Case in point: a U.S. House panel approved legislation transferring control of private networks to the state.  H.R. 3674 passed the Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies and was passed to the full Committee on Homeland Security.

Now, those of you who have ever navigated a government website or followed technology news won’t be surprised to hear that Uncle Sam is a wee bit late to the game on really ‘getting’ the gestalt of the InterTubz.  As it stands, cybersecurity largely lies in the hands of private companies, men and women who have no incentive to protect the Web, other than the loss of their life’s work, the decimation of their reputation, the wholesale destruction of their cherished way of life and the systems enabling it, and ungodly sums of money.

Nevertheless, Washington’s consistent theme is that everything is improved when it is both mandatory and centralized.  In that vein, behold PRECISE, a precious acronym for Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness.  This boondoggle would set DHS loose on America’s domestic cybersecurity, charging Janet Napolitano and her troops to create yet another government entity.  The proposed National Information Sharing Organization represents one more blow to spontaneous order; it would seek to coordinate research, communication, technical assistance, and threat response – as if private Web companies have no incentive or competency on their own.

And, yes, there would be lots more information flowing to the government.

Make no mistake, I am not understating the gravity of the devastation caused by a hypothetical major cybersecurity attack.  Nor am I arguing that there aren’t people who would like very much to use the Net to harm American interests.  What I am galled by is the proposal that having the Web’s creators take their lead from Washington is the way to go.

Alright, let’s break down PRECISE.  It, along with the smorgasbord of suggested cybersecurity laws, is the legislative equivalent of South Park’s Underpant Gnomes.  These acts, including PRECISE, suggest lots of lofty, yet extraordinarily vague, ends.  They’re full of language about writing good guidelines within reasonable time and soliciting feedback from relevant experts.  But they don’t spell things out.  When it comes to legislation, this is the very devil.  Giving wiggle room to lawmakers is no smarter, or more ethical, than giving drugs to an addict.

As it stands, the federal government already has a protocol – a very aggressive protocol - it uses to secure its own networks: Einstein.  Under Einstein, the government monitors the online activities and communications of its employees, using algorithmic programs to catch anything that might be an attack and passing that material on for personal scrutiny.  Einstein watches both the ‘flow rate’ of employees’ behavior – such things as time and volume of online activity and to ‘to’ and ‘from’ addresses of e-mails and the content of those communications.

Monitoring flow rate may have some legal precedent defining it as communication with no ‘Reasonable Expectation of Privacy,’ though there is still case to be made that something like the domain name in a sender or recipient address could give away personal information.  Watching the content is another matter, altogether.  Gathering such information requires a technique called ‘Deep Packet Inspection,’ and it means that the content of personal communications are open to government inspection.  Because various agencies of the federal government share information gleaned from Einstein and reserve the right to disclose data to state and local government and law enforcement groups, there is also a grave loss of control over who sees messages not intended for public consumption.

Federal employees arguably agree to a diminished expectation of privacy at work as part of their job and there is something to be said for a higher level of surveillance within the government’s own networks.  Logging on to government network also requires clicking the ‘agree’ button on a banner ad warning that activity and communications are subject to surveillance.  It’s not an outrageous expectation that employees work while at work and use smartphones and private laptops for checking personal messages.

PRECISE, however, leaves open the worrying possibility that Einstein standards of expectation of privacy could become the norm over the entire Web.  The Justice Department’s Office of Legal Counsel has already advised DHS that there is no 4th Amendment violation in doing just that.  Such asinine reasoning goes back to a 1976 Supreme Court ruling that people have no expectation of privacy regarding information divulged to third parties, even if the information was shared with an expectation of trust.  The law recognizes some ‘privileges’, but overwhelming the current precedent is that once you willingly shared something or wrote it down, you have neither 4th nor 5th Amendment protections over the state seizing that communication.

This ‘Third Party Doctrine’ makes no sense in the digital age, and the looming passage of PRECISE is a frightening instance of policy that was dangerous enough when promulgated and far worse now.

For a moment, let’s set aside the other attendant issues; privacy, better ways to spend money, and the contestable reality of a threat that justifies such excesses.  Let’s look at the health question.  These machines stand in open, crowded, and filthy areas.  They get infrequent and, almost certainly, inadequate maintenance.  The people running them don’t even need a high school diploma or basic literacy to get the job.  The scanners lack radiation alarms and, until recently, their operators did not wear dosimeters.

…it now takes an Act of Congress to force the U.S. Government to conduct actual investigation into wantonly showering the populace with radiation.

Right here, we’ve got problems.  Any doctor who so callously exposed her patients to radiation would be stripped of her license.  Any radiation technician who took such shoddy care of the equipment he uses would be fired.  Any hospital that tolerated such carelessness would lose accreditation.  The government justifies such laws on the medical use of radiation based on the inherent danger.  This is the stuff that mutates your cells, turns yours bone into crumbly mush, and inflicts giant ill-tempered lizards on the Orient.

Why then, are we operating under the asinine fallacy that radiation isn’t harmful if we say it’s for security rather than therapy?  Radiation is radiation.  It doesn’t read policy memos and it doesn’t care that Homeland Security sees to be willing away the unstable isotopes.  Whatever alternate universe the politicians are on, here in reality, radiation is a threat and we’re all at higher risk.  Higher risk not just because of the roll-out of scanners at airports, but because of the government’s fetish for adding the things in every public place from sea to shining sea.

Washington tells us it’s all perfectly safe.  They, of course, can’t actually share any of the evidence they swear to possess with us peons, national security and all.  Even were all that tip-top evidence to exist, the outrageous laxity of radioactive machines popping up all around us is a problem.  Simply put, intelligent people aren’t so frivolous to a known carcinogen.

Finally, there may be some movement on the impending irradiation of the Land of the Free.  Principally authored by Susan Collins (R-ME), and with bipartisan sponsorship, the study sign bill would require that DHS contract with an independent lab to test radiation levels.

Last fall, John Pistole, the TSA Administrator who would not rule out cavity searches at airports, finally promised Congress that he would preform just such a study.  Within days, he reneged, saying that DHS’ own private studies concluded there was radiation risk.  That study, naturally, is not available for citizens to review.  TSA officials brazenly insist that no one will get cancer from the ionizing radiation of scanners, an alarming level of certainty with no basis for belief.

Europe has already banned the use of such scanners over radiation concerns.  ProPublica concluded that no peer-reviewed work on the safety of backscatter x-rays has been done and that the TSA may have glossed over safety problems with the machines.  Scientists who have been publicly named by the TSA as supporters of the use of radiation in passenger screening have reacted angrily, accusing the agency of misrepresenting their work for its own agenda.  The National Academy of Science has espoused a linear model of radiation risk, meaning that cancer risk grows over time with increased exposure, finally concluding that no amount of radiation, small as it may be, is entirely safe.

The FDA declined to invoke its power to regulate non-medical use of radiation, opting to rely on the TSA voluntarily seeing to the safety of the machines.  In turn, the TSA ignored the requirement to consider public comment and paid no heed to research that suggested the machines posed a risk.  In short, there exists little data, none of it up to academic snuff.

What this means, boys and girls, is that it now takes an Act of Congress to force the U.S. Government to conduct actual investigation into wantonly showering the populace with radiation.  The level of disregard for citizens this evinces ought to concern us all.

Sen. Collins will introduce her bill soon.  Until then, we may at least hope that, when the radiation turns us all into mutants, our superpowers will be enough to extract a bloody vengeance from Washington.

At the time, some justified leaking Bork’s rental history to the press, and the media’s willingness to publish, on the grounds that Bork had himself not been a terribly strong advocate of privacy.  A move intended to embarrass Bork instead scared Congress, many of whose members no doubt patronized niche video rental stores and had built up truly scandalous rental histories.

In response, we got the 1988 Video Privacy Protection Act, a piece of direct legislation forbidding video renters from disclosing a customer’s checkout history without explicit consent.  At one point, it would have fair to say this was something of a misstep down the road of favoring painfully specific laws over common sense.  Libertarians, such as I, would have said that service providers who sell or give away their customers purchase history would be punished efficiently through market mechanisms.

Things, to put it lightly, are changing.  Our personal information is worth more and more and to ever greater numbers of people – often strangers and discrete data-mining companies.  Technology allows integration of that data to a level inconceivable in the late 80s.  Back then, the fear was that the reading and movie-watching habits of public figures would be publicized to humiliate those people.  Today, the reality is that each and every one of us is a monetized prize; sold, resold, and bundled to the highest bidder.

Enter Netflix.  Streaming movie providers have run up against VPPA before.  In 2008, Blockbuster got into hot water over violating customer privacy via a partnership with FaceBook Beacon.  The next year, Netflix was answering questions over its practice of divulging user data as part of a contest to improve the algorithm by which the company recommends films.  And now, the inevitable is here.  Netflix and FaceBook would like to fully integrate their services, with every film you watch shared with your ‘friends’ for the purpose of fine-tuning movie picks.

Uh-huh.

The problem with the collision of technology and privacy concerns is very much about ostensibly ‘free’ services actually being an exchange of online services for personal information.  Make no mistake, we pay for everything we get one way or another.  That’s fine if it’s an agreement with informed consent.  As well you know if you pay any attention at all to privacy issues, this is a vanishingly rare thing when it comes to social media.

Under VPPA as it stands, Netflix may not be able to legally share that data on an ongoing basis.  More accurately, Netflix is afraid that VPPA doesn’t give it as much protection from angry users as it would like to enjoy.  Obviously, both Netflix and FaceBook would like to share as much data as possible and to do it all as an obscure opt-out, if they can.  To that end, the former company has gone before Congress, asking for a ‘clarification’ of VPPA, along with asking users to urge their Representatives to support that position.  The proposed legislation here is H.R. 2471, which would explicitly make it legal for a company, such as Netflix, to get a one-time consent from a user to share data indefinitely, until that consent is revoked.

Here, again, I make my objection that more and more laws will make some people feel safer, but won’t actually improve the grace with which private data are handled by third parties.  VPPA originally had language banning magazine publishers from disclosing subscriber data, something that fell prey to lobbyists.  Between 1988 and today, the PATRIOT Act has gutted much of heft behind laws we may think protect our privacy.  Why is the answer to the quagmire of legally protected user data yet another law, and an absurdly precise one at that?

On that note, the mere fact that companies with perfectly dreadful privacy records are backing H.R. 2471 ought to raise eyebrows ad questions.  Too, why does a company that has enacted two painful price hikes in the last sixteen months, all while the quality and selection of its offerings decline, now need Washington’s blessing to make more money off the data of people who are already paying customers?

What Netflix is really doing here is pushing for a highly specific law that will render it immune to the complaints of users down the road.  If the extent of Netflix’s planned expansion is to get an informed and explicit consent and then share data only for the purpose of delivering better movie recommendations to users, it’s hard to imagine why they would require federal legislation with such narrow focus.

Patrick Leahy, author of VPPA, described, “an era of interactive television cables, the growth of computer checking and check-out counters, of security systems and telephones, all lodged together in computers….”  That was 1988.  Last week, he neatly summed the problems with HR. 2471; “A one-time check off that has the effect of an all-time surrender of privacy does not seem to me the best course for consumers.”  He’s right.  However, let’s take it a little further.  A law like this comes too close to making peoples’ privacy decisions for them, and flirts with giving Congressional benediction to unethical data-mining.

I go back to my position that people should be their own first privacy guardians.  That means common sense, skepticism, and scrutiny of any bid to share their information ‘for their own good’.  I dislike laws that infantilize consumers, that make dangerous behavior seem harmless with the veneer of legal acceptability, that distort the market.

Netflix wants customers to waive privacy now and forever and just trust that things will turn out hunky-dory.  Yet they want a law essentially guaranteeing they won’t have to answer for their behavior in the future.  To me, that says they anticipate angry customers over the proposed data sharing.  And it says they don’t want to play by the same rules they are suggesting for the rest of us.

Briefly, it’s a radical answer to the onslaught of data-mining.

On the face, this all sounds great.  Of course, major money stands to flow in government coffers for violations, and the state will enjoy daunting new powers to investigate.  One is tempted to wonder if Europeans have gone from corporate frying pan to political fire.  

The phrasing is, right off the bat, worrying.  A ‘Right to be forgotten’ embodies in its very name an obligation on others to do the forgetting.  And that is an entitlement.  Who will be paying for this?  On the surface, it seems that this law delivers a potentially crushing burden to businesses, requiring them to spend more time, money, and effort on getting explicit permission from users, on complying, and on ruthlessly purging data from the length and breadth of their reach.

Hold on a moment, though.  What’s so absurd about an opt-in policy that aims for informed consent?  It costs to be ethical, but that’s no excuse for getting up to hijinks.  One could also say that the new right is more aptly termed a ‘Right to Purge’ or a ‘Right to Reclaim Private Data.’  No doubt, the new EU rules affirm ideas of privacy as a fundamental right, one linked to dignity, reputation, and control over personal information.  Companies might whine – they already do – over all the effort they put into collating and maintaining ‘Personally Identifiable Information’ (PII), insisting they own data about their users.  This has always stunk to me; it’s a bit like a burglar proclaiming he owns your stuff by virtue of all the work and and risk he took on to burgle you.

The flip side of this is, though, an economically unavoidable truth.  Simply, if you aren’t paying for a service, then you are the service.  The tangle of social networks, reward cards, and online services that are “free” are not, and never have been, any such thing.  You pay with all the information they can gather on you.  A world with data purge on demand has the possibility to be a world with a slowed pace of innovation and far fewer free services.

I say it has the possibility because, honestly, no one can say just yet.  Perhaps what people want is the assurance that someone is watching out for them, that they have, at any time, the option to purge their electronic histories.  It might turn out that the belief that companies are acting under the threat of fines and oversight will keep them to the straight and narrow.  Again, it might turn out that people become, on the whole, even more careless about handing out personal information if they assume they can always take it back.  This is a weird new coupling of  market-based self-policing and questionable faith in the state to take care of all things.  Especially from an American mindset a worldview in which the government is the greater threat to privacy.

What if this fear turns out to be well founded?  What if the most insidious companies still maintain data, if governments use the law to gain even more access to data and more control, if the law is a feelgood shield to hide the reality of state surveillance?  It’s already a problem that one of the biggest spenders on gobbling up data is the government, and that holds here and across the pond.  It stands to reason that telling the state to ‘forget’ you won’t be an option.  Equally bothersome, whatever money comes in, legitimate victims of privacy violations won’t see a dime.  That’s ever the case with governments punishing crimes by fining Peter, sending Paul away with a apt on the head, and keeping the money.

In short, it’s easy to see how EU governments will benefit here, but it’s less clear how much this will do for individuals.  One thing, though, does seem predictable.  The U.S. is going to have to respond, one way or another.  The first response has been  tepid.  Washington raised the same points I did – compliance costs, deleterious effect on innovation, the need to create an authority with the power to oversee the goody bag of new protections.  Aside from vague promises of a tip-top policy at some point, that’s it.

In America, the reality is that companies are downright monstrous about letting users, even former users and those who already paid once for services, truly delete data.  In the home of such devilish beasties as Google and FaceBook, this is a major consideration.  Diminished luster and all, America’s answer to the privacy question will have global heft.  Too, after a point, no answer becomes an answer.

Just as I worry the EU, while no doubt having made a mighty stride, will need to balance and refine its new law with some thought to market realities, I fear whatever Washington delivers will fall short in just the opposite direction – kowtowing to data greedy corporations with inadequate thought for us peons.

And what the peons?  Is it, frankly, high time more of us began paying serious attention to what we do with our data?  Could we have just a touch more judgment and foresight?  If we each own our own data, already a prime assumption of privacy-obsessed critters such as myself, then oughtn’t we each to be the first guardians?  Our new reality is a hyperlinked world with an unquenchable thirst for information and a distinct lack of ethical quandaries about getting it.  It’s high time to adapt.

Such as Sonia Sotomayor.

Earlier this week, in U.S. v. Jones, the nine wise souls of Washington ruled – and unanimously at that – that planting a wireless GPS on a man’s car constitutes a search.  Given that the search was carried out sans warrant, the search and the man’s ensuing conviction was thrown out.

All in all, twas a nice surprise in a country that seems to be sliding toward less and less privacy all the time.  The decision was a very narrow one; writing for the Court, Scalia noted that covertly tracking a man’s every movement for nearly a month would violate a reasonable man’s “expectation of privacy.”  That, however, was tempered; as the actions that led to conviction constituted a search and as the search was bad, the entire thing fell apart on Fourth Amendment issues – there was no need to delve into reasonable, subjective expectations of privacy in the case at hand.

What’s interesting is Sotomayor’s concurring opinion, one in which she notes the massive role that electronically conveyed data have come to play and suggests the time has come for a broader re-imagining of what privacy means and how the Fourth Amendment ought to be applied.

As she correctly writes, wise jurisprudence requires preserving the protections inherent in the Fourth at the time it was adopted, at a minimum.  From this, we get, “a Fourth Amendment search occurs when the government violates a subjective expectation of privacy that society recognizes as reasonable.”

The explosion of the cyber age has birthed ways to communicate, ways to store information, and ways to spy that were inconceivable a generation ago, let alone in the 18th century.  While the Founders did not imagine e-mail and cell phones and GPS, they did not approve of the state knowing a citizen’s every communication and movement.

The threat presented by the current situation far exceeds anything previously possible; surveillance has grown so inexpensive and so easy that people who would never have come under intense government scrutiny now face a very real diminished privacy.  The state also suddenly enjoys an ability to conduct surveillance without anyone – the target or potential witnesses – ever knowing, and to aggregate massive databases they might sell, share, and mine for years.

A “reasonable” expectation of privacy will certainly change in the wake of technology, and some have certainly suggested that change will equal a largely passive acceptance of diminished or non-existent privacy.  Such people, though, tend to be ones who stand to gain greatly from just that outcome and who guard their own privacy fiercely.  Sotomayor’s thought are more realistic and, it is devoutly to be wished, more accurate:

I would ask whether people will reasonably expect that their movements will be recorded and aggregated in a manner that enables the Government to ascertain , more or less at will, their political and religious beliefs, sexual habits, and so on.

At risk with technology’s continued growth and without a corresponding check of the state’s ability to misuse it, is a chilling effect, citizens’ behavior conditioned by a fear that any number of government agencies could be watching or listening at any time, that anything in their past might be known to the state, and that they will never be sure.

This fear leads Sotomayor to make the most audacious suggestion in  her opinion; that the time has come to reconsider denying any expectation of privacy when someone has divulged information to a third party.  Coming from any federal government employee at all, let alone an appointee of someone like Barack Obama, this is startling – in a great way.

In the past, the government has argued that having shared information with any third party at all destroys the ability to later claim an invasion of privacy or to assert a right against self-incrimination.  Were it not for the various privileges, we’d be in an even worse spot.  However, the reality is that each of us shares sensitive information with all kinds of people and companies in the course of our day-to-day lives.

We provide medical histories in order to receive care, sign off on background checks so that we might get job offers, and implicitly consent to Internet and phone providers logging details of our usage.  We unburden ourselves to close friends, share financial information with tax preparers, and generate rafts of intimate details whenever we are a client, patient, user, applicant, or student.   That does not at all mean anyone of us would like such material to be available to the wide world, or to the government for its leisured perusal.  It certainly does not mean we’d be comfortable with the government aggregating every existing source to paint rich portraits of our personal lives and use them at their discretion.

In short, absolute secrecy should not be a legal prerequisite to recognize that someone has displayed a subjective, and reasonable, expectation of privacy.

Sotomayor now looks to be a key fifth vote on potential future cases impacting privacy.  Her concurrence in Jones is certainly a bright spot in an atmosphere where abuses of technology race ahead of law and policy.

Across the pond, its football players, shadows ministers, and drunk Windsors, but the same theory applies.  The recent kerfuffle over widespread phone hacking has focused keen eyes on British tabloid and their excesses.  Which has led to the Levenson Inquiry on Press Standards (why start now, say I).  Editors of ‘celebrity magazines’ have apparently been receptive, coldly as that may be, to the Inquiry’s idea that a ‘Privacy List’ be established, on which the famous who do not wish to be photographed might enroll.

Hmmmm.

It seems that the U.K.’s motley crew of sensationalist papers have their own  board, and they (sometimes) abide by the rules of something called the Press Complaints Commission (PCC).  The PCC is itself a nascent creation, brought about last summer in the wake of the News of the World scandal.  Now, to my American mind, the British (nay, the European) attitude toward celebrity privacy is, at times, goofy.  If you don’t want to be famous, you don’t need to be.  Wash your soiled linen in private, keep your own counsel, and behave yourself in public.  If those of us with personal entourages can manage it, so can you, darling.

Be that as it may, I will also admit journalists are, not infrequently, vicious.  But what is noteworthy here is that the action that so incensed people involved hacking into the phone of a dead girl and, by showing activity on her voicemail, leading police and her family to falsely believe she was alive.  Why is it that fallout of such horrific intrusion on private citizens is being met with chatter about how better to suit the whims of celebrities?

Overall, the U.S., in law and in culture, gives a lower expectation of privacy to the famous; the reasoning being that people can hardly expect to selectively refute the trappings of a life they chose.  Americans see the major threat to privacy as the government and tend to give shorter shrift to starlets who willingly live in public and then attempt to take back the past only as it becomes inconvenient.  Perhaps this is a noble expression of our expectation that you ought to have some dignity in public and that you are the first person responsible for your reputation.  Or perhaps it is a justification of our deep appetite to bathe in reflected starlight and see our demigods brutally knocked to earth.

Contrarily, Europe sees government as a protector of privacy, privacy that is at gravest threat from the people around you.  Accordingly, those with a higher likelihood of coming under media attention have a higher expectation of privacy.  Sensible application of theory or still-extant vestige of Ancien Regime reverence for the cultural elite?

Back to something that might be addressed at less than book-length:-what will happen if celebrity magazines agree to abide by a ‘Privacy List’?

We might spend the entire day with questions of the state creating a privileged class and effectively legislating what citizens might be interested in.  Let’s not.  The British state does not consider truth as a defense against slander or libel – giving rise to ‘libel tourism’ –  and still censors films.  We may assume for the current article that there is an appetite to restrict press freedoms.  However, it does bear pointing out that the only reason tabloids are at all willing to discuss self-regulation is a bid to head off that very threat of government oversight.

First, tabloids sell because human nature is voyeuristic and often prurient.  A so-called ‘Privacy List’ is more apt to trigger black market broadsheets full of uncredited photos and scoops than to achieve its stated aim.  The truly gossip obsessed are not going to pay with their dollars or their eyes for a publicist-vetted puff piece about whatever that happened three days ago.  Also, given how many celebrities do conduct themselves, only publishing verifiable misbehavior is not going to do anyone’s reputation any favors.

On the other side, huge swathes of material in the glitzier publications is already done in close agreement with the celebrities featured.  Might this proposed List really only be formalizing a tacit agreement?  Then again, if the beautiful people are already hand-in-hand with the tabloids and are still getting bad press, they’re bad businessmen, pure and simple.  The solution to unfavorable news ought to be a better publicist before seeking new law.

Heck, is the proposal anything other than a flimsy way for both journalists and politicians to be seen to be doing something?  If this itself a choreographed media ploy being played out for the benefit of credulous citizens?

Second, how sound an idea is it to sponsor a culture where a blind eye is turned to poor conduct, provided those involved enjoy sufficient fame?  What on earth will this do to a generation of celebrity-addled kiddies looking to these ill-bred people as roll models?  Be that as it may, why is it the media’s task to provide positive roll models?  Might we expect at least some children to understand that intoxicated, indolent, and indicted is no way to go through life?

Ultimately, do we not punish the tacky and the gauche with shunning and shaming?  Do we not hold the right to refuse to interact with people we find ill-mannered?  Dare we still hope for policy makers who are wise enough not to legislate what is best left to culture?

Similarly, is  this something that would effectively allow a certain set of people to seek out and revel in attention when it suited them and to forbid anyone from looking when it did not?  Is it right to allow the fame hungry to play that game?  How complicit are celebrities in having fostered a tabloid culture that has utterly no boundaries?

This is, perhaps, hinging on the difference between respect, the simple decision not to intrude upon another’s private life, and deference, allowing another person to command your attention one moment and send you scurrying away the next.

Too, we are right in asking how it comes to be that existing laws were insufficient.  Between trespassing, harassment, stalking, tortious privacy claims, interfering in police investigations, and so on, it’s staggering that the state lacks the means to deal with actions that do represent actionable irresponsibility on the part of the press.

This trend is, in my opinion, unlikely to wash up on American shores.  Here, the press enjoys broader freedoms.  Nor has our Fourth Estate, yet, plumbed the tawdry depths of British tabloids.  The American worry, I would caution, is a government that withholds, censors, and denies the existence of information regarding its own activities.  That, sadly, presents a much tougher fight.

Yes, that alone should have you sweating bullets.

Worse yet, the woman, Ramona Fricosu, has only been immunized for the act of producing the material, not for anything that might be found.  The courts openly sought to force her to produce incriminating evidence and a judge smiled on that idea.

Legal types can (and likely, will) go on ad infinitum about the precise wording of the ruling and the meaning of every last comma.  I myself indulged in a little when the case’s decision was still imminent.  Fricosu may have held there are case-specific facts that make the defendant’s Fifth Amendment claim legally invalid, but this is not a good sign that future cases will

Hair splitting sophistry aside, this realistically is a sign the government is no longer even pretending not to be waging war on privacy.  Anyone with regard for their personal life is now going to need to go much further than merely encrypting a drive – and encrypting an entire computer is not a ‘nothing’ step toward describing privacy.

The usual rejoinder from naive sorts convinced the state never spies on ‘good’ people and from the state itself is the tired old ‘If you’ve done nothing wrong, you’ve got nothing to hide’ trope.  Indeed, that’s just what the U.S. Attorney’s office implied in applying for Fricosu’s compelled decryption, explicitly saying that allowing the woman to decline to decrypt her computer would set a precedent allowing terrorists, child rapists, and other assorted creeps to get away with anything; and implicitly stating that the only people who ever actually try to protect their privacy must be nefarious and reprehensible.

Directions for seeking compelled decryption came from D.C., a clear signal that this was never a standard procedure undertaken in Denver; this case always represented the opportunity for the state to move one step closer to rendering any encryption and data protection available to civilians utterly moot.  Anyone who has followed the tenor of civil rights and privacy since 9/11 won’t be surprised.  On all things related to how far the government can go in surveilling tax payers, Bush felt, and Obama feels, that nothing is too far.

Already, we are operating in a theater where ISP providers must save user records for longer and longer spans; where many of the companies that hold your data will turn it over to the state on request, rather than requiring a subpoena or warrant; and where the government openly seeks to require that any encryption technologies have backdoors for the government.

We are told the awesome privilege of snooping through the most personal papers of 300-some-million Americans will be available only to those who ‘need’ it and will be used sparingly.  However, that the state is willing to trample on the Bill of Rights itself to prosecute what is, in the end, a minor criminal trial – nothing at all to do with the twin stand-bys of terrorism and child predation -should tell us very differently.

Savvy types have already thought through the implications of how someone could retain a meaningful Fifth Amendment claim in the face of courts who clearly see that right as an inconvenience, but no one tuned in to this debate thinks the trend is anywhere other than toward decreasing privacy and, thus, decreasing privacy, which ultimately means decreasing freedom.

(UPDATE: The TSOs at Dallas Fort-Worth apparently don’t recognize a .38 handgun, as they let one through in a passenger’s carry-on bag earlier today.  Well, done, lads.  Tell me again about how all the intrusion is justified because you catch banned items.)

As some of you may have seen, last November, two women, both in their eighties, went public with separate complaints that America’s security aces had strip searched them.  The TSA and its parent, the Department of Homeland Security, denied everything without denying anything, falling back on the meaningless insistence that ‘all policies had been followed.’

Today, DHS is now admitting that the strip searches they still deny happened were wrong and that the policies may or may not have been followed after all.  Betsy Markey, former public irritant to the citizens of the 4th District, is now doing nothing good as an Assistant Secretary at DHS.  She admits that both women were forced to allow their medical devices, a defribrillator in one case and a colostomy bag in the other, to be searched and concedes that such is “ not standard operating procedure.”

What this means, naturally, is that TSOs are getting nothing more severe than “refresher training” on respectful treatment of passengers, a statement the seems to indicate Homeland Security thinks recognizing human dignity is a minor thing that one might understandably forget.

More worrying still is the wording of Markey’s ‘apology’ to the two women.  On behalf of the TSA, she “sincerely regrets any discomfort or inconvenience the passengers at JFK experienced.”  Think about what this says.  It’s not as admission that what the TSOs did was objectively wrong, that it was cruel and unnecessary and grotesque, that it furthered no legitimate goal, that it violates a reasonable expectation of privacy.  Rather, it is a pseudo-apology along the line of what adults say to whining children in order to quiet them down, a sort of well-I-am-sorry-you-feel-that-way-but-I-am-not-going-to-listen-or-negotiate tactic.

This is old hat from Washington.  Not only do America’s soi-dissant guardians never admit they have violated the right to privacy; they never admit such an right exists at all.

It is not really an apology an all; it is the insistence that neither woman, nor indeed anyone violated by TSA overreaches, is legitimately in the morally ascendant position.  Markey’s statement is more properly seen as an assertion that she and her ilk are beyond reproach and cannot help the way some people might feel about doing their bit to fight those pesky terrorists.  At its core, Markey’s blather and the entire rhetoric of the DHS/TSA keeps telling us there is nothing wrong with the burgeoning surveillance state; it’s all our fault for clinging to excessive ideas of privacy and for stupidly failing to appreciate the gravity of the the terrorist threat.

Yet again, we are treated as children – and not as very clever or well-liked children, at that.  Neatly derived from such a position is the conclusion that, as travelers invariably overreact to vital security measures, nothing the TSA does might be seen as what it really is: abuse of power.  Taking the kindest possible interpretation, TSOs are woefully unqualified people  being given discretion and latitude they are hopelessly unequal to discharging rightly.  Perhaps some TSOs are in this camp.  However, it is undeniably that more than a few TSOs use the infliction of humiliation as a source of psychological (and perhaps sexual) gratification.

At the level of individual airport workers, this is a petty and vindictive assault on the dignity of their fellow citizens.  At the level of the government formulating, executing, and apologizing for the policies in play, it is a frightening voyage into the Panopticon, once we may not be able to come back from easily, if at all.

The official reason is benign.  They always are.  PM 557 is an omnibus medical bill, with the offending provision buried, much like indefinite detention without trial got buried in the NDAA.  It was also passes as a recess bill while Parliament was on its Christmas holiday, much as the United States is now doing with naming heads of various agencies.

On the surface, this intrusion of Kafka-esque proportions is to reduce Brazil’s high maternal mortality rate.  Pish-tosh, of course.  This is nonsense of the first degree.  Brazil’s problem is a lack of access to quality medical care.  Creating a database isn’t going to make a nonce of difference in that.  Brazil has a shortage of quality prenatal care and a dearth of care providers with any meaningful training on OB/GYN; they lack the resources to address medical emergencies that develop in labor ad delivery and they cannot even guarantee women going into labor will find a bed in a hospital.

If anything, spending precious time and resources on what is both bureaucratic make-work and a frightening privacy violation will diminish what little is available to spend on taking care of pregnant women.  This is just the sort of thing that lessens freedoms, erodes civil liberty, and accomplishes nothing good – while furthering the idea that the state ought to be balls-deep in the medical decisions of citizens.

So, what the hell is going on here.  Brazil is a Catholic country.  Secular or not in name, the Church exercises great political power and is largely responsible for the current President getting to be President.  Why such an alliance would be obsessively interested in knowing the instant a woman is aware of her own pregnancy, I leave to the reader’s imagination.

On the policy front, what will this mean for Brazil’s women?  The legislature does not meet again until March, at which point they could take up PM 557 and possibly alter the wording or override the problematic clauses.  Until then, are women going to register pregnancies?  Will women who don’t do so be fined?

Let us, for a moment, assume this is upheld.  Will women be denied any prenatal care or hospital delivery if they did not register their pregnancy?  Will gynecologists be compelled to share records of which patients show signs of having delivered a child so that the state may cross-check with records?

Might Brazil see women who are scared to share news of their pregnancy with friends and family lest someone turn them in?  Are women of child-bearing age who have not reported any pregnancies to be hunted down and questioned?  Will store require identification to buy orange juice and vitamin supplements?

It does seem women could be scared off of seeking whatever medical care might be available.  A spike is home births and women preferring to see traditional care providers might be a boon for some.  But it will also certainly deprive high-risk expectant mothers who ought to be under the care of a physician from seeking that out.

In short, it hardly seems that this new law will help pregnant women.  Nor does it seem like it takes a genius to figure that out.  So, I ask again, what is Brazil really doing here?

The facts, briefly, are these. A woman’s laptop was confiscated pursuant to a warrant by police as part of a fraud investigation. It was, though, fully encrypted at the time, leaving the state unable to execute a second warrant to search its contents. The state is asking for an order, an Application under the All Writ’s Act (as opposed to a milquetoast old subpoena) compelling the woman, already under indictment, to decrypt her computer; she is claiming the 5th Amendment protects here from doing so. A decision could come any day

I know. It’s so exciting. Actually, given where this country is going on privacy rights, it’s so terrifying.

Anyway…

Alright, so, some background. First, you need to to know about Boucher, a 2007 case out of Vermont that essentially asked whether an individual may refuse to provide a passphrase to an encrypted electronic device on the grounds of the 5th Amendment.

OK, first, a brief background to the background. Encrypting a device is substantially different from just taking advantage of the password option to log in. Yes, you should totally do that, but it’s only going to keep out prying roommates and third-rate script-kiddies. In the hands of a forensic professional with time on his side, your little rinky-dink user password is worthless.

Encryption, on the other hand, makes it much harder to get access to whatever is protected. Choose a sufficiently difficult key and passphrase, and it becomes effectively impossible to break into your stuff. It’s possible to encrypt files, volumes, whole drives, and entire operating systems. Once the OS is encrypted, even booting from a disk or swapping your hard drive into another machine won’t allow access.

Contrary to the Hollywood image of slick government hackers who can bypass any system with a modicum of effort, getting into an encrypted OS within the lifespan of the universe requires the passphrase.  Hence Washington’s eagerness to gain the dubious ‘right’ to compel citizens to give up passphrases.

Alright, back to Boucher, but oh-so-briefly. You can read the full details at the link. Sebastien Boucher was arrested and his laptop confiscated for illegal material two ICE agents saw on it during an inspection at the US-Canada border. However, the government turned the machine off and couldn’t re-gain access to the illicit material without knowing the encryption passphrase. They issued a subpoena to compel that the passphrase be turned over, having already got a warrant for the contents of the drive, and Boucher claimed the Fifth. He won the first round but was ultimately defeated when the District Court found for the state

In Boucher, the defendant lost on a specific area of Fifth Amendment law called Act of Production. Basically, to claim Act of Production under the 5th Amendment means you are refusing to turn over something because merely producing it would prove that said documents exists, prove that you have custody of and access to the documents, and would authenticate them. Thus, even producing the documents in question is testimonial and incriminatory.

It’s this kind of stuff the differentiates policy from law.  One considers ideas and moral precepts.  The other is maddeningly hair-splitting.  Is a passphrase more like a key or a safe combination?  Is there a meaningful difference between compelling someone turn over the passphrase and compelling them to enter the passphrase and then surrender the computer?  And so on.

Additionally, when the government appealed the intial Boucher ruling, they amended a key part of their subpoena. At first, they wanted to compel Boucher to turn over his passphrase. On appeal, they amended the subpoena to ask only for the decrypted contents of the drive, even if that meant allowing Boucher to type in his passphrase while no one was looking instead of actually communicating the phrase to the state. It worked. After three years, Boucher gave up the passphrase and was subsequently convicted.

Back in Colorado, the current defendant, Ramonda Fricosu, is also claiming Act of Production and the state is hoping that what worked in Vermont will work here. They’re making the same counter-argument in Fricosu that worked in Boucher – invoking the Foregone Conclusion doctrine by arguing that they know so much about the drive’s contents that Fricosu would not be adding to their case by turning over the decrypted contents.

Now, the intelligent lay person would ask why the state needs to see the drive’s contents if they can’t add anything to the pending case.  However, those of you who know (or might happen to be) lawyers know that as soon as an attorney starts arguing something has no legal value yet he still wants to court to hand it to him, something nasty is in the wings.

In a nutshell, if nothing Fricosu might give to the state by decrypting the computer would be new, then it’s not testimonial and if it’s not testimonial, then there is no 5th Amendment issue and no privilege. Colorado is also perhaps hoping to learn from Vermont in that they have said from the beginning they have no problem with allowing Fricosu to type in her passphrase with no one looking before turning the computer over to a forensic specialist.

(The reason this is a point worth arguing over is that the encrypted contents have no 5^th Amendment privilege as they aren’t testimonial and were created voluntarily. It’s the act of providing access that might be privileged and the state is arguing that if Friscosu never actually shares the access code, only turns over the contents in a newly readable format, then no privilege was violated at all. Yes, of course it’s sophist nonsense.)

For the Obama administration, a cabal that is, at this point, not even pretending to care about privacy, this case is a big deal. Colorado specifically sought out Washington’s approval to pursue the plan to compel Fricosu’s compliance. No less a figure than Lanny Breuer, Assistant Attorney General for the United States, personally approved the request from U.S. Attorney for Colorado John Walsh. One day after Breuer’s approval came through, Walsh’s office asked the District Court of Colorado to order Fricosu to decrypt her computer. Six months later – faster than light when one considers the speed of the U.S. judiciary – we are expecting a ruling from Judge Robert Blackburn.

Regardless of who wins this round, an appeal really is a foregone conclusion. SCOTUS declined to hear Boucher so there is some precedent yet to be set.  And, let’s not be conspiratorial, but it is interesting that D.C. is being kept in the loop on this from day one.

Well, has the state got a case?

Writing for the state is Assistant U.S. Attorney Patricia Davis, who, suffice to say, is not on PPC’s Christmas card list. My favorite part of her brief was where she preciously insisted that breaking into the laptop, “…if it is possible at all, would require significant resources and may harm the Subject Computer.” While that is true enough, the government claiming to be all of a sudden concerned that they might damage a citizens’ property in the course of governing is the worst sort of offensive blather.

The government has sought to compel decryption under the diabolically vague All Writ’s Act, more or less arguing they can compel decryption so long as they claim such authority is an implied power of the judiciary. What’s really going on in Fricosu is an extension of the Boucher battle over Act of Production, itself a cheap game to deny defendants protection against self-incrimination without actually admitting to it.

The state has staked its ground. On the other side, EFF, in an amicus curie brief, points out that the state’s own words; there is, “a very high likelihood of containing evidence pertaining to the charged crimes,” is inadequate to meet the foregone conclusion doctrine’s burden.  For one thing, if you had carte blanche to go through anyone’s laptop, there is a ‘high likelihood’ you’d find something embarrassing if not illegal.

Specifically, another court decision, Hubbell, requires the state to be able to describe what they want with “particularity” if a defendant or witness is to be compelled to produce incriminating evidence. Does the state have a circumstantial case? Yes, they do. Ought the Bill of Rights be able to stand up to the legal jargon equivalent of “damned if we know what there is, but we want to see it”?

Another aspect of invoking AoP is also at play here: authenticity. Davis argues that, “…her [Fricosu's] act of producing [the computer contents] arguably has evidentiary value to authenticate the items.” Here the state’s claim is that they needs the contents, and needs them authenticated by Fricosu’s act of accessing then. Blithely sidestepped is whether or not decryption would also be incriminatory.

Davis however is out to prove that it’s not just economists who can contradict themselves in the same paper. Two pages later, we are reminded that, “[o]nly when an “act of production” explicitly or implicitly communicates facts or information otherwise protected by the Fifth Amendment privilege against testimonial self-incrimination – for example, if the existence and location of subpoenaed records are unknown to the Government, or where the mere act of production would authenticate the records – does the act of production fall within the scope and protection of the defendant’s Fifth Amendment privilege” (emphasis added).

This is from the second Boucher decision, the one that found for the state. In Boucher, the court held that the defendant’s prior behavior – allowing government agents to browse his computer, telling them what drive his images were in, and admitting laptop was his – made it impossible for him to latter claim he hadn’t made the computer’s contents known the the state and authenticated them. Davis is citing this approvingly, never mind what she said a few paragraphs earlier. Either the state needs the authenticated and decrypted drive contents for evidentary value and thus dismisses any issue that the same act of production is testimonial and/or incriminatory; or the state concedes that Fricosu has a legitimate 5th Amendment claim as producing the documents would authenticate them.

Don’t, however, stop here. Davis didn’t. One page later, we see, “The Boucher Court noted, however, that the Government could not make use of the target’s act of production to authenticate the unencrypted drive or its contents” (emphasis added).

Yes, dear readers, the great and sovereign state of Colorado seems to have just admitted that they know they can’t legally use Fricosu’s decryption of the drive to authenticate it despite having just based their argument for compelling the passphrase on the need to authenticate the damn thing.

So, to recap, the state has already contradicted itself by first saying it needs Fricosu to decrypt the drive in order to authenticate its contents and then approvingly citing precedent that the 5th Amendment holds if the mere act of providing something would authenticate it before admitting they actually can’t legally use Fricosu’s potential decryption to authenticate the drive or its contents.

In her response to the state’s application, Fricosu and her counsel make many of the same criticisms while also pointing out that the highly sought information – a passphrase – exists only in the defendant’s head.  There already exists, under Curcio, precedent that courts may not compel disclosure of the contents of someone’s mind.  At stake here is the sickeningly real possibility that something as intimate and seemingly sacrosanct as our own thoughts and memories are to be subject to warrants and subpoenas and the goddamn All Writ’s Act.  Are Constitutional protections now going to be trimmed down with each new advance in technology?

And what of whatever immunity Fricosu might get?  The state has been coy about what’s on the table.  But it’s almost certainly not going to be much.  The immunity that gets trotted out on every courtroom drama is Transactional Immunity.  Compelled testimony usually gets the far less expansive Use and Derivative Use Immunity, a guarantee that what you gave up under compulsion and whatever is derived from that won’t be sued against use.  Use and Derivative Use, however, by no means precludes facing charges on other evidence, perhaps itself compelled from someone else.  Nor does it mean you’ll even get that much.  In Hubbell, the court tried to bring criminal charges using evidence the defendant had turned over, arguing that the immunity was for turning over documents, not for anything found in the actual documents.  That trick didn’t work, but prosecutors still aren’t above trying it again.

In legal circles, finding oneself in this predicament is term the “cruel trilemma”: you will either self-incriminate, perjure yourself, or commit contempt of court.  How’d ya like them apples?

Defendants and witnesses left in such a position might, obviously, prefer not to take a watered down immunity and instead invoke the 5th across the broad.  While it’s a lovely idea, Kastiger allows the courts to offer Use and Derivative Use Immunity whether or not someone wants it and compel testimony, having made the 5th Amendment moot by taking the legal threat off the table to a certain extent.  Civil rights advocates have certainly argued that the value people lose when their 5th Amendment rights vanish  is rarely ever matched by the immunity they get; they’ve also argued that the Bill of Rights is not something the state may now give, now take away, now replace with a poor consolation prize of its choosing.  To date, though, the decision stands.

Fricosu’s response also gets in on the sophistry, pointing our that the warrant allowed the states the search the computer’s hard drive, which they have done.  Nowhere did the warrant say they had a right to search it to any extent or that Fricosu was compelled to assist in any way.  In part, if the state truly wants us to pretend that bullying a passphrase out of someone and subsequently going through their private files are entirely distinct acts, I suppose this is what they’ll get in return.  Do any of us truly want to be under the jurisdiction of people who maintain a straight face while holding forth on such hair splitting facts?

If any of this is a joke, then the state, responding to the response, didn’t get it.  They argue that having a warrant to search a computer implies full access, however they must get it.  There is a certain one-sidedness is holding that the state’s privileges have implied power while citizens’ rights, as in the case of supposed protection against self-incrimination so convoluted as to be useless, don’t.

When the Fricosu decision comes, an appeal is more or less a given.  Obama wants the case to go further as he’d very like a precedent that the 5th Amendment provides no protection against turning over incriminatory, encrypted documents.  And that is a blood-chilling idea.