This transcript was generated using AI automation and may contain minor formatting or transcription errors. Please refer to the original audio to verify specific quotes or context.
Cato Surveillance Week 2026: Final Day
Patrick Eddington, Senior Fellow, Cato Institute (moderator)
Jennifer Valentino-DeVries, Investigative Reporter, The New York Times
Patrick Toomey, Deputy Director, National Security Project, American Civil Liberties Union
Lawrence Cappello, Associate Professor of History, University of Alabama
Patrick Eddington: Well, welcome to this, our final day of Cato Surveillance Week 2026. I’m Patrick Eddington, senior fellow here at the Institute. Just a quick admin notes at the start here. If you want to submit questions or comments regarding the event, you can do that via the web page. You can do that via Facebook, YouTube and X. What I also want to kind of do is set the table here a little bit for what our topic is going to be today. A friend of mine refers to these. Yes. That’s one of my dogs, as personal tracking devices.
And in a lot of respects, I think that’s exactly what we’re living with here and into these personal tracking devices, these so-called smart phones that we have. We put these apps on there, and we’re almost always asked essentially, if we agree to somebody terms of service and whether or not those terms of service contain something about we may sell your data.
That is the topic that we are here to discuss today and exactly what is done with that data and by whom, and specifically here, certainly from a Cato perspective, we’re very concerned about what governments do with this kind of data that we generate and how they potentially put it to use, not just to keep track of us, but to potentially come after us for some kind of law enforcement action that may or may not be legitimately predicated. To help me wade through all of this today, I have some bonafide experts here.
We’re joined by Jennifer Valentino-DeVries, the investigative reporter, one of the investigative reporters at The New York Times; and my friend and colleague working over at the ACLU, the deputy director of the National Security Project, Pat Toomey. And finally, Professor Lawrence Cappello, associate professor of history at the University of Alabama, the author of several books. You can see those books, one over his right shoulder, one over his left shoulder. I would encourage you and he’ll plug those here in a couple of minutes. I certainly invite him to plug them. I have them both. They’re excellent.
And I highly recommend you go out and pick them up. You’ll learn a hell of a lot about just exactly how we got to the place where we are right now. Jennifer, I want to start with you. You started investigating this kind of stuff back in 2018. I believe, and maybe even a little bit before that. And in the beginning, you were basically showing folks how ordinary weather and mapping apps wind up feeding the location data market. Kind of walk us through what got you into this and what that entire pipeline looks like and what the effects of it essentially are.
Jennifer Valentino-DeVries: So, I think that this is actually something that I had been interested in for years prior to those stories a few years ago. And, as Patrick and Lawrence, are aware. This kind of tracking has been building over time. It was not something that simply started in 2015, 2016.
It has been something that people have been getting used to, for years and sort of it’s much like the frog in a pot of, slowly boiling water, a metaphor, I think, that people started agreeing to share their data, including their precise location, in order to get services that were in fact, beneficial to them in some way, such as weather alerts or, notifications, you know, of parking spaces, for example, or gas prices. You know, there are any number of things, any number of ways to use this data that is actually helpful to the consumer. Companies, of course, were interested in gathering this data more for advertising and marketing purposes.
And then, once they had that gathered, eventually law enforcement, came to realize that, you know, this sort of data could be really helpful to them. And I think, you know, we run into this problem in which people are sharing their data for, a certain purpose. But then once they share it is, you know, pretty much out of their control and can be used for other things that they would not have necessarily agreed to initially. Not just government surveillance, but also commercial surveillance.
You know, that is not what they are necessarily wanting and not what is presented to them when they see a little screen that says, you know, we will share your data to help you. And that is how it has happened over time. And now I think we’re in a situation where much more data is being shared that people would have necessarily originally agreed to.
Patrick Eddington: To me, there’s the availability of this data for federal, state and law enforcement. In your judgment, does it constitute a de facto end run around the Fourth Amendment?
Patrick Toomey: It absolutely is. I mean, the distinction between the government compelling companies to turn over this type of sensitive, often location information or other types of sensitive information. And the government buying it is really a distinction without a meaningful legal or constitutional difference. In either case, it’s putting this incredibly sensitive information into the government’s hands.
You know, as Jennifer was saying, information that allows the government to track our associations, track our movements through space and time, really easily infer, the most private details of our lives are political affiliations or religious, associations, certain health facts, about us and all of those things are, you know, the basic privacy of life that this information exposes and whether the government is, you know, showing up on a company at a company’s doorstep with a warrant or, you know, some other type of legal process or it’s offering, you know, an app developer or another tech company money to feed it that data on an ongoing basis as information is siphoned off the apps on our phones.
It doesn’t change kind of that that fundamental Fourth Amendment privacy calculus. And, you know, as we’ll talk about, there’s legislation out there that would directly address this issue. The Fourth Amendment is not for sale act. And, you know, would be one of the most significant updates, at the federal level on electronic privacy issues since Congress legislated about email in the, in the mid 1980s. And so it’s, you know, we’re well past time where Congress needs to step in. And there’s obviously, a bill waiting for Congress to embrace to address these very issues.
Patrick Eddington: Lawrence, you are a historian, essentially, of a lot of this. I want you to tell us first and foremost about, the two books that you’ve got up there on your shelf over your shoulder that you have authored. I’ve read them both. They’re incredibly valuable. But I think our reader or our viewers, as well as potential readers out there, really need to know more about them. So please.
Lawrence Cappello: That’s really kind of you. I’m going to do so very briefly, and then I’d love to jump in with these heavyweights. My first book was called None of Your Damn Business. It’s a history of the right to privacy in the United States from around the Gilded Age into the cusp of the internet era. My second book, which was released not that long ago, is called On Privacy 20 Lessons to Live By. It’s a short book. It’s meant to fit in a back pocket and be read in like 1 or 2 sittings. And it’s basically what I’ve found over a long career of why privacy actually matters in plain spoken language.
Really just trying to take the academia out of all of that in the ivory tower, out of all of that, and offer just really practical advice about how to talk about privacy. I think one of the big problems that privacy faces when trying to defend it is that it’s kind of like hard to explain why it’s important. We all know why, like deep down, that this is something we care about. But then, you know, go tell someone. Well, let me see your phone. No. Well, if you’re not doing anything wrong, you should have nothing to hide, right? And then when you defend yourself on that, it gets strange.
You either sound like you’re a conspiracy theorist living in a bunker off the grid, or you sound like a college professor. Right? Who’s giving a philosophy lecture. And the book is about giving people practical, common sense language about why privacy matters, why it’s important, and why it’s something that anyone who lives in a free society should care about. But enough about that. Thank you very much. But you’re very generous. I’m not here to plug, though.
Patrick Eddington: Yeah. Well, I always want to offer my fellow authors the opportunity to talk about, their book. So you were more than welcome. But I want to come back to you very quickly. You’re a professor. You deal with young people. How are young people essentially dealing with this phenomenon of the data out there? How do they. You know, I’m a hardcore old guy, right?
I mean, I learned the hard way during my time in Central Intelligence Agency, that when you sign a non-disclosure agreement, for example, you know, you’re putting yourself in a position of basically having the government looking over your shoulder, you know, in that way, anything that you ultimately publish, that’s something that I have to deal with for the rest of my life. But that’s a very discreet issue. What Jennifer has outlined for is what Pat has outlined and what you started outline is that we’re in a totally different world now where every one of us essentially has to kind of deal with it.
But I’m really interested to learn how your students essentially are reacting to this stuff, how they process it, and what you see when you interact with them in the classroom.
Lawrence Cappello: It is good. They do care a lot about privacy. I just find that they do their intelligent, they’re articulate, they can speak about these things when you kind of give them the right things to read and the right things to watch. But, you know, we’re talking about the Fourth Amendment, right. And the most important word, as far as I’m concerned, the Fourth Amendment is reasonable, right. Like, what’s a reasonable expectation of privacy? What is an unreasonable search and seizure. And a lot of Fourth Amendment jurisprudence is a constant, you know, grappling with this question of what’s reasonable.
And that’s going to change from generation to generation, right? A lot of I think people who are over 40 will look at Gen Z and say, oh, the thing they’re most terrified about is not being seen, right? That like, they’re just the most, you know, public, and they want— they have Life360, and, you know, they all want, you know, like every institution to be their mom, right. Like, that’s not the case at all. They just have different expectations and different kind of understandings of how those things work.
They are by no stretch of the imagination, the least private generation, in that they enjoy significantly less privacy than we did at their age, than our parents did at their age, and their grandparents did at their age. So a lot of them are grappling with that, but they still want to curate how they’re seen by the world. And a lot of what I think the reason privacy is important, not just the Fourth Amendment, which has a lot to do with liberty and freedom, but privacy in general. One of the reasons we want to control the information that’s out there about us, right?
Let’s define privacy imperfectly as being able to control the snippets of information that all exists around us in the world. One of the reasons we want to exert control over that is because controlling that allows us to shape how we’re perceived by others, right? It allows us to control our reputations and how we navigate the world. That kind of control is absolutely necessary to navigating modern society. It just is, right. Like it’s, on a social level. On a professional level. Look at Gen Z social media. They’re not laying it all out there. This isn’t like, here’s my whole life. Look at me. They’re curating how they’re being perceived.
Most of them would be the first to admit that who they are on social media, probably who they are, aren’t in real life. So that instinct is perennial and something they’re really in touch with. They want to control what information is out there about them. I think the big difference is we were all raised in a world where we developed and were instilled with certain privacy instincts from a very early age, a lot of that wasn’t even overtly taught. It was just a byproduct of being in an America at a specific time, particularly the 20th century. Now, what you see, they don’t have those instincts and a lot of our responsibility.
And this is something I thought a lot about when I became a parent, is how do you cultivate instincts in this generation that is largely been handicapped, because they’re really the first to ever be entirely prisoners of their recorded past?
Patrick Eddington: That’s an excellent point, Jen. I think there was a moment in your reporting when you showed a woman the record of her own movements. How did how did she react to that? What kind of came out of that revelation for her?
Jennifer Valentino-DeVries: She was shocked by these revelations. And it was more than one person who participated in this, research with this. And I think they were universally shocked by what was on there and yet said they knew that they shouldn’t be. I think they were kind of aware that something was happening in the background, and but it was something that they didn’t have time to investigate, to go through. All of you know, their settings and look at and nobody was providing them, you know, with their own data, at that point. Right. So they had no idea what it could actually show.
I think it was, until that point, really an abstract, kind of thought for them if they thought about it at all.
Patrick Eddington: The how many folks did you actually manage to get involved in this particular project? And did the reactions to the revelations of this tracking essentially? Did it vary essentially, you know, by demographic? Did it, did it vary by whether they were Gen Z or whether they were an old guy like me, etc., etc.? How did that kind of shake out in your reporting?
Jennifer Valentino-DeVries: It was so the people we actually spoke with, it was just really a handful of folks who were in the particular data set that we were looking at. I think also you should remember, you know, this was several years ago at this point, and there have been changes in, how much data is being collected and shared. The differences honestly depended a lot on, the technology being used and how much it was able to track them, how, fine grained of location. The tracking was actually able to get. And I wouldn’t say that there were really generational differences.
The people who were letting us look at their data, you know, it was not as though they were, They really didn’t have anything to hide. I mean, otherwise you’re not going to be agreeing to, you know, share your data with The New York Times. But we could see people in this data set, and there’s been work done since then. Who? You know, you could track people also to like an abortion clinic, which law enforcement, you know, has like been doing. You could track people and see that they were going to, a gay bar in new Jersey, as I recall. And. It is incredibly revealing.
Even just looking at location, let alone, you know, all the other data that might be collected now from your car, not only your cell phone, your web browsing, and is increasingly, you know, able to be combined into, you know, unfortunately, I think a, I think it was Paul Ohm who’s a professor. I think he’s at Georgetown now. He’s always called this the Database of Ruin. And we’re always, like, increasingly coming close. I’m afraid to that, to that state.
Patrick Eddington: Pat, to me, you mentioned the Fourth Amendment Is Not for Sale Act. The House version, of course, offered by Republican Representative Warren Davidson of Ohio. The Senate version offered by who I describe as the last man standing or last person standing in the United States Senate who really goes to bat on these issues. The senior senator from Oregon, Ron Wyden, give us kind of the general legislative history, the origin essentially of the legislation and kind of, you know, where we stand with that right now. Obviously, there’s been no action so far and likely will be no action during the balance of the 119th Congress.
Do we have a sense of whether or not that particular bill might be reintroduced in the 120th Congress?
Patrick Toomey: Well, I be very, very surprised if it wasn’t reintroduced going forward. I think the, you know, the bill has been out there for a number of years. It was it was, I think, passed by the House. Several years ago without moving forward in the Senate. But there have been repeated efforts to introduce it and to get both houses of Congress to vote on it. And I think, you know, I think everything that’s happened in the interim, since the House initially passed, it has only added kind of added the added fuel, added momentum, to you know, that Bill’s trajectory.
There’s been some I think updates to it to take into account, you know, additional developments. And I think the Supreme Court’s recent decision in the Chatrie case this past summer, which was its decision on geofence warrants and the Fourth Amendment, you know, only adds, again, to the kind of legal support and legal impetus for that bill. The Supreme Court, just as a as a quick summary, addressed whether a geofence search, which is, which is a demand was a demand to Google for information about, all the people running a particular feature of Google service within a certain area over a certain, you know, time frame.
You know, it was a demand for that, that information in the course of a robbery investigation. And Google had kind of devised this three step process that it used to respond to those types of requests for sensitive geolocation information. And the person accused, and identified through that search ultimately challenged it. And the case went all the way up through the Fourth Circuit to the Supreme Court, which decided— reaffirmed the Supreme Court’s prior decision in 2015 in the Carpenter case, which was kind of a landmark decision about the sensitivity and Fourth Amendment protections for cell phone cell site location information.
And what it did was, it really reaffirmed that despite some efforts in interim years by the government to cabin carpenters reach and kind of limit it to one particular type of data that, in fact, the court recognized, you know, even more the sensitivity of geolocation information. It’s opinion discussed how more, you know, how the data had only gotten more granular in the interim, how, you know, the number of geolocation kind of snapshots that Google collected from its users devices was only more frequent than what the cell companies have been doing back in 2015.
And, you know, where Carpenter had focused on a person’s movements over the course of a week? Chatrie was about the sensitivity of that information even over the course of an hour. And so it really, you know, showed that that the Carpenter decision was not a one off was not, you know, not going to be confined to kind of its specific facts and that the court was recognizing that the sensitivity of this data had only grown. And so, you know, I think that decision fuels the need for Congress to step in the court.
While it recognized that the use of this type of geofence search was a Fourth Amendment search, you know, governed by the reasonableness and warrant requirements in the Fourth Amendment. It left unanswered another set of questions about whether this three step process that Google had been using was satisfied that warrant requirement. And, you know, that’s just one kind of glimpse of the complex questions that sit underneath a lot of, the decisions about how to treat government demands for or purchases of this type of data. You know, what steps in the process. Do you need to go to a court? What types of findings does the court need to make?
How you know? How can the government try to try to request or demand more granular or additional information from within that huge pot of data? And so all of that, I think, goes to the, you know, the reasons that you need Congress as a deliberative body to be designing many of these rules in the first instance, leaving them up to kind of judges in individual cases is not the best way, even if it’s one important way for us to regulate these types of technologies as a society. And so it really is on Congress to step in and to create some of those important rules.
Lawrence Cappello: Okay. Jump in here for a second. And though you said you wanted to have a discussion like people like Pat and the ACLU, you know, they are at the vanguard of like the most the biggest battleground for like modern privacy. And, you made some really good distinctions there that I thought were that just I want to highlight even further without regurgitating what you said. It was also ties into something. If you ever read the brilliant profile of that The New York Times did on Jennifer. A lot of what you talk about is how a lot of this is kind of seems futile, right? That like, information collection is going to feel futile.
It’s important, I think, sometimes to be clear about where the privacy battlegrounds are right now in the 21st century. And I think something that we tend to forget is information like it moves in stages. And people who study data scientists are really into this. But like information is first collected, right. And like the collection of that information presents its own kind of privacy problems. But then after it’s collected, it’s like reassembled into these like, files, right? These dossiers, that’s the processing stage that that’s a different battleground and that presents its own unique privacy problems. Then it’s like shared again, right?
Like after it’s processed and used for different ways, which presents its own different kinds of privacy problems. When people say things like privacy is dead, I think they’re talking about a lot of what Jennifer argues and what I feel. And I’m sure Pat feels, that we’re never going to be able to stop that collection part anymore, right? That like, you can’t, like, navigate modern society without constantly dropping snippets of data. You can’t get a cup of coffee, you can’t drive, you can’t do all these things.
And a lot of us just feel like giving up because and I agree, like, I don’t think we’re ever going to meaningfully be able to stop data collection anymore. The real battleground in the 21st century is what Patrick’s talking about. It’s what happens to information after it’s collected. Right? Like and so when we talk about, like, shutting down Flock cameras, I’m all for that. But it’s you’re not going to stop the collection of data just by like, you know, I live in I work at the University of Alabama. I live in Birmingham.
A guy that lives less than an hour from me just got arrested because you’re driving around with a 12 gauge just blowing up cameras, right? Which I think is interesting and like, you know, it shows the kind of like, human pathos involved in all of this. But like that in and of itself, a lot of people like, that’s kind of futile. And I was like, yeah, it is what Patrick’s doing, you know, talking about, okay, this data was collected, already by like, different entities. Some of it was purchased, some of it was taken and like but that in between phase of okay, it’s been collected. Now what?
That’s what the modern battleground for privacy is certainly with Fourth Amendment jurisprudence. But then also in like your own personal lives, right. You shouldn’t not have a phone. You should be able to have a phone and then like trust to a certain degree, that there’s proper default settings put in place that are going to prevent your geolocation data going to anywhere you’re not looking at. And, just my compliments to both of you. Really like, it’s, this is where the Vanguard is.
And if you want to meaningfully change things, I think the Americans need to be more aware of those distinctions that there’s stages of information being collected. And when we start lumping it together, it gets to kind of muddled and confusing and solutions become more difficult to achieve.
Patrick Eddington: I probably endorse almost all of that, although I’m not prepared to give up on the stopping collection part of it. In a governmental context. Right. Jen, I think maybe you had something you wanted to add in there before I give my own homily, or correct you,
Jennifer Valentino-DeVries: I was going to bring up Sensorvault if you want to talk about Sensorvault. Oh, I was well, I was actually, going to talk about a I think that people also feel this is futile because they have, they’ve been made to feel as though they can control this data when they actually can’t, that they can control the collection and that it’s their responsibility to control the collection. But that really is not the case. So they are presented with all these options and menus that are hidden behind menus and told that, well, we have these privacy tools. If you bothered to use them, you could somehow control your privacy. And that is simply not true.
So I agree that, when it comes in particular to the technology itself and the commercial collection of data, that that is not where the battleground is, but I think that, people still think actually that that is where the battleground is because they’ve been made to feel this way. They’ve been perfect. The responsibility has been a, you know, falsely kind of foisted on to them.
Patrick Eddington: I will tell you that my latest freak out was when I got to a particular place where I had some business to conduct, and I get this pop up on my phone with Google telling me, your parking location has been saved. And I’m like, I didn’t tell you to do that. So I continue to kind of be of the opinion that definitely in the governmental context, that what we need in place, if we’re going to allow certain kinds of collection.
And while on an emotional level, I am sympathetic with the guy that was riding around taking off Flock cameras, I cannot, as a matter of public policy, endorse that particular kind of civil disobedience, even though it’s emotionally satisfying. I think and I’ve talked about this and I’ve written about this quite a bit, that for me at least, it is a data destruction requirement that really needs to be at the heart of a lot of this stuff. I know that I’ve advocated this. I know that Pat has advocated this.
Our friends at the Brennan Center have advocated this, but from my perspective, it is the failure to have mandatory back end auditing and data destruction, especially in the governmental side. And I keep coming back to that because while I hate, you know, what Google necessarily does, I’m not a fan of what Thomson Reuters does, all the rest of that kind of thing when it comes to the to the commercial data aspect of it. Thomson Reuters is not going to send people with badges and guns to break down my door and conduct a search of my home and a seizure, which may or may not be legitimately predicated.
That’s why I tend to worry more about the governmental side of this. What complicates it now, of course, is this very topic we’ve been discussing, whereby the government has the ability to simply go and purchase this data, which really kind of brings us back to this whole issue of, you know, where do we kind of where do we actually put the boundaries around it?
We talked Pat talked about the Fourth Amendment Is Not for Sale Act that actually passed the House, in 2024, literally during the same period of time that the House was debating whether or not to reauthorize the FISA Section 702 program, all of Title VII, essentially of the FISA program. And Senator Rand Paul, to his credit, did offer an amendment on the Senate side to the legislation that included the full text of the Fourth Amendment Is Not for Sale Act. And unfortunately, that went down in flames. I think the vote was something like 61 to 39.
So as I see it, we still have a very hefty task on the Senate side, especially to try to get members to understand that this can be weaponized against you. I think more and more of them are beginning to kind of understand that they’re beginning to kind of realize that. But we still, in my judgment, anyway, we still have a long way to go to kind of get members of Congress to really engage on this. I mean, so far, I’ve only mentioned two members of Congress. They’re the two most prominent for the most part on this issue, or at least they have been. And it’s Warren Davidson and Ron Wyden. But I and Pat helped me out here.
I’m scratching my head when I’m trying to figure out, you know, who else is out there really kind of beating the drum on this. Is there anybody else in Congress besides those two guys that’s like, really kind of going to town, basically saying, hey, we need to do something.
Patrick Toomey: I mean, they’ve definitely been some of the most prominent champions. But I think, as you said, there’s been other supporters at different important moments. Rand Paul has been, a supporter of these types of issues that at times Senator Mike Lee has weighed in on important privacy issues. You know, a bunch of members of the Freedom Caucus on the House side at different moments have been drivers, within the House of Representatives.
So I think there’s an appetite and I think I think, you know, I think it’s really interesting to think ahead to what, you know, what might be possible in the next Congress, given the types of concerns that, you know, we’re thinking about, we’re hearing about with respect to AI, with respect to Flock, like others have said on this call, because I think it does, feed into, you know, both public appetite and public demand for congressional action on this overall set of privacy issues.
And so the hope is that we, you know, we get to a point where we break through with enough members of Congress who are hearing from their constituents and are ready to do something. And as you know, as many folks on this call may know, Section 702 has lapsed. So there will be another debate in Congress around at least one set of important privacy and surveillance issues, and whether the Fourth Amendment Is Not for Sale Act. And some of these other questions related to the use of AI in ways that intrude on privacy, get bundled into with those issues, I think is one possibility.
And that’s how the Fourth Amendment Is Not for Sale Act came up through Congress last time around.
Patrick Eddington: Lawrence, you actually are very heavily involved with the AI issue at U of A. You’re trying to use it, if I understand correctly, in ways to enhance the teaching process. When you think about, AI in this particular context that we’re discussing, where do you think essentially government’s role is in trying to put some boundaries around this in terms of what AI could potentially do to supercharge the use of this kind of commercial data?
Lawrence Cappello: A couple things. One would be, yeah, I’m very heavily involved in using AI that expert instructors use AI to help them better combat post-pandemic student disengagement. Like, you know, something the pandemic did something to a generation of American children that impacted how they act in the classroom. And AI has a lot of positive traits that can help instructors, particularly those who aren’t freight trains of confidence and hyper charismatic lecturers. Right? Like who feel like they’re losing their students and they’re great. They’re great educators. Don’t get me wrong.
I just mean that like that do need a little bit extra help for what is a very different student body in terms of learning style and knowledge consumption. That said, I’m a huge proponent. I ban AI in a lot of my classes, and I allow it in some other ones. Largely because cognitive offloading is a real thing and, you know, it’s now more than ever. It’s our responsibility as instructors to make sure students are developing old school critical thinking skills, which I think is increasingly going to become more of a premium in the marketplace. I mean, I run a events pre-law concentration here for legal history.
I spent a lot of time talking with people my age who are senior partners that are hiring. And I remember 3 or 4 years ago, they would talk to recent law school grads and be like, oh, do you know about AI? Like, can you use AI and legal research? And now all they’re saying is like, what separates you from any recent grad with a subscription, right? Like what they’re looking for is the old school ability to go in there. And that’s that didn’t take long either. Which makes sense because like the legal field is, I think, very market responsive. Right. Like it’s there, it’s high stakes. They’re quick on their feet.
Firms understand that if they don’t adopt, they die. But you asked me about what can the government do. I definitely something so, you know, this is a Cato Institute talk, right? And a lot of the solutions we’re thinking about are going to push up against a lot of free market ideology, right? Because if we’re talking about public and private sharing between the government, we’re also then kind of talking about, you know, private sector regulation, you know, look at Europe. Europe has the most advanced privacy protections in the developed world, right, with the GDPR. And as a privacy advocate, I’m also a conservative.
But like as a privacy advocate, I’ll be the first to say that like that did hinder a lot of market development, right? Like in terms of it did, the regulations were a hindrance to a certain degree. I’m not going to run the other way and say, okay, then no regulations. But there are some tough questions that need to be asked. You brought up a really good point in data destruction, right? In the sector, we call it the right to erasure. Right. Or increasingly it was called the right to be forgotten. Right. We talk about this a lot. When you brought up Carpenter, which I think is one of the most important cases of the 21st century.
One of the things people were saying with cell site location information was like, why doesn’t, you know, Verizon, just, like, delete the data after six months, right? Like, why are you keeping the cell site location information? That’s like five years old. Like that’s at first of all, people like, wait, what they are. And that works. Right. But there’s I could make a very good if I was counsel for a corporation that was on the data side for like Google or someone who’s a data driven company, I can make the argument that you’re going to hinder my business. Those arguments been made since the 1970s.
I mean, the big reason that the Privacy Act in 1974 doesn’t include private entities because it was supposed to, and then it gets gutted at the last minute. It was because people were making arguments about how these data regulations are going to destroy companies and are the enemies of capitalism. Right.
So there’s I’m not saying I have the solutions, but what I’m saying is, as someone who is a fiscal conservative, but also really like a privacy advocate and cares a lot about the Fourth Amendment, we’re going to realize that the AI age, if it is as transformative or everyone says it is, there needs to be this common sense data regulations that like, if you’re doing business in the United States of America, you’re simply going to have to deal with because our liberty is more important than that. Right? And the fact is, your capacity to know us and harm us has gotten considerably more.
And, you know, at the end of the day, you know, the Fourth Amendment is there for a reason. It’s tied to the legacy of the revolution. It’s tied to the legacy of Madison. If I could just for one more minute, I’m a big fan of market solutions to this problem. I’m a big fan of privacy enhancing technology being bought and sold.
One of the things that when I study the history of privacy was largely the story of privacy protections are often proposed by privacy advocates and then in a lot of ways, free market sensibilities gut those protections because those protections are framed as enemies of profitability and of the economic powerhouse that is the United States in the 20th century. And a lot of those arguments were well founded, and a lot of them hurt privacy. We’re at a really interesting moment now where for the first time in our history, there’s a chance for the people like on the free market, seem to be embracing privacy and the profit motive as kind of joined.
The profit motive was usually against privacy for most of our history. And now, have you seen an Apple ad in the last three years? You know, privacy. That’s iPhone, VPNs. I mean, this is counter surveillance technology that 15 years ago would have been seen as a little paranoid unless you had like proprietary jobs where you needed to, like, keep that stuff. And now it’s like on every ad in a bus, in a subway. Some of them are super clever.
Look at the constant gesturing for privacy enhancing technology and one sector that I think everybody should keep their eye on, particularly if you’re an investor, is what’s called, it’s all online reputation management. When you’re trying to get people to care about privacy sometimes don’t threaten them, threaten their kids. A lot of people I never got more invitations for talks than when I started writing about what parents can protect kids privacy. Right? And like, all of a sudden, people were really interested in that.
And online reputations, reputation management are companies that will it’s like a Google alert on steroids for like you and the people you love. And anytime something pops up, there’s a team that will identify it, flag it. You can then have a meeting or a zoom meeting, depending on the tier of service. And parents are increasingly doing this for their teenage kids, recognizing that they grew up at a time where you could just do crazy stuff and like, no one saw it and no one had a recording of it and it was fine. Whereas now their kids might do the same exact thing and hurt themselves.
So for the first time in American history, the profit motive does seem to be also on the side of privacy. Of course, there’s still trillions to be made in violating it, and I really am excited by that. And really in think that modern CEOs and people on boards should pay attention to the potential windfall that can come from being a privacy forward company. The fact that we have such bipartisan culturally, not necessarily people in Congress, but left and right reaction against Flock cameras, right? Like there’s this unification aspect of privacy, if it’s in the right context.
And I think that there’s something to be profitable from me from there. So while I think Pat is absolutely doing the Lord’s work by fighting for what he’s fighting for, like out in, you know, in the Fourth Amendment in the courts, there’s this other prong of resistance, of just finding a way to take your car off the grid. If you did have a GPS, like locked into it, right, finding a way to, you know, take your phone off the grid, finding a way to use signal as opposed to another text messaging app. Right. Like there are ways in which you can limit your digital footprint.
And as a parent, things like share are now something you need to worry about, which is sharing too much about your children online, like their birthdays and photos of them and stuff like that because it makes them right for identity theft. The people assume that by 2030 two thirds of identity theft is going to occur from minors being gleaned from their parents social media.
Patrick Eddington: Well, Jen, all this work that you’ve done in this area. How is it impacted how you approach your daily life? The apps that you necessarily decide to use, how you deal with sources, all those kinds of things. That’s one of the things when I think about my friends in the journalism community, is you can kind of get nailed from two different directions here. One can be the governmental side, but then the data that is actually being accumulated on you can then turn around and wind up in the government’s hands.
So to what extent have you modified your behavior or your approach to reporting source relationships, all the rest of that kind of stuff on the basis of what you’ve learned about this technology and this potential threat?
Jennifer Valentino-DeVries: Yeah, I think that, you know, I’ve been more privacy conscious than the norm for some time now. And I don’t know that I would call myself a Luddite, but, I think my family is very aware that we are not getting an Alexa ever, despite their attempts. But I think it’s also important for me to note that even though I am more privacy conscious than a lot of people have time to be, I still find it very difficult. And I have come to accept that I’m not going to, be perfect at privacy. I think that that is practically an impossible task.
And I think that that speaks to the need for either legislation, decisions by the courts, a combination of multiple, things, because, again, this is not really something that each individual can keep track of at this point. You know, I don’t have time to read every single terms of service that pops up on my phone or computer. You know, you would spend people have calculated the amount of time it would require to do that sort of thing, and it is prohibitive. And so I think it’s important to keep that in mind.
I think, when it comes to sourcing, I have been heartened to see that journalists, over time, have become much more concerned about keeping their sources private and about digital communications. A lot of journalists use signal now. We regularly have discussions, in the newsroom, with, you know, our lawyers and reporters, editors, people who are on our, security computer security team. And that too is quite difficult because you’re dealing with, somebody, another person who. You know, might not, be really able to take steps to keep themselves, like, perfectly private.
And it’s tough, when you’re having to deal with the source who is maybe working in the government and so forth. And they are being, you know, all their badge slips are being tracked and I when you look at cases where, press sources have been found out, you can see just how much of a data trail they’re leaving behind. And sometimes frequently, it’s just they will the government will just present metadata. You know, you went out of the building at this time, you came back into the building. You know, the reporter was actually in, you know, this location. And you looked at the, classified document at this time on your computer.
And it all kind of lines up and nobody else did that. So you have to be the one who has done this. And I mean, that’s certainly that’s enough, you know, to take to a grand jury and like, it’s really tough just with metadata, even if you’re if you don’t have, even if you’re keeping your content relatively safe. And I think it’s always important to look to those cases to know what can be, what can be done. I think, As the government has in several cases recently, you know, shown itself to be more likely to go after press records. I think journalists are paying more attention to that. I’m very concerned about, that situation.
And I know everybody at the times is and, as our other journalists I know, but I will say it has prompted, over the past few years, journalists to be much more cognizant of their digital security.
Patrick Eddington: Well, I will say that, over 30 years ago, when I made the decision to smuggle over 100 classified documents out of the CIA and deliver them to the Senate Select Intelligence Committee. The first thing that I did before I put any document away for that particular purpose was get a get out of jail free card from the Senate Intelligence Committee saying that I was supplying everything to them. Pursuant to their oversight responsibilities. It would be very difficult for anybody to do that now.
I mean, I think in some respects, Ed Snowden was probably lucky that he managed to get as far as he did in terms of, exhilarating documents showing, clear constitutional rights violations by the government against all of this. So those insider threat programs that have been established, you know, since then, I know are making it much more difficult for people in your business to actually, you know, find out what’s going on. I do want to touch on the Flock camera thing for a moment. I mentioned data destruction, as one way, you know, to approach the collected data problem that Lawrence articulated so well, one of the reasons that I’m.
I’m trying to convince my wife to move to the state of New Hampshire, isn’t simply because I a absolute Second Amendment advocate, but in the state of New Hampshire, if you’re going to be if you’re a governmental entity and you’re going to be operating anything like a Flock camera, everything else that isn’t relevant has to be destroyed within three minutes. I really like that, that kind of approach, if it’s not relevant, if the data doesn’t, you know, actually, produce a hit for an Amber alert or a silver alert or something like that. I think it absolutely ought to be destroyed.
So I personally, I’m hoping that other states, you know, will pick up on this. This is another way. Another lawful way to go after Flock cameras without actually potentially discharging a firearm or using a chainsaw or something like that to take down those Flock cameras. I also think it’s probably worth noting that one of the reasons that Pat Toomey and I and our friends at the Brennan Center and Institute for Justice, which has one of the premiere Flock camera cases, anti Flock camera cases right now in the federal courts.
One thing that makes the electronic surveillance part of this much more difficult to actually get defeated or get reined in to any degree at all, is that for most people, that kind of activity is basically going on in the background, and most people are not aware of what’s going on. But if you’ve seen a Flock camera and you know what it looks like, you know what it’s doing every time you drive by it. And I think it’s that tactile aspect of it, you know, that really makes it a lot easier to kind of understand why people are, you know, doing what Lawrence described earlier.
And there’s also been this confluence, I think, of the Flock issue, you know, with data centers. I’m a big fan of Sarah Longwell, the publisher of The Bulwark, but who also at Longwell Partners has her own business consulting, political consulting business. But she does this thing called the focus Group podcast, which is basically hosted by The Bulwark. And in these focus groups that she’s done over the last few months, this confluence of Flock means data center means bad things, as really it has congealed. I mean, it has absolutely become a thing. And we’re seeing this very much as I think both Lawrence and Pat of alluded to.
It’s become a very bipartisan thing in that regard. So I personally have some hopes that we wind up, you know, getting to a place where maybe in the coming Congress, we see some action on this. I don’t think the problem can get solved primarily by the states. It would be nice, you know, if that were the case. But if the federal government is still in a position to take tax dollars and buy these kinds of cameras and get easements and put them up in states, again, that would kind of represent an end run, essentially about what we’re trying to kind of accomplish here. We’re getting down to the last few minutes here of our time together.
So I want to basically turn to each of you in turn and just kind of get your overall concluding thoughts on where we are, where we appear to be going, and where we should be going. And, Jen, I want to start with you.
Jennifer Valentino-DeVries: Sure. I think that, I’m terrible at prognosticating, which is why I’m a reporter, not I’m putting on the past on events that have actually occurred. But I am. Concerned about the degree to which AI, will supercharge a lot of these, databases or supercharge the ability to gather disparate data and make some sense of it. I know that we have had programs for a long time, and data centers throughout the country that are gathering this data and making these databases. But I had always found that, you know, when you went to things like this, you looked at the actual programs, you know, it’s a database, it’s a network map. Okay. You know.
Yeah, it’s not, quite the level of, like, Minority Report or some sort of Sci-Fi, thriller. I am concerned that, artificial intelligence, because of its ability to make sense of disparate data, is really going to bring us closer to that sort of science fiction world. This despite the fact that I also, you know, I don’t think we are looking right now at like super intelligence, or anything like that. I think that there will still be and this makes it more concerning, plenty of errors. In this kind of analysis.
And it is a combination of, you know, an error rate that is a, not compatible with a fair justice system, but a presentation that is so human and authoritative that it makes, law enforcement work, you know, seem so much easier. And it’s really easy to kind of fall into a trap, I think, of relying on its outputs and reducing, you know, I think Lawrence was mentioning earlier, talking about his students, you know, it, has a lot of cognitive effects. And I think I can only guess that the same will be true for uses by the government. And I think that’s truly problematic. And that’s kind of what I’m looking out for in the future.
I do think that, you know, policies related to data destruction, are good ones. And I agree that, you know, this is the thing, like, if we could get the, Congress to do anything, ever. This is something that they should do. I am not incredibly optimistic about that. But, you know, we’ll see. And people do seem to be finally realizing like that. There is there has been in the past few years like that question that I know all of us always get like if I have nothing to hide, why should I worry about this? I think is much more answerable now for a variety of folks than it was, maybe 15 years ago or so. That’s fine. At least. At least there’s that.
Patrick Eddington: Yeah, that is my favorite question. Whenever I am asked to lecture students. What? You know, I’m not doing anything wrong. What do I have to worry about? I bring up a guy by the name of Brandon Mayfield. We can. We can talk about that in other time. AI hallucination, combined with massive data. Pat Toomey, what kind of a nightmare are we talking about in terms of protection of constitutional rights?
Patrick Toomey: You know, I think we have to hope and then do everything we can to, make sure we get there. I think we have to hope we’re at on the verge of a watershed moment for privacy. And, you know, there have been these moments before, and that’s one of the reasons I like to read the kind of history that Lawrence writes about, related to these issues. You know, the past the adoption of the Fourth Amendment was one of those watershed privacy moments. The enactment of the Wiretap Act in 1967, you know, decades, of course, after the telephone came into common use.
And, you know, it just takes time for, you know, the government to figure out how it wants to try to exploit these tools. And then for the public and, of course, eventually their representatives to decide and to work up the willpower to regulate them in a, in a kind of across the board way. But you see that in the Wiretap Act, you see that in FISA. And, you know, we haven’t seen enough of that in the last 40 or 50 years. But given the advances that we’ve talked about today, I think we’re close. We’re, you know, we’re close to a moment where the public is understanding how things have changed and what it means for their privacy.
And of course, it’s not going to happen on its own. It requires the kinds of, public pressure that, you know, that we’re seeing bubble up in some places now, but that that’s where we need to be and be heading because, you know, as folks are saying, as Jennifer is saying, AI is only adding fuel to this, you know, where even the collection of information was a really serious intrusion five years ago. The ability of AI to kind of, you know, sift through this data and combine it with other data sets at scale in an instantaneous way, where human analysts would, you know, would take them hours, days, weeks to do the same thing.
That’s only going to add to the need to get some real regulation around this. And, you know, for all the work that we do in the courts, as the ACLU, a comprehensive approach has to come from Congress. And we’re absolutely pushing there.
Patrick Eddington: Lawrence Cappello, the final word goes to you.
Lawrence Cappello: Anybody who has young people in their life that they care about, set up a Google alert for them. Now, I don’t think a lot of people are aware of how much data about minors and the people you care about is out there on the internet. Google will help you suddenly become aware that someone might have posted something, or is doing something with regard to your kid. The other thing I’d say is, you know, we didn’t bring up Orwell once, which is one of the first privacy talks I’ve been on where we didn’t talk about Orwell. And, you know, that book was written when none of that tech existed, right? Like it was all sci fi.
The tech does exist now, and there are nations on this planet that have enacted full-on Orwellian surveillance states. We haven’t yet. Right. Like, I mean, we have a lot of problems that we need to sort through, but we’re not at the extreme end of the spectrum. And the reason we’re not and the thing that now keeps Orwell from being a reality, it’s human beings. It’s people. Right? Like it’s the institutions, of course, that we care about. But it’s the living, breathing people that breathe life into those institutions. And people like Pat who agitate the system.
People like Jennifer who investigate, you know, the real harms that are happening here in the state of these things. But it’s important not to forget that, like we talk about privacy and tech and AI and all these things seem so big, but, you know, it’s human beings making decisions and choosing to upload core principles that, you know, were born out of our revolutionary tradition. And, we should keep that keep that in mind. At the end of the day, human beings can make the difference here. And they’ve already been the thing that’s kept us from being, like some other civilizations on the planet.
Patrick Eddington: Absolutely agree with all of that. Jennifer Valentino-DeVries, Pat Toomey, Lawrence Cappello, thank you for joining us today and for your exceptional insights. My thanks to you, our audience. This concludes Cato Surveillance Week for 2026 for the Cato Institute. I’m Patrick Eddington. Thanks for joining us.
