Privacy Threats from a Banana Republic


By now, the economics of offshore outsourcing are clear.Offshore outsourcing creates economic growth, bringing more andbetter things to more people.

Free trade in services is equivalent to free trade in goods, ofcourse, and data processing is the latest, greatest activity to plythe oceans of world trade. Outsourced services include taxpreparation, handling of customer inquiries and complaints,accounts payable and accounts receivable operations, softwaredevelopment, and data entry. The twin revolutions intelecommunications and computing are making possible new waves ofefficient Information Age production.

Some do resist the forward motion of a growing,changing economy. One way opponents fight offshore outsourcing indata services is by raising privacy concerns. Most of thoseconcerns have little real weight. U.S. privacy promises andcontract obligations go wherever data goes. Legal obligations likethe privacy torts apply no matter the data's format, transfermedium, or location. And regulatory requirements do not cut outwhen data moves offshore.

Anywhere on the globe, good practices protect privacy and badpractices do not. Good outsourcers investigate their serviceproviders carefully, making sure there is proper training ofemployees. They check that computers used for data processing donot have open Internet connections, e-mail, or instant messaging.They keep data processing rooms free of pencils, paper, printers,and copy machines so employees can't abscond with data. Informationis not stored at remote locations any longer than necessary. And,of course, they use encryption when transferring data. Given allthese good practices, data sent offshore may be more secure thandata processed domestically.

Likewise, bad practices fail to protect privacy, onshore or off.The one known case where offshore outsourcing has threatenedprivacy illustrates this: In late 2003, the UCSF medical center inSan Francisco originated a long outsourcing chain that stretchedthrough many links to Pakistan. When the medical transcriber at theother end wasn't paid, she threatened to publish patientinformation on the Internet. That is a hardball practice, at best,but the mendacity and double-dealing that caused the situation wasentirely homegrown, by a deceitful subcontractor in the exotic, faraway land of Florida.

There is one legitimate privacy threat from offshoreoutsourcing. This has been called the "foreign subpoena problem."Obviously, other countries do not have the same Fourth Amendmentprotections that the United States has. It is possible that datamoved offshore could be collected by a foreign government inviolation of data subjects' privacy. For example, a country tryingto get tax information from its own citizens who invest in theUnited States might collect U.S. financial records that appearwithin its borders.

The primary solution to the foreign subpoena problem is theself-interest of "insourcing" countries. It would be job-destroyingfoolishness-economic suicide in some cases-for the government of adata processing country to arbitrarily seize foreign data. The merethreat of local government seizure would chase foreign clientsaway. Only the densest government would attack its economic base inthis way.

The "foreign subpoena problem" with offshore outsourcing firstcame up as a theoretical possibility that could arise if somebanana republic lacked the good sense to protect data transferredto it for processing. Unfortunately, that banana republic may turnout to be the United States.

Section 215 of the USA Patriot Act dramatically lowered thethreshold for secret judicial orders requiring data holders to turnover information about non-U.S. persons. It also expanded the scopeof what could be sought. American law enforcement now may seizeentire databases of information, and it is against the law foranyone to reveal this when it happens.

Section 218 of the act also broadened the authority ofinvestigators to perform physical searches and electronicsurveillance in foreign-involved cases. Formerly, foreignintelligence gathering had to be the "primary purpose" for suchactivities. Now, it only need be a "significant purpose." Thissmall change in wording is a huge expansion in investigativeauthority.

USA Patriot Section 505 lowered the threshold for the FBI toissue secret orders requiring businesses to disclose customerinformation without the permission of a judge. Subsequentlegislation broadened the scope from financial services providers,phone companies, and Internet service providers to include traveland real estate agents, the U.S. Postal Service, jewelry stores,casinos, and car dealerships. That section has been enjoined by a court in New York because thesecrecy requirement is so restrictive.

Last month, the information and privacy commissioner for BritishColumbia released a report exploring the risk to British Columbiansfrom outsourcing of data across Canada's long border with theUnited States. It concluded that the personal data of Canadianstransferred to the United States is at unique risk of seizurethanks to the USA Patriot Act. It even found that data held inCanada by a subsidiary of a U.S. company could be at risk.

All countries have laws that require disclosure of data fornational security and law enforcement purposes. The United Stateshas long been a beacon of freedom because our laws have been moreprotective of privacy and civil liberties than others.' But, today,Canadians are right to be concerned about the privacy of data theytransfer to the United States because of the USA Patriot Act'sprovisions.

Make no mistake: this issue got where it is because ofopposition to free trade. The British Columbia Government andService Employees' Union brought it forth in a suit to prevent theBritish Columbia government from using a U.S.-linked contractor torun the province's public health insurance program. The union is noaltruistic privacy group.

The problem is: they're right. Thanks to excessiveness in someprovisions of the USA Patriot Act, the United States is reversingits global orientation from a beacon of freedom to the paragon of asurveillance society.

The USA Patriot Act provisions worrying Canada are not scheduledto sunset next year, as some portions of the law are. When Congressreviews the USA Patriot Act, it should consider whether theseprovisions are consistent with American freedom. It should avoidbeing terrorized or sloganeered by our country's national securitybureaucracy. And it should protect not only our civil liberties butalso our role as a world leader in technology and free trade.