it would make a big difference if read e-mails were automatically “deleted” and moved to a “backup” folder, even though this would be an essentially cosmetic alteration to the interface.

Others argued that a “backup” presumed the existence of another, primary copy and noted there was no evidence the user had “downloaded” and retained copies of the e-mails in question. This view rests on a simple technical confusion. If you have read your Gmail on your home computer or mobile device, then of course a copy of that e-mail has been downloaded to your device—otherwise you couldn’t be reading it. This is obscured by the way we usually talk: we say we’re reading something “on Google’s website”—as though we’ve somehow traveled on the Web to visit another location where we’re viewing the information. But this is, of course, just a figure of speech: what you’re actually reading is a copy of the data from the remote server, now residing on your own device. Moreover, it can’t be necessary for the user to retain that copy, since that would rather defeat the purpose of making a “backup,” which is to guarantee that you still have access to your data after it has been deleted from your main device! The only time you actually need a backup is when you don’t still retain a copy of the data elsewhere.

Still, this isn’t really the court’s fault. Whether or not this interpretation makes sense, it at least arguably does reflect what Congress intended when the Stored Communications Act was passed back in 1986, when there was no such thing as Webmail, when storage space was expensive, and when everyone assumed e-mail would generally vanish from the user’s remote inbox upon download. The real problem is that we’ve got electronic privacy laws that date to 1986, and as a result makes all sorts of distinctions that are nonsensical in the modern context of routine cloud storage. Legislation to drag the statute into the 21st century has been introduced, but alas, there’s little indication Congress is in much of a rush to get it passed.

Here’s Your Answer, Governor Martinez

New Mexico’s Governor, Susana Martinez (R), wrote a letter to DHS Secretary Janet Napolitano last week asking for assurance that implementation of our national ID law, the REAL ID Act, will not be pushed back again beyond the upcoming January 15, 2013 deadline. Here’s your answer, Governor Martinez.

Congress passed REAL ID in 2005 as an attachment to a military spending bill. The law never had a hearing in the House or Senate.

In 2006, the policy of having a national ID implemented by states was beginning to sink in, and in April of that year, Representative Neal Kurk, a Republican from Weare, New Hampshire, spoke eloquently against REAL ID, saying:

I don’t believe that the people of New Hampshire elected us to help the federal government create a national identification card. We care more for our liberties than to meekly hand over to the federal government the potential to enumerate, track, identify, and eventually control.

Thus began the “REAL ID Rebellion.”

It wasn’t the U.S. Congress that had the first hearing on REAL ID. It was the New Mexico legislature in September 2006.

A year and a half after the law passed, New Mexico legislators heard about the costs and consequences of having a national ID. The Wall Street Journal dubbed the federal policy “Real Bad ID” the next month.

In 2007, states across the country started passing legislation barring themselves from complying with REAL ID and denouncing the law. By 2009, half the states in the country would say “NO” to REAL ID.

The law had a three-year implementation schedule, meaning states were supposed to start issuing national IDs in March 2008. But about a year before the deadline, then-Secretary of Homeland Security Michael Chertoff announced in conjunction with the release of draft implementation rules that the Department would grant extensions to all States requesting them. The final deadline for compliance was now going to be December 31, 2009.

The DHS didn’t come out with standards for REAL ID until January 2008, just months from the original May 2008 statutory deadline. DHS pushed the deadline for extension requests, which hadn’t come in, to March 31, 2008. The December 31, 2009 deadline that DHS had earlier announced became an “initial” deadline, with a later “real” deadline of October 11, 2009 for states that achieved “certain milestones.”

When the March 31, 2008 deadline for extension requests came, the states were not forthcoming with them. Montana notified the DHS that was not going to comply with the REAL ID Act, ever. The DHS saw the writing on the wall and treated that notification as a request for an extension—and granted it.

The Missoulian reported “Montana Wins REAL ID Standoff.” New Hampshire won, too. And so did South Carolina.

By September 2009, several states were declining to ask for a second extension (with a showing of material compliance), so DHS kicked the deadline for extension requests down to December 2009. And in December 2009, with states still refusing compliance with REAL ID, the DHS stayed the compliance deadline “until further notice.”

In March of 2011, the DHS quietly extended the deadline again, this time to the current date of January 2013.

You can see the writing on the wall, Governor Martinez. The states are not going to implement REAL ID—not the ones that respect their place in our constitutional system, anyway. Accordingly, the DHS will—as it must—extend the deadline for REAL ID once again, as Congress continues its failure to do away with the moribund national ID.

Governor Martinez may see this as a way to score some points—a two-fer even. She can suggest that DHS Secretary is soft on security and she can use REAL ID in her push to restrict access to drivers’ licenses in her state.

But when Janet Napolitano extends the REAL ID deadline, she’ll be just as soft on security as her predecessor Michael Chertoff was. New Mexico is one of the few states that still uses drivers’ licenses to administer driving and doesn’t condition licensing on proving one’s citizenship or immigration status. If Governor Martinez wants to change that, investing New Mexicans in the national ID system as a byproduct of Congress’ failure to pass comprehensive immigration reform, that’s between her and her constituents.

Speed of Politics, Speed of Tech

The Brookings Institution held a forum this morning on “Fostering Internet Competition“—at which, oddly, many panelists seemed resigned to the idea that one layer or another of the Internet would not be competitive: The question, as they saw it, was how to regulate the monopoly player at one layer to foster competition at the next layer up.

For Loyola University law professor Spencer Waller, it is online social platforms like Facebook and Twitter and Google that raise the specter of monopoly, and the question is how to regulate them so as to ensure competition and innovation in services built atop these platforms.  Harvard’s Susan Crawford thought the application layer could probably take care of itself, provided the monopolistic physical infrastructure—the means of providing broadband connectivity to end users—was properly regulated. Only one panelist, media theorist Doug Rushkoff, seemed interested in the possibility of fostering competition all the way down—he was, rather astonishingly, the first to utter the phrase “mesh networking” at the very end of the question and answer period. The others—as revealed by frequent analogies to electric grids and interstate highways—seemed stuck in a model that failed to take seriously what is probably the most important fact about Internet policy: Technology moves faster than politics.

The beguilingly broad word “infrastructure” may be partly at fault here. Roads, sewers, railway lines, electric grids, broadcast spectrum, broadband pipes, the TCP/IP protocol, and Facebook are all “infrastructure” in some sense. They’re also wildly different in many ways—and loose analogies that conflate them are lethal to sound policy thinking. Whether a particular infrastructure provider constitutes a “monopoly” or even a “natural monopoly,” after all, is powerfully determined by technological context. Telephone service is only a “natural monopoly” until someone invents cell phones—and as an important and prescient Cato anthology The Half-Life of Policy Rationales pointed out, technological progress often alters that context so radically that it undermines the justification for policies implemented in response to the problems of the old context.  This obvious point suggests a simple rule of thumb: Even if you have a clear cut problem that seems amenable to a regulatory solution, only act if you’re sure the context in which that problem is embedded will change a good deal more slowly than the political process moves, because a regulatory scheme that no longer fits the facts on the ground may well be difficult to dislodge even when it’s doing harm. Or, in a nutshell: Make sure there’s more inertia in your infrastructure than in your regulatory structure.

Roads and bridges and electric grids are technologies with a lot of inertia. They’re big, clunky physical objects that, once built, are apt to remain in use for 50 or 100 years. Even as particular physical pieces of each network are torn down and replaced, the essential nature of the technology remains constant: We drive on wheeled vehicles over concrete; power is delivered to homes over buried or suspended wires. When these infrastructures look like natural monopolies, reasonable people can debate what kind of regulatory structure is appropriate, but a policy well adapted to the facts of the technology is likely to remain relatively well adapted, because the facts change slowly. The roads and power grid in the town where I was born were mostly there before I was born.

This is not what Internet technology looks like. When I was in high school, as ordinary Americans were just starting to get wind that something called “the Internet” existed, almost everyone who connected from home connected over ordinary phone lines to a dial-up service—and many wondered which of these behemoths might ultimately dominate the market: CompuServe, Prodigy, GEnie, Delphi, or America Online? (Remember them?)  By the time I finished college, home users were largely connecting via  cable television pipes—and for many Americans, that remains the lone wired broadband option even now. But as growing numbers of Americans connect primarily through mobile devices, it’s hardly their only option or getting on the Internet—and as 4g wireless broadband networks roll out nationally, with a variety of other wireless broadband technologies waiting in the wings—it becomes increasingly possible for the average user to ditch wired broadband entirely, even for applications like high-quality streaming video. (Crawford, rather oddly, referred in passing to wireless broadband as a “natural monopoly”—by which I think she meant there are fewer national carriers than she’d like, but I can’t be certain.)

To be sure, wireless broadband is unlikely to match the top speeds of the fastest wired FiOS lines anytime soon—and Baja Fresh isn’t a perfect substitute for Chipotle. But perfect substitutability has never been necessary to provide competitive pressure and avoid the harms of monopoly. The wireless alternative just has to be a good enough substitute for enough customers that the wireline provider can’t afford to act like they’re the only game in town.

Notwithstanding all this, it is no doubt true that there are currently many Americans for whom broadband is a monopoly service available from their local cable operator, with locally available wireless Internet too slow to constitute a realistic replacement. But even if (purely for the sake of argument) you’ve got the perfect legislative response to the current facts on the ground, the relevant policy question is whether those facts are likely to remain constant over the time it takes to implement that legislative response—and, because regulatory structures have their own inertia, two and three and five years later. It seems obvious they are not.

The assumption of a persistent monopolist in online platforms seems even more obviously confused. Facebook is now supposed to be the invulnerable social networking monopolist. A few years ago it was MySpace, which took the crown from Friendster. In the world of search, we’re all beholden to the imperial will of Altavista… wait, sorry, I meant Yahoo!… wait, sorry, I meant Google. Is it still Google? How about now?

There is, to be sure, plenty government could do to foster greater competition at the lowest layer of the Internet stack. It is a little insane that, in a country where the overwhelming majority of households have cable or satellite TV (or have abandoned traditional TV entirely for services like Netflix and Hulu), federal policy keeps some of the most valuable spectrum locked up as a delivery mechanism for reruns of Friends in high def, something the FCC is slooowly moving to change. The agency could also be moving faster to encourage experiments with spectrum sharing and “white spaces.” All of these exciting possibilities would have made for a fascinating discussion about how public policy could “foster Internet competition.” So it was disappointing that most of the Brookings panelists seemed to assume the indefinite persistence of the status quo, and focused on how to make monopoly bearable. If we’d taken this approach a decade ago, we’d probably be getting the first final rulemaking out of the Subcommittee on Ask Jeeves any day now.

Want Privacy Choice? Papa’s Gonna Give You One

I was interested by the title of a paper called “Behavioral Advertising: The Offer You Cannot Refuse” by a small coterie of privacy activist/researchers. I love the Godfather movies, in which the statement, “I’m going to make him an offer he can’t refuse,” is a coolly tuxedoed plan to threaten someone with violence or death. I don’t love the paper’s attempt to show that government “interventions” are superior to markets in terms of freedom.

Behavioral advertisers are no mafiosi. They are not in the business of illegal coercion. They’re not in any kind of illegal business, in fact. The choice of title suggests that the authors may be biased toward making targeted advertising illegal. (The lead author argued in 2004 that Gmail should be shut down as a violation of California law.)

What was most interesting, though, was the paper’s unspoken battle with lock-in, or path dependence. That’s the idea in technology development that a given state of affairs perpetuates itself due to the costs of changing course.

The QWERTY keyboard is a famous example of lock-in. The story with QWERTY is that keys on early mechanical typewriters were arranged so that commonly used letters wouldn’t strike one another and jam together. The result was an inefficient arrangement of keys for the fingers, but it’s an arrangement that has stuck.

The reason why it has stuck is because of switching costs. Everybody who knows how to type knows how to type on a QWERTY keyboard. If you wanted to change to a more efficient keyboard, you’d have to change every keyboard and everyone’s training. That’s a huge cost to pay in exchange for a modest increase in efficiency. So we’ve got QWERTY.

Since as close to the beginning as I know of, Web browsers have been designed to store information delivered by Web sites and to return it to those sites. Cookies are the best known form of this, tiny files that allow a Web site to recognize the browser (inferentially, the user) and deliver custom content. There are also “Flash cookies,” more accurately called “local shared objects,” which can store information about users’ preferences, such as volume settings for Internet videos. Flash cookies can also be used to store unique identifiers to use in tracking. These things provide value to Internet users, and most Web sites make use of them to deliver better content.

The authors of the paper don’t like that. The path of Web browsing technology is not privacy protective, and they would call on regulators to fix that with a pair of interventions: preventing Flash cookies from “respawning” cookies (that is, recreating them when they have been deleted) and regulation of consumer-data markets to prevent marketers from learning information about consumers. This would uphold consumer choice, they argue. And they argue dubiously that their work “inverts the assumption that privacy interventions are paternalistic while market approaches promote freedom.”

Now, ask yourself: If the government came in and required everyone to train for and use the more efficient Dvorak keyboard, would that be a paternalistic step? The end result would be more efficient typing.

Of course it would be paternalistic.

So let’s be frank. This is an argument for paternalistic intervention, attempting to allay the authors’ concern about what a favorite technology of Internet users is doing to privacy.

And it is the authors’ privacy concerns, not Internet users’ at large. Opinion surveys in the privacy area are notorious for revealing that consumers will state a preference for privacy no matter what their true interests are.

The good news is that there is far less lock-in in the Internet browser area than in keyboards. Technologists can and do build browser modifications that prevent tracking of the type this article is concerned with.

Their real problem is that few people actually care as much as the authors do about whether or not they receive tailored advertisements. Few people want to use a browser that is essentially crippled to gain a sliver of privacy protection to which they are indifferent.

Paternalist? It sure is. And unlike a paternally driven switch to a better keyboard, this policy wouldn’t obviously make consumers better off.

Huawei, ZTE, and the Slippery Slope of Excusing Protectionism on National Security Grounds

Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. —Benjamin Franklin

Chinese telecommunications companies Huawei and ZTE long have been in the crosshairs of U.S. policymakers. Rumors that the telecoms are or could become conduits for Chinese government-sponsored cyber espionage or cyber attacks on so-called critical infrastructure in the United States have been swirling around Washington for a few years. Concerns about Huawei’s alleged ties to the People’s Liberation Army were plausible enough to cause the U.S. Committee on Foreign Investment in the United States (CFIUS) to recommend that President Bush block a proposed acquisition by Huawei of 3Com in 2008. Subsequent attempts by Huawei to expand in the United States have also failed for similar reasons, and because of Huawei’s ham-fisted, amateurish public relations efforts.

So it’s not at all surprising that yesterday the House Permanent Select Committee on Intelligence, yesterday, following a nearly year-long investigation, issued its “Investigative Report on the U.S. National Security Issues Posed by Chinese Telecommunications Companies Huawei and ZTE,” along with recommendations that U.S. companies avoid doing business with these firms.

But there is no smoking gun in the report, only innuendo sold as something more definitive. The most damning evidence against Huawei and ZTE is that the companies were evasive or incomplete when it came to providing answers to questions that would have revealed strategic information that the companies understandably might not want to share with U.S. policymakers, who may have the interests of their own favored U.S. telecoms in mind.

Again, what I see revealed here is inexperience and lack of political sophistication on the part of the Chinese telecoms. It was Huawei—seeking to repair its sullied name and overcome the numerous obstacles it continues to face in its efforts to expand its business in the United States—that requested the full investigation of its operations and ties, not anticipating adequately that the inquiries would put them on the spot. What they got from the investigation was an ultimatum: share strategic information about the company and its plans with U.S. policymakers or be deemed a threat to U.S. national security.

Now we have the House report—publicly fortified by a severely unbalanced 60 Minutes segment this past Sunday—to ratchet up the pressure for a more comprehensive solution. We’ve seen this pattern before: zealous lawmakers identifying imminent threats or gathering storms and then convincing the public that there are no alternatives to their excessive solutions. The public should note that fear imperils our freedoms and bestows greater powers on policymakers with their own agendas.

Granted, I’m no expert in cyber espionage or cyber security and one or both of these Chinese companies may be bad actors. But the House report falls well short of convincing me that either possesses or will deploy cyber weapons of mass destruction against critical U.S. infrastructure or that they are any more hazardous than Western companies utilizing the same or similar supply chains that traverse China or any other country for that matter. And the previous CFIUS recommendtions to the president to block Huawei acquisitions are classified.

Vulnerabilities in communications networks are ever-present and susceptible to insidious code, back doors, and malicious spyware regardless of where the components are manufactured. At best, shunning these two companies will provide a false sense of security.

What should raise red flags is that none of the findings in the House report have anything to do with specific cyber threats or cyber security, but merely reinforce what we already know about China: that its economy operates under a system of state-sponsored capitalism and that intellectual property theft is a larger problem there than it is in the United States.

And the report’s recommendations reveal more of a trade protectionist agenda than a critical infrastructure protection agenda. It states that CFIUS “must block acquisitions, takeovers, or mergers involving Huawei and ZTE given the threat to U.S. national security interests.” (Emphasis added.) What threat? It is not documented in the report.

The report recommends that government contractors “exclude ZTE or Huawei equipment in their systems.” U.S. network providers and systems developers are “strongly encouraged to seek other vendors for their projects.” And it recommends that Congress and the executive branch enforcement agencies “investigate the unfair trade practices of the Chinese telecommunications sector, paying particular attention to China’s continued financial support for key companies.” (Emphasis added.) Talk about the pot calling the kettle black!

Though not made explicit in the report, some U.S. telecom carriers allegedly were warned by U.S. policymakers that purchasing routers and other equipment for their networks from Huawei or ZTE would disqualify them from participating in the massive U.S. government procurement market for telecom services. If true, that is not only heavy-handed, but seemingly strong grounds for a Chinese WTO challenge on the grounds of discriminatory treatment.

Before taking protectionist, WTO-illegal actions—such as banning transactions with certain foreign companies or even “recommending” forgoing such transactions—that would likely cause U.S. companies to lose business in China, the onus is on policymakers, the intelligence committees, and those otherwise in the know to demonstrate that there is a real threat from these companies and that they—U.S. policymakers—are not simply trying to advance the fortunes of their own constituent companies through a particularly insidious brand of industrial policy.