Digital Divergence: How Digital Network Technology Threatens both Privacy and Security

The National Constitution Center is hosting an event in Philadelphia on May 10, entitled “Digital Privacy in the 21^st Century.” It features a keynote address from Jeffrey Rosen, the President and CEO of the Center; papers from Jennifer Daskal, Jim Harper, Neil Richards, Christopher Slobogin, and me; and a group discussion on stage with the authors and a moderator, Tom Donnelly, before a live audience. For those deciding whether to make the trip, review the webcast, or read the materials, here is a summary of my paper.

The paper, entitled “Digital Divergence,” makes the argument that digital network technology has in general been bad both for privacy and for security. The technology offers enormous benefits, in the form of smartphones, nifty apps, cloud storage, the Internet of Things, and all the rest. But it also has costs. In the paper, I try to explain how digital network technology has exploded the familiar zero-sum game between privacy and security, causing losses to both values simultaneously. I explore some of the legal changes, statutory and constitutional, that may follow from this.

1. The first part of the paper describes how digital network technology threatens privacy. This ought to be recognizable to most sophisticated readers – it’s the now-familiar narrative of how more and more activities generate digital data records, often held by third parties, that are conveniently available for surveillance and analysis by government. The essential elements of this narrative, and its essential prescription for legal change to restore protections for privacy, find their clearest expression in two recent Supreme Court cases. First, the decision in Riley v. California, which required a warrant to search a smart phone incident to an arrest; and second, the concurrences of five Justices in United States v. Jones, which would require a warrant for any long-term monitoring by technical means of a person’s precise location. This narrative and prescription have been echoed and expanded forcefully by the academic and advocacy communities. If you don’t understand how digital network technology threatens privacy, you haven’t been paying attention.

2. The second part of the paper describes how digital network technology threatens security. This may strike some observers as counter-intuitive, or even ridiculous: isn’t the smart advice, “Don’t Panic” because this is the “golden age” of surveillance? In some ways, certainly yes. But in other ways, I argue, no. The paper identifies several factors that make it harder for the government to conduct surveillance to detect and prevent misconduct, and several others that facilitate misconduct.

The increasing international mobility, anonymity, and geographical indeterminacy of people and data is one big factor: Long gone are the days in which the cooperative, regulated, monopoly AT&T provided landline telephone service to known, paying customers at fixed addresses. Now we have disposable cell phones paid for in cash at a drugstore, foreign and otherwise uncooperative providers of many varieties of free messaging applications, increasing strong encryption, cross-border and fragmented cloud data storage, vastly increased international travel, crypto currencies, and ever-larger haystacks of digital data that tend to obscure the needles.

We also have systems that allow for fraud, theft, sabotage, attacks and covert action at network speed. Some foolish criminals still try to rob banks physically, taking a few thousand dollars and some dye packs or location trackers while being recorded on video, but the smarter ones can move vast amounts of digital money in a nanosecond. They can hack and dox private email and other digital data, and will soon get around to manipulating data in place. They can possibly take over SCADA controllers for industrial equipment or dams. They can cooperate with hostile governments through the increasing public-private marketplaces on the dark web, buying and selling the latest zero-day exploits. And they can do all of this without ever leaving their mother’s basement in Oslo, or a cyber café in Kabul, or perhaps even a redoubt in Syria or the FATA region of Pakistan, reaching to anywhere from anywhere, taking increasing advantage of failed states and other ungoverned areas worldwide.

3. If you’re still with me, you may be puzzled. The traditional, pessimistic view has always been that privacy and security are locked in a zero-sum struggle, in which one value’s gain is inevitably the other’s loss. Sure, there may be a few instances in which optimists can claim a win-win, as I did with respect to lowering the FISA Wall. Those cases aside, however, it’s supposed to be an either-or choice. How can it be that, in general, both privacy and security are suffering simultaneously?

My answer is “digital divergence”: digital network technology has produced at least four pairs of divergent trends—i.e., trends that are related to one another, and share a common origin in the technology, but exert opposite effects. These pairs of opposite trends are in some ways like the two sides of a coin, but they are not static, and indeed are becoming more pronounced over time. This is divergence as the dictionary defines it—“a drawing apart (as of lines extending from a common center).” Here are the four pairs of divergent trends:

• Digital network technology creates more private data of which less is relevant to security. All other things being equal, more private data is bad for privacy, but more irrelevant data—data pertaining to innocent persons—is bad for security because of the haystack effect and other factors.
• Digital network technology encourages both consolidation and fragmentation of data. Consolidation permits wholesale compromise of privacy, as the Supreme Court recognized in Riley and as commercial companies’ data breaches regularly confirm, but fragmentation of data does not reliably protect privacy, in part because of challenges in systematically safeguarding fragmented data from opportunistic compromise.
• Digital network technology has led to greater and lesser cooperation among governments, and between government and the private sector. Western governments have not advanced their formal data-sharing relationships beyond Mutual Legal Assistance Treaties (MLATs), which are valuable but insufficient in a digitally networked world. Some of the most cooperative emerging public-private partnerships are between adversarial foreign governments and black-hat hackers, while U.S. communications providers are generally reducing their cooperation with the U.S. government (which may promote privacy but may also reduce security).
• Above all, digital network technology has allowed greater freedom of choice in the way that end users protect their data privacy. Unfortunately, some of the persons and entities representing the most significant security threats may be among those most willing and able to employ protective measures, while on average the innocent masses may tend to leave themselves exposed.

In the digital realm, the paper argues, privacy depends largely on control over digital data—i.e., the ability of individuals to understand and determine what data concerning them (to, from, or about them) are generated, retained, revealed, acquired by others, and used or manipulated. Correspondingly, security is threatened by the privacy of those who themselves endanger security—their ability to control digital data concerning themselves and their misconduct makes it harder to detect, disrupt, deter, and defend against that misconduct. Digital divergence reveals trends generally favoring control of data by bad actors more than by good ones.

4. What is to be done? Possibly, lots. Building on Riley and Jones, it is easy to imagine (and the academy and advocacy groups have imagined) many legal changes that could enhance protections for privacy. Among them would be expanded warrant requirements for location data, for stored digital data, and/or for data held by third parties. Perhaps also a narrower definition of relatively unprotected “metadata” and a broader definition of protected “contents” of digital information. A restriction of existing authority to search digital data at the border. Limits on compelling providers to assist with decryption. Tougher rules for the government’s use of drone or overhead reconnaissance and surveillance, for collection and use of publicly-available information, for online undercover work or other undisclosed digital participation in organizations. All this, and more, could help restore and protect privacy in the era of digital network technology.

The legal changes favoring security are a little harder to imagine, in part because the narrative establishing the threat to security is less well developed, understood, and accepted. But changes here could include replacement of fragile location-based paradigms for regulating surveillance; expanded authority to obtain digital data stored abroad; more international agreements to supplement existing mutual legal assistance treaties (MLATs); clearer and more robust requirements for “technical assistance” from providers, perhaps including with decryption; expanded governmental access to metadata; and greater cooperation from providers and/or greater regulation of digital networks and networked hardware.

Interestingly, some of these legal changes favoring privacy and security are mutually exclusive, but some may be mutually accommodating. Our challenge, in the months and years ahead, is to find the win-win solutions when we can, and otherwise to strike the best balance available.

5. A few weeks before publication of Edward Snowden’s first leak, I published a series of blog posts discussing the possibility of a “blue sky” overhaul of U.S. surveillance law. I explained both the massive challenges of such an overhaul and the reasons why it might never occur, but also the conditions that might trigger it despite the challenges. Digital network technology has the potential to effect that level of change — not in a single, paroxysmal burst of new law created intentionally by elected officials, but through a rapid and radical transformation of the environment underlying the old law. My paper is an attempt to help us keep up with that transformation, and Digital Privacy in the 21^st Century should be a great opportunity to discuss the issues with some smart commentators.