07 June 2013

Constraining the NSA with Deweyan "Expansive Privacy"

I can't say that I'm surprised about the NSA revelations. Pissed, yes, but when they have to build a new power plant in your area to power the NSA data center that I go past on the way to work every day, you know there's a lot of data being collected.

The constitutional implications of this are undoubtedly alarming. Some are arguing that this is a massive constitutional overreach, a total disregard of the Fourth Amendment. I'm worried that their wrong, though. I'm worried that NSA has simply embraced the logical implications of relying on pre-Internet privacy concepts to govern data, with the consequence that they've broken the Fourth Amendment's protections for the political process altogether. But I think John Dewey can fix it. In part because Dewey can fix anything, but mostly because his concept of the public-private distinction adapts well to the kinds of communication at the heart of the NSA mess.

Note: What follows is really speculative and not really researched. I'm relying on memory of past work, especially on the Dewey stuff. If you see anything really inane in this please bring it to my attention now before I shoot myself in the ass in a venue that is less speculative.

The Fourth Amendment establishes the fundamental constitutional constraints on the collection of data by the government, establishing that "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated." In practice this has been held primarily to apply to criminal justice matters; it was not explicitly an issue, for instance, in the controversy over the data collected by the US Census Bureau even when that collection was challenged as intrusive. With regard to searches, the operational standard established in Katz v. United States (1967) is that a search has occurred when there is a reasonable expectation of privacy with regard to the object of the search.

Therein lies the problem with regard to NSA collect of both telephone metadata and PRISM data. There is no reasonable expectation of privacy with regard to telephone metadata because that metadata must be shared with the service provider to make the telephone call. The same is true of packet metadata in Internet communications. In the case of PRISM data, the expectation of privacy is even less reasonable. This is information that we are deliberately sharing with others, at the least intentionally sharing with the service provider (as opposed to incidentally, as in the case of metadata) and quite often sharing it with the service provider for the purpose of sharing with other users of the service. And in both cases, a reasonably well informed person should know that the service providers are using the data for their own purposes as well as ours. An expectation of privacy is (at least in the empirical sense, i.e., that the data will be treated as private regardless of one's expectation of whether it ought to be) entirely unreasonable. Far from an abrogation of constitutional principles, the NSA revelations should be seen as the logical conclusion of our existing understanding of what constitutes an unreasonable search.

Yet something doesn't sit right about this. Senate Majority Leader Harry Reid's advice that "Everyone should just calm down and understand this isn't anything that is brand new" was treated not as the stately voice of reason but as the imperious voice of deception, and rightly so. The constant criticism of Facebook for violating its users privacy is but one of the more prominent examples of a broad concern with abuse of the data users give service providers. While it is analytically unreasonable to see a Facebook status update that is restricted to one's friends as private, I think it unrealistic to say that society is unprepared to see such an expectation as such, and it is society's willingness to accept the reasonableness of the expectation rather than a lawyer's or academic's analysis that is the standard established in Katz.

Even if society were unwilling to accept this expectation of privacy as reasonable (and the criticism of millenials as prone to oversharing via social media suggests that at least some members of society are), taking the Katz standard to its apparent conclusion makes the Fourth Amendment essentially useless. The overarching purpose of our protections against unreasonable searches is to protect political participation from abuse of the criminal process by the state. If a police officer must show probable cause before searching the home of a government critic, then the government can't use the police to silence criticism by fishing for trivial crimes. But if the major means of communication and document storage are no longer private, the Fourth Amendment can't do that.

So what is needed is some way of rethinking when we have been searched that is meaningful for electtronic communication and data storage. One consideration that I've seen mentioned (but not substantiated) in this debate is the idea that a search doesn't take place until the data is queried rather than when it is collected, implied by the procedures outlined in Director of National Intelligence James Clapper's statement. I don't think this is adequate. A constitutional provision prohibiting unreasonable searches works to protect participation not only by keeping the police from acting beyond their authority but also by making sure the people know this. When potential participants know that the data is there waiting to be queried, that's likely to have a chilling effect on participation (especially when they are also aware that the court protecting their data from being queried didn't reject a single request last year). The data collection establishes a disciplinary process that keeps citizens within the bounds of criticism that the state is willing to permit.

My thought is instead to look to John Dewey's understanding of the public-private separation. Traditionally that's been seen as a categorical distinction: either something is entirely public or entirely private, with the categorization based on the subject matter. Dewey, though, rethought that in The Public and Its Problems. For him, the private was the realm of action in which only the participants experienced the consequences of the action; once the consequences went beyond the participants the matter was public: the distinction was not substantive but pragmatic (in the technical sense of connected to actions and their consequences).

That breaks down the categorical aspects of the distinction as well. Actors can bring the affected third-parties into the action, for example by allowing them to participate in its development or by compensating them for the effects of their action. This in some sense privatizes the action by eliminating third-parties; everyone affected is a participant, and no one outside the action has any standing to seek the intervention of the state (assuming, of course, that the incorporated parties have no reason to challenge the terms of their inclusion). This essentially creates a kind of "limited publicity": matters in which some but not all members of society have a right to participate based on the consequences of the action of them. And the counterpart of limited publicity is a notion of "expanded privacy." Once all of those members are participating fairly, the matter is private with regard to other members of society. Those other members would have no right to participate in the action. Action is thus public with regard to those who suffer its consequences and private beyond that point.

I think this gives us leverage on why the data collected by NSA appears simultaneously public and private. Ultimately my status update is a communication between me and the friends I include in its privacy settings. (No, boss, you don't see all of my posts even though you friended me. Live with it.) Facebook delivers that communication and as such is part of the process; my update is public with regard to Facebook. But beyond Facebook and my friends list, that communication is private. I have a reasonable expectation that it will not, as Helen Nissenbaum argues, be used out of the context in which it was communicated, for example as an endorsement of some advertisers's product. Such a realm of privacy would almost always exclude the state, protecting citizens from the mess that the return of the imperial presidency has created.

No comments:

Post a Comment