Source: https://www.yalelawjournal.org/review/privacys-trust-gap-a-review
Timestamp: 2019-04-18 17:26:27+00:00

Document:
author. Neil Richards is Thomas and Karole Green Professor of Law, Washington University School of Law; Affiliate Scholar, The Center for Internet and Society at Stanford Law School; and Affiliated Fellow, Yale Information Society Project. Woodrow Hartzog is Starnes Professor of Law, Samford University’s Cumberland School of Law; and Affiliate Scholar, The Center for Internet and Society at Stanford Law School. For helpful suggestions and conversations, we would like to thank Frederik Borgesius, Brannon Denning, and Evan Selinger. We are especially indebted to Nico van Eijk, whose invitation for us to participate in the 2015 Amsterdam Privacy Conference at the Institute for Information Law (IViR) at the University of Amsterdam was the genesis of this Book Review.
It can be easy to get depressed about the state of privacy these days. In an age of networked digital information, many of us feel disempowered by the various governments, companies, and criminals trying to peer into our lives to collect our digital data trails.1 When so much is in flux, the way we think about an issue matters a great deal. Yet while new technologies abound, our ideas and thinking—as well as our laws—have lagged in grappling with the new problems raised by the digital revolution.
Reading between the lines in the debate over surveillance and data collection, it is easy to think that protecting privacy is all on you. Most privacy discussion is framed in individualistic terms. For example, we talk about an individual’s “right to privacy” and whether that individual right has any meaning any more. Policymakers fight for a person’s “individual control” over personal information. Companies promise to give consumers “personal choice” to empower their personal preferences about how their information is collected, used, and shared. It is as though we are all islands, each waiting to exercise our individual ability to protect our privacy against those who would surveil us, whether they are private companies or government agents.
Thinking of privacy as an issue of personal choice, preferences, and responsibility has powerful appeal. It resonates with American ideals of individualism, democracy, and consumerism. It flatters our sense of autonomy and accommodates our diverse notions of privacy and preferences for disclosure. For instance, you might not want to broadcast the details of your life on Instagram or Snapchat, but others might. Individualistic notions of privacy lead us to favor solutions that help us choose and put us in control of our own unique lives.
Yet there is a problem with this view of the digital world, and it is a problem of power. In the digital economy, the real power is not held by individual consumers and citizens using their smartphones and laptops to navigate the twists and turns of their lives, but by the large government and corporate entities who monitor them. The digital consumer is not like the classic American myth of the cowboy, a rugged and resilient island of autonomy set against the backdrop of the digital frontier. On the contrary, she is increasingly disempowered, marginalized, and subject to monitoring and sorting by powerful institutions about whose existence she may not know, and whose activities she may not be able to resist. In the digital world, we may heap responsibility on individual users of technology, but they lack options for protecting themselves.2 This is another form of the “digital divide”—it is not merely that some people have access to technology while others do not, but that most people are vastly less powerful than the government and corporate institutions that create and control digital technologies and the personal data on which those technologies run.
More fundamentally, however, pragmatism will not be enough if the conceptual foundation for protecting our privacy is deficient. In talking about the foundation for a privacy revolution, we can do better than making incremental improvements to the standard story of a highly individualistic, atomistic privacy. We must think about privacy instead as the rules which govern personal information and take into account more complex social contexts, the increasing importance of information relationships in the digital age, and our need to rely on (and share information with) other people and institutions to live our lives.14 Information relationships are relationships in which information is shared in trust and in which the rules governing the information sharing create value and deepen those relationships over time. If privacy is increasingly about these information relationships, it is also increasingly about the trust that is necessary for them to thrive, whether those relationships are with other humans, governments, or corporations. Trust is particularly important for the large tech companies with which we increasingly share vast amounts of often-intimate data. For instance, the battles that Apple and Microsoft have fought with the Federal Bureau of Investigation (FBI) and the Department of Justice (DOJ) are battles fought to earn and keep the trust of their customers.15 In this direction lies a better digital future for all of us—a digital society in which privacy rules promote trust and make life better for the humans who inhabit it. This is what we will call “first-best” privacy protection.
By contrast, obfuscation is a creature of distrust—a last resort of the weak, the marginalized, and the betrayed. Obfuscation is not merely motivated by distrust; it also creates additional distrust by hiding from the surveillance economy or intentionally feeding bad data into it. Obfuscation is a kind of pollution of the information economy, which can be useful in the short term but costly or even unsustainable in the long run. While obfuscation can be useful to those who have no other options, it can also sow distrust when injected into existing relationships. We believe that a better strategy for a sustainable digital future is to promote trustworthy information relationships—the building blocks of a digital society. In these relationships, obfuscation by one party against another can sow damaging distrust. By further undermining the potential of trust, obfuscation thus offers a kind of “second-best” privacy that will actually cause us to lose ground in the long run. If we fall prey to the pessimistic and isolationist aspects of obfuscation, we risk seeing our only option as a guerrilla war against privacy forces with which we might otherwise be able to work. It is a war we cannot win.
Against the backdrop of privacy’s trust gap, we then offer both an internal and an external critique of Brunton and Nissenbaum’s obfuscation theory. We develop our internal critique in Part II, taking issue with Brunton and Nissenbaum’s description of obfuscation as a largely solitary and independent strategy. We argue that even within the parameters of obfuscation theory, people often have to depend upon others to obfuscate effectively. Unless people can trust designers, intermediaries, confederates, and lawmakers to help them obfuscate, the tactic will frequently fail. It is those who must trust others, the weak and vulnerable, who need obfuscation the most. Yet by feeding bad data into the system, obfuscation can have the perverse effect of further corroding social trust.
In Part III, we offer a broader, external critique of obfuscation. We caution against leveraging the wisdom of obfuscation into a premature guerrilla war for our privacy. Such a strategy has an undeniable romantic appeal, but we do not yet need to resort to a guerilla war of individuals against the powerful institutions that seek our data. As lawyers, we believe that the first-best solution to problems of social power that Obfuscation catalogs is not revolution, but regulation. Although it may not always be obvious, privacy is not doomed. Law and public policy can and should play a role in promoting trust and privacy. Contrary to popular and legal rhetoric about the “death of privacy,”16 there is substantial evidence that the campaign for privacy rights can be not only viable, but also effective. It would be a mistake to cede the high ground of legal reform to fend for ourselves by embracing self-help obfuscation at the expense of trust-based solutions like confidentiality, data ethics, transparency, and data security. But by ignoring both the current evidence that privacy law can do helpful work and rejecting the potential of law, this is essentially the strategy that Brunton and Nissenbaum recommend.
In Part IV, we offer an alternative frame for thinking about privacy problems in the digital age. We propose that a conceptual revolution based upon trust is a better path forward than one based on obfuscation. Drawing upon both our prior work and that of the growing community of scholars working at the intersection of privacy and trust, we offer a blueprint for trust in our digital society. This consists of four foundations of trust—the commitment to be honest about data practices, the importance of discretion in data usage, the need for protection of personal data against outsiders, and the overriding principle of loyalty to the people whose data is being used, so that it is data and not humans that become exploited. We argue that we must recognize the importance of information relationships in our networked, data-driven society. There exist substantial incentives already for digital intermediaries to build trust. But when incentives and markets fail, the obligation for promoting trust must fall to law and policy. The first-best privacy future will remain one in which privacy is safeguarded by law, as well as private ordering and self-help.
Obfuscation aims to spark a rebellion by the weak and powerless using whatever tools are available for resistance. Despite such an insurrectionist objective, Brunton and Nissenbaum surprisingly accept the terms of the privacy debate as they are. This capitulation is the source of the book’s greatest contributions as well as its most significant limitation. By accepting the status quo and leaving loftier challenges to privacy theory for another day, Brunton and Nissenbaum have the freedom to seek out realistic and practical privacy strategies that can be effective even if they are flawed or only modestly effective. But this clear-eyed realism still buys into the framework that dominates almost all our modern thinking about personal information—that privacy is largely an individual pursuit. Before we address the limitations of Obfuscation, let us first review its principal arguments and most noteworthy contributions.
Obfuscation is one part a saboteur’s user manual and one part an exploration of the ethics of that sabotage. The privacy stories that dominate our news headlines show no likelihood of dying down, and they have left people bewildered and worried. This book offers one way out.
Brunton and Nissenbaum explicitly aim to start an obfuscation revolution.17 They seek to empower people with the potential of digital technologies to conceal, disrupt, and fight back against the exposure and manipulation of our data. They explain that “[t]he focus of our limited revolution is on mitigating and defeating present-day digital surveillance” using ready-to-hand components.18 They tout obfuscation as “a lexicon of ways to put some sand in the gears, to buy time, and to hide in the crowd of signals.”19 There is much to like in this proposal, in particular its rebuttal of simplistic notions of privacy and its offer of a weapon to those most in need of protection from the power imbalances of our digital age.
In their Introduction, the authors lay out their conceptualization of obfuscation as “the deliberate addition of ambiguous, confusing, or misleading information to interfere with surveillance and data collection.”20 The first and prototypical example of obfuscation in the book is the use of “chaff” by pilots during the Second World War to frustrate military radar and weapon targeting systems by giving off a confusing and overwhelming number of signals, all but one of them false.21 The goal of Obfuscation is to explicate that concept as a starting point for resistance and revolution by individuals or groups of individuals against the surveillance and data collection that exist within asymmetrical power relationships.
We argue that the central arguments and contributions of Obfuscation are best understood through the lens of the modern individualistic conceptualization of privacy, a lens that they implicitly adopt for individuals or groups of individuals acting together.30 This notion of privacy revolves around principles of autonomy and control. It conceives of us as each individually responsible for protecting our own little privacy islands. It is the dominant story of modern privacy law and policy31 and is reflected in the examples and rhetoric in Obfuscation. Brunton and Nissenbaum make the best of this framework by helpfully focusing on practical defenses that leverage transaction costs and surveillors’ practical, financial, and cognitive limitations to frustrate data collection and comprehension.
Embedded in the heart of Obfuscation is pragmatism regarding the kind of privacy people can actually expect and a celebration of what we think can best be called a “good enough” privacy. The authors explicitly jettison ideal notions of privacy, recognizing that sometimes even temporary, incomplete privacy interventions can be enough to serve people’s needs.32 They note that in many situations, optimal systems for privacy, like encryption, are not possible, accessible, or desirable.33 People often need to be at least partially or temporarily visible, and their information must be somewhat comprehensible to others to interact in the world. The act of being online for any activity usually requires a certain kind of visibility.
Enter obfuscation. The authors argue that “[t]he strength of an obfuscation approach isn’t measured by a single objective standard (as safes are) but in relation to a goal and a context: to be strong enough.”34 Instead of making someone completely invisible, obfuscation can buy them time before detection. Instead of erasing one’s tracks, obfuscation can provide plausible deniability and disrupt the ability of surveillors and data collectors to profile or otherwise single out individuals. When people obfuscate, they raise the transaction cost of effective surveillance and data collection. This can temporarily delay surveillance and perhaps even discourage surveillance and data collection efforts altogether. Obfuscation does not promise protection—only the possibility of minimized risk and an outlet for protest.
The pragmatism of Obfuscation comes just at the right time in our modern privacy debate. Because there is no set definition of privacy, our resulting policy has latched onto overly idealistic notions of privacy that do not scale well. Thinking about privacy as individual control over information has resulted in myriad boilerplate contracts, and even privacy-conscious persons may not have enough time to read through all of the privacy policies they wish to opt out of.35 Additionally, thinking about privacy in terms of an individual’s secrets fails to cover information we want to share with some, but not all.36 Secrecy and control are too simplistic and unforgiving. While obfuscation lends some support to the same individualistic framework that equates privacy with control, it adeptly rebuts the misguided and myopic notion of privacy as secrecy.
In focusing on structural and practical privacy protections, Obfuscation joins the growing chorus of voices exploring concepts like obscurity, friction, inefficiency, and structural privacy rights, which look to the relative ease or difficulty of conducting privacy-protective activities.45 These concepts are distinct yet ultimately all look to the transaction costs associated with finding, understanding, using, or sharing information.
In economic theory, transaction costs refer to the kinds of expenses necessary to engage in market exchanges.46 The concept is invaluable because our sense of privacy is in part a function of decisions made by corporations and government actors that have limited resources to spend on information collection and disclosure. The strategy of obfuscation is harmonious with the broader concept of obscurity, which is another way of using existing friction and other structural constraints to secure privacy.47 Obscurity is the idea that when information is hard or unlikely to be found or understood, it is, to some degree, safe.48 “Friction” is the idea that transaction costs can be used as a lever to make information more or less accessible, according to desired values of openness or privacy.49 Finally, structural constraints are regulators of privacy-corrosive behavior that prevent surveillance and data collection or use through technological or physical barriers in the world.50 Obfuscation is capable of being used to obscure through “noise,” to add friction through forced work on behalf of collection systems and recipients, and to leverage structural protections like limitations on automation capabilities. As such, it is a welcome contribution to the growing pragmatic approach to modern privacy, which is sensitive to the practical limitations of people and systems in identifying issues, assessing risk, and solving problems. One of Obfuscation’s greatest virtues is its recognition that pretty good privacy is often good enough.
Another strength of Obfuscation is that it equips people with another means of defense when safe relationships are not an option for sustainable data exchange. Although people need others to flourish, some data collectors are not trustworthy. The history of consumer protection is littered with scammers and others who would exploit us and our data.51 Electoral campaigns, advertisement networks, and other organizations that care more about short-term gains from data than long-term sustainable relationships also have little incentive to be trustworthy data stewards.52 Obfuscation, from this perspective, is a response to, and thus a product of, distrust.
Additionally, others that might collect people’s personal information or surveil them have no relationships with the objects of their surveillance whatsoever. For example, many surreptitious surveillors like Peeping Toms, nosy neighbors, and government intelligence agents have no relationship with those they surveil. Data brokers usually do not have a direct relationship with the subjects of the data either.53 Concepts like big data and open data presuppose downstream uses of data outside what we traditionally think of as information relationships.54 It makes little sense to talk about the importance of relationships in these contexts. And it is here where obfuscation can matter most.
Obfuscation is most useful as a weapon when our backs are against the wall. In an increasingly nationalistic and paranoid world stage, governments are dramatically increasing surveillance, particularly of minority and vulnerable populations.55Obfuscation and more robust privacy strategies like using encryption will be invaluable for resistance. States are the ultimate dominant actors in asymmetrical power relationships. When the vulnerable are out of options, obfuscation is far better than resignation. The authors point out that obfuscation can also be a tool for protest and, if nothing else, a way to express displeasure, whether it ends up effectively protecting people or not. One of the most prominent examples of obfuscation in the wake of then-candidate Donald Trump’s consideration of a Muslim registry was an organized effort by non-Muslims to register.56Doing so would add noise to the database and express protest and solidarity at the same time.
As a tool of expression and of last resort, obfuscation has much to commend it. But obfuscation can only be asked to do so much work. As we explain in greater detail below, it would be unwise to saddle it with heavy lifting.Technology alone cannot save us. Like the notion of obfuscation itself, privacy-friendly technologies unsupported by law and policy can only temporarily stave off the corrosive power of overreaching government and corporate surveillance. Technology is necessary to help create an environment for human flourishing. But it is not sufficient. The sustainable path to fixing a broken world is through social movements, participation in the democratic political process, and the rule of law.
This is the dominant rhetoric of privacy: a conflict between privacy and progress to be resolved through individual consumer choice. Like a lot of worldviews, this story does ideological and political work. The dominant view gave birth to the “notice and choice” regime that molded our current data protection regime.60 It provides a justification for the maligned “third party doctrine” in Fourth Amendment law, which puts the risk of disclosure to the government on the person who shares information with others.61 It encourages us to think about information as being either “public” and known to all or “private” and known only to one person, rather than thinking about the variations between these two extremes that happen when information is shared in a relationship.62 The dominant narrative even underlies the “nothing to hide” fallacy used to excuse surveillance, as if the only relevant factor for surveillance were the bad secrets you may keep.63 But at bottom, no matter how it is phrased, the responsibility for protecting our privacy under the dominant story ultimately rests upon each of us as individuals. Under this view, we are all privacy islands.
Missing from the individual view of privacy and security law is the more nuanced understanding that in a connected society, privacy is not just an individual concern, but a major building block for society as a whole. This is privacy’s trust gap. Our dominant legal framework is frequently insufficient or incapable of comprehending the real and important injuries to the trust we need to flourish in our networked, digital society. If privacy is just a matter of individual concern, behaviors and forms of surveillance that breed suspicion raise no cognizable legal issues, even though they undermine our civil liberties or our willingness to connect to others in ways that produce social value. Privacy’s trust gap thus contributes to the sense of fatalism dominating our rhetoric and hindering our policy, particularly as the law conceives of us all as individuals on our own privacy islands, rather than emphasizing our interconnections. While Obfuscation offers a useful weapon to those with little other power to avoid data collection and surveillance, the weapon is not only rooted in individual actions under the privacy islands model, but also reinforces and widens the trust gap.
Obfuscation is offered as a weapon of the weak, those on the “wrong” end of asymmetrical power relationships. But it is precisely the weak and vulnerable who need help from other people, organizations, and technologies in defending themselves. Thus, they cannot function effectively as islands in the way that the dominant individualistic theory of privacy would require.
While some examples of obfuscation that Brunton and Nissenbaum provide are entirely within an individual’s control (such as speaking in general terms or planting false signals), few obfuscation attempts in the digital world, where most data is collected, are truly solitary affairs. Online attempts at obfuscation usually require the cooperation of (and thus, vulnerability to) at least one of two different kinds of parties: designers and confederates.
Unfortunately, the proposed obfuscation revolution looks to be a lonely one. Obfuscation accepts the framework of privacy individualism, and both obfuscation and privacy are conceived in individualistic terms, largely through the lens of self-defense. Obfuscation is proposed as an individual pursuit, a tactic to be employed by people seeking to create or preserve some notion of privacy for themselves.
The authors provide numerous examples of individual obfuscations, like poker players giving “false tells” to avoid being predictable and attorneys playing loud audio files of polyphonic “babbling” to confound eavesdropping.75 They highlight how people can change out SIM cards to avoid being linked to one specific phone or use deliberately vague language to frustrate data analytics.76 As a revolution, obfuscation seems to merely ask that we each fight surveillance alone, even if sometimes we fight it alone, together.
Adversarial attitudes within information relationships are not sustainable. If we all were to pollute the information economy, we would also counteract the usefulness of personal disclosure. Disclosing our health data to the right people can help us get and stay healthy. Disclosing our financial information can help us access credit and accumulate wealth. Agreeing to certain kinds of surveillance might gain us entry to places that require elevated levels of security. People and organizations need each other to participate in the modern world, which means they must work together.
Brunton and Nissenbaum recognize this reality in a section titled “The Fantasy of Opting Out.”79 Credit, health insurance, jobs, travel and entertainment all require trust in other parties. Too often, the individualistic account of obfuscation glosses over the importance of these relationships. What would happen if people regularly obfuscated their health information to their doctors and their financial information to credit institutions? We would probably be less healthy and wealthy (and wise) because diagnosis and risk assessment would become very difficult for those seeking to work with us. While some surveillors and data collectors have little concern for people’s well-being, the costs of obfuscation vary wildly amongst different kinds of information relationships.
There is room for debate on the efficacy of obfuscation.80 But our critiques concern the individualistic conceptualization of obfuscation itself. First, as we have seen with other regimes designed to give people “control” over their personal information, “empowerment” is often the positive spin placed upon the structural reallocation of privacy risks.81 Under this story, when we are “empowered” to exercise control over how our information is collected and used, we bear the responsibility of bad choices, even when our good options are limited or nonexistent. These situations can include being bound by voluminous, incomprehensible, and constantly changing privacy policies.82 Or they can include liability for harm resulting from our inability to manage a bewildering number of privacy settings or passwords,83 or our failure to opt out of data collection by information brokers or online surveillance companies we may not have been aware even existed, a phenomenon Brunton and Nissenbaum themselves marvelously term “the fantasy of opting out.”84In these contexts, “empowerment” and “control” can be (and have been) used by the powerful to get their way while avoiding substantive legal obligations with respect to personal data. And they leave individuals alone and isolated to solve this problem themselves or bear its costs.
Second, and ominously, there is only so much that we can gain through a strategy of obfuscation. It is a defensive tactic to protect against overreaching by the already powerful. At best, it preserves the status quo, perhaps minimizing the exploitation of the powerless, but doing relatively little to upset the power differentials that constitute the status quo.
Additionally, as the authors themselves concede, obfuscation is available to the powerful as well as the relatively disempowered. It can be used by law enforcement and by corporate surveillance regimes as cloaks and countermeasures. Brunton and Nissenbaum give examples of each of these techniques, from the use of false signals by the police to trick automobile radar detectors into thinking there is a speed trap86 to the intentional drafting of privacy policies to obscure the real ways in which personal data are being exploited.87 Obfuscation can be a useful tactic, a “force multiplier” of sorts, but there is no evidence about whether its deployment will benefit the disempowered or the already powerful.88 If obfuscation is simply about exploiting the practical limitations and resource cost of surveillance and data collection, the weak and vulnerable may be able to temporarily obfuscate effectively or obfuscate effectively against only some parties. But if a motivated adversarial party is willing to invest the resources to counteract obfuscation, the rich and powerful will eventually win. In addition to the powerless, the rich and powerful will also be motivated to find ways to use obfuscation to their own advantage. In a digital society, in which the control of code-based technologies generates ever-more useful social power, we fear that increased use of obfuscation across the board could worsen existing power imbalances rather than shrink them.
If obfuscation is truly to be a revolution, it cannot be an individual pursuit that presumes all asymmetrical information-based power relationships are adversarial. Even if obfuscation is justified against some adversaries, people are likely going to need to trust others with whom they are at a power disadvantage. This is particularly true in the digital world, where the guts and inner workings of code, structure, and process are opaque.
Under the standard story we tell ourselves about digital privacy and security, individuals must take an adversarial position toward all those who would collect, use, and share their personal information. While we are certainly vulnerable online, privacy’s trust gap means that this worldview can be wasteful and even destructive as the dominant story of privacy.
In the least, people must be able to understand how the tool works and trust that the tool works as it is supposed to. Every user creates a mental model about how a technology will work. Their expectations are created by the representations of the developers, the user’s background knowledge, and the design of the technology itself.95 When a user’s mental model does not match the reality of how the technology works, they might think the technology protects them more than it does or accidentally misuse the technology in a way that exposes them to a range of privacy harms, from embarrassment to financial injury or even criminal penalties in the law enforcement context.
Many kinds of obfuscation also require ordinary people to put their trust in others just like them. Brunton and Nissenbaum provide several vivid examples. They recall the large group of Roman gladiators who called out “I am Spartacus” to protect the real Spartacus standing among them.96 Or similarly, in The Thomas Crown Affair, the protagonist pulls off a spectacular caper with the help of many identically dressed people engaging in a blur of exchanges involving identical suitcases.97 There are many real-world examples of obfuscation that require confederates as well. Brunton and Nissenbaum give the example of people who swap grocery store loyalty cards to obfuscate data collection about their shopping habits.98 People can also exchange SIM cards and debit cards to muddy data trails and prevent accurate triangulations of people’s whereabouts. But all of these examples share one critical factor—collective obfuscation usually requires us to trust our confederates. While this might not be a problem in contexts where enough people feel collectively and sufficiently repressed to fight back, this kind of solidarity is not always easy to locate.
Confederates must at least be reliable enough to engage faithfully in collective obfuscation. But often these confederates are entrusted with information, such as identifying information, incriminating information, location information, and more, that leaves the obfuscator vulnerable to a range of privacy injuries from embarrassment to criminal punishment. Spartacus and Thomas Crown were able to obfuscate effectively, but only by trusting in the solidarity of their confederates. The same gladiators who protected Spartacus from the Roman authorities could just as easily have identified him to those who would kill him by shouting, “Here is Spartacus.” In short, many obfuscatory techniques require trusting allies.
Considering the role of developers and confederates, it seems clear that obfuscation is frequently not an individual activity but one that requires the assistance of others. This complicates our story of privacy and obfuscation as individual pursuits, as it requires us to trust obfuscators, even as we are sowing the seeds of distrust by obfuscating in the first place. After all, if we do not want to live like hermits, we have to place our trust somewhere. Recognizing the fact that other people are necessary complicates the standard privacy islands story, but as we will see in the next Part, obfuscation theory has a more serious trust gap of its own.
The insight that we have to place our trust somewhere reveals a larger problem with obfuscation theory. Obfuscation, as we have discussed, is a product of distrust, a last resort for those who cannot otherwise resist their exploitation by the information economy. Instead of building bridges, obfuscators are compelled to burn them. By polluting the data stream to render it unreliable, obfuscation thus reveals itself as not just a creature of distrust, but also a creator of further distrust. In this Part, we examine obfuscation theory from an external critique and argue that it offers at best only a kind of second-best privacy—a privacy for those who have been disempowered and defeated rather than included as equals in the digital society.
There is a better alternative: a “first-best” form of privacy protection, which safeguards personal information via legal rules and social norms. Under this optimal solution, we could create the necessary incentives to protect sustainable, trusted information relationships between ordinary people and the corporations and governments with which they need to engage in order to participate fully in the digital society. This “first-best” privacy would be promoted through law rather than self-help, would be collective rather than individual, and would support building trust rather than undermining it.
Obfuscation is a costly weapon. For it to work well, people must either deceive or damage a system or data set. Brunton and Nissenbaum defend obfuscation in these circumstances by arguing that “[d]ata pollution is unethical only when the integrity of the data flow or data set in question is ethically required.”99 Fair enough, at least with respect to the data set.
But data are usually collected in the context of information relationships. Websites, Internet service providers, merchants, carriers, and members of our social networks all collect our personal information as part of a service or social exchange. Sabotage through obfuscation will breed distrust within these relationships. This is where obfuscation’s trust gap diminishes its own utility as a weapon of the weak.
As the authors note, it is essentially impossible to opt out of information relationships in the modern age. Unless we want to embrace the hermit lifestyle and go completely off the grid, we must share our information with others to get the things we need in order to live as integrated members of our society. It is thus not ideal to intentionally poison the online relationships we cannot do without—the technologies that help us get jobs, find partners, seek health treatment, recommend books and films, purchase goods and services, socialize, and travel.
While obfuscation can occasionally be useful, too much waste, damage, and dishonesty will render toxic any such useful information relationship. Consider social media. One obfuscation technique profiled by the authors is “Bayesian flooding,” a strategy in which Facebook users include so many false and implausible life events on their profiles that Facebook cannot accurately target advertisements to the user.100 While this might be effective, a Facebook profile full of lies would be largely useless to everyone, including the owner of the profile. It might confuse one’s networked connections. Even if human audiences recognize the profile as a fake, the ostensible purpose of social media is to exchange legitimate communication with others. Why even use Facebook in the first place? Similar problems can be found in mapping, gaming, and recommendation apps that require geolocation to serve their purpose. Though such actions might help people obfuscate as a form of protest and collective action, they are mainly only useful when users are prepared to sacrifice the benefit of that information relationship.
The result is that obfuscation is best suited as a strategy for those within relationships that are expendable or those with whom we have no relationship. But in the context of a nonexpendable relationship, obfuscation promotes distrust. As information relationships continue to become more important to our networked lives, this issue is likely to become more problematic.
A defender of obfuscation theory might respond at this point that while the tactic is neither practically nor ethically perfect, it can still be good enough. From the perspective of a powerless individual, obfuscation might well be the best option. But as we have already explained, looking at privacy questions from an individual perspective is limiting. Once we expand our frame from the individual perspective to a social perspective, other options become available.
An obfuscation-first strategy for the information age is a concession that the battle is lost, conceding that the best hope for individuals is a kind of guerilla war against the powerful. Depending upon one’s politics, these strategies can have just as powerful an emotional appeal as the obfuscation strategy does for us. But when it comes to the strategy of obfuscation, while we feel its romantic appeal, we harbor no hopeful illusions about such a last-resort strategy’s efficacy over time. Instead, we believe that the strategy of trust building will be more effective. Such a strategy works with government and corporate interests to show the long-term value that digital trust can create and plays those interests against each other where necessary to promote the interests of the humans who constitute our digital society.
Contrary to both popular and legal rhetoric about the “death of privacy” and the privacy pessimism Obfuscation exhibits, there is substantial evidence that the legal campaign for privacy rights can be effective.104 Consider the numerous examples from the past few years of instances in which privacy law has advanced human interests over those of the government or corporations. Examples of this phenomenon abound, but some of the most salient include the expiration of the PATRIOT Act,105 the passage of the California Electronic Communications Privacy Act (CalECPA)106 and state social media protection laws,107 the expansion of FTC enforcement of privacy and security rules,108 the effect of European privacy regulation on American data practices,109 and the efforts to foster data security by state attorneys general.110 In each of these recent cases, law has been successfully marshaled to protect people’s privacy (whether in their capacities as citizens, consumers, or employees) against powerful corporate or government entities.
The battle to secure privacy is by no means won, but as these numerous cases illustrate, progress is being made. Seeking change and shelter through the legal and political process is a proven strategy recognized by previous revolutions like the civil rights movement and the struggle for safe and equal workplaces.117 We worry that a strategy of increased obfuscation could, by corroding trust in our digital future and by keeping our focus on the individual rather than the social dimensions of privacy issues, undermine this promising trend in a way that might make us all worse off.
We cannot know what the future will hold. As Justice Holmes wisely reminded us in his great dissent in Abrams v. United States, “[A]ll life is an experiment. Every year, if not every day, we have to wager our salvation upon some prophecy based upon imperfect knowledge.”118 Holmes was writing about an earlier revolution—the industrial one—and dealing with the prosecution of an activist who had quite literally called his fellow workers to the barricades to protect human interests against government and corporate ones.119 Yet Holmes’s wisdom is as relevant to the information revolution of the twenty-first century as it was to the industrial revolution of the twentieth: we do not know what the future will hold, but we have to do the best we can with the limited knowledge we possess. We cannot know for certain whether a strategy of obfuscation or one of trust is the best way to deal with the disruptive consequences of the information revolution. But we remain hopeful that trust is the better strategy. If we must have a conceptual revolution about how we think about privacy and security, we should fight that revolution for trust and relationships rather than sabotage and individualism. Instead of a revolution of sabotage, a guerilla war of obfuscation against powerful interests, we should have a conceptual revolution about the way we think and talk about privacy that pushes past the limitations of the privacy islands approach. At bottom, we believe there are encouraging signs that the battle for privacy has not been lost and that a strategy that promotes trust in information relationships is a better way forward than doubling down on obfuscation and distrust.
In this Review, we have argued that the major weakness of obfuscation is that it subscribes to the individualism that dominates modern privacy rhetoric and policy. There is, however, a better way to think about privacy, security, and the role of information in a digital age. Rather than thinking about the ways in which we are isolated like islands, we can think instead about the ways in which we are connected. These connections frequently occur through what we have been calling information relationships. Thinking about privacy in these terms will allow us to move past the privacy islands model and close privacy’s trust gap.
How should we promote trust in the context of personal information? Trustworthy data stewards have four characteristics that promote trust: they are honest, discreet, protective, and loyal.122 Each of these values requires some elaboration. First, trustworthy stewards are honest because they explain to us the terms under which they hold and use our data. Honesty places the obligation of being understood on the steward, rather than on our ability to scrutinize the dense, vague, and protean language of privacy policies and terms of service. Second, they are discreet because they treat our data as presumptively confidential and do not disclose it in ways contrary to our interests or expectations. Third, trustworthy stewards are protective because they hold the data securely against third parties, doing everything within reason to protect us from hacks and data breaches. Fourth, and most fundamentally, those we trust are loyal because they put our interests ahead of their own short-term potential for gain. This means, among other things, that they do not engage in unreasonable self-dealing when collecting, using, or sharing our data.
One of the chief virtues of a trust-based approach to privacy is that it allows us to better understand privacy problems and formulate privacy solutions. Legal and policy questions surrounding privacy are transformed when we move from a privacy islands perspective to a trust perspective.
A focus on trust changes this calculus. Moving beyond fictive notions of trust and blunt concepts of consent as the essence of privacy law, a trust perspective would go further. It would ask whether the notice was sincere and reasonable (i.e., whether it was honest). It would ask whether the choice was meaningful and gave the data subject the opportunity for discretion in the way their data was held. More generally, it would ask whether the data were protected and whether the institution holding personal data acted in ways that were loyal to the data subject. In this context, loyalty might mean the company took the data subject’s substantive interests into account so that the data subject did not need to engage in pragmatic privacy self-help, whether of the notice-and-choice or of the obfuscatory varieties. The main effect of the shift in perspective is to keep the party entrusted with personal information from shifting the risk of loss back onto the trusting party. It thus places obligations on the powerful entities best able to protect against loss, rather than blaming the powerless individuals who are often at their mercy.
We harbor no illusions that trust is a panacea for all problems of information policy. It is hard for us to trust those whose interests are opposed to ours, or parties of whose existence we are unaware. Another limitation of trust is the problem of misplaced trust—a party that pretends to be trustworthy but then betrays those that trust them can sow massive amounts of distrust. As we conceive of it, trust works best in relationships in which there is the potential for mutual gain and in which there are multiple opportunities to deepen the relationship. We can have such relationships with our cloud provider, our social network, or our spouse, but one-time transactions standing alone are more prone to distrust. Relationships like these are the economic or literal equivalent of a “one-night stand.” To guard against this problem, companies in the “sharing economy” like Airbnb and other online intermediaries have built trust-promoting structures like peer rating systems into their platforms.137 But we believe that trust retains enormous potential, particularly for consumers in the digital economy who must live their lives in connection with large technology companies who share the consumers’ economic interests in a long-term, sustainable information relationship that can be beneficial (and profitable) to both parties.
Similarly, we believe that there is much insight to be gained when we look at the world from the perspective of trust. For example, trust allows us to see other problems with the dominant view, such as the implicit zero-sum game of individualistic notions of privacy. When the individual is pitted against the world, we should not be surprised when the individual’s gain is seen as the company’s or government’s loss.138 If we think about privacy as the antithesis of profitability or national security, we should not be surprised when companies choose to maximize profits or governments engage in widespread surveillance. But privacy is frequently something corporations can use for their long-term benefit, and something free societies can cherish while also being secure.139 However, looking at privacy in negative, individualistic terms can cause us to lose sight of this very important insight.
Perhaps most interestingly, even obfuscation is transformed into something more useful when we look at privacy through the lens of trust. As an isolated concept, obfuscation is destructive. Brunton and Nissenbaum speak of “sand in the gears” and of frustrating adversaries.140 The entire point of sabotage is wreckage. However, the wisdom motivating obfuscation—that data collectors’ limited resources can be used to protect our privacy—can be leveraged for constructive purposes as well. Consider instead a broader notion of obscurity as privacy. Obscurity is a concept focused on the creation or preservation of transaction costs to finding and accessing personal information. Obscurity protections are based around the notion that making (or keeping information) “hard but possible” to find or use is often good enough for many purposes.141 Whereas the examples in Obfuscation largely taint data, obscurity looks to more generally minimize the risk of identification, which could include limitations on searchability, storage, or other increases in transaction costs that keep the data safe, but useful.142 While it is hard to imagine companies saying “please obfuscate against us” or “please taint our data,” they might be open to preserving the obscurity of data subjects within relationships of trust. They might not need to know (or store) many kinds of identified sensitive data in order to carry out their functions and might deliberately collect less data than is possible in order to protect and be loyal to their trusting customers.
At a practical level, how do we promote trust in the relationships that constitute our digital society? Our proposal for first-best, trust-promoting privacy rules is twofold. First, we should encourage the further development of existing trust norms as a business practice in the technology industry. Second, we should develop legal rules to provide additional incentives for trustworthiness and to punish companies that act in ways that are trust-corrosive or disloyal. Third, we should place meaningful checks on government surveillance and government access to information held by companies on behalf of their customers.
The first part of our strategy involves encouraging trust norms. There are already numerous market incentives for companies to promote these kinds of relationships. Consider in this regard Apple’s high-profile standoff with the FBI over the security of iPhones and its lobbying in favor of strong encryption before Congress.143 Or consider Microsoft Corporation’s lawsuits against the federal government, seeking to prevent extraterritorial use of search warrants and the use of search warrants accompanied by gag orders.144 Consider also the trend among large technology companies to issue “transparency reports,” data-rich compendia of government requests and orders to access the data of their users.145 Or consider the vast sums that big technology and cloud companies expend in order to protect the data they store on behalf of their customers.146 These are recent examples, but this phenomenon is hardly new. In 2006, for example, Google successfully convinced the government to narrow a subpoena of its search engine records in order to protect the trust of its users and the confidentiality of their search results.147 These cases illustrate that it will often be in the immediate and long-term interest of companies to protect the privacy of their users. More generally, as Internet business models mature, it will be in the interest of companies to be honest, discreet, protective, and loyal to their customers, in order to develop long-term relationships that create real value for the companies as well as their users.
We harbor no illusions, however, that all companies will take this long view. Bad actors exist throughout our economy and seek short-term gain at the expense of their users, a phenomenon we have elsewhere called “data strip mining.”148 Similarly, there will also be instances in which companies have financial or other incentives to betray or act disloyally with respect to the privacy of their users or other people. The shadowy and largely unregulated data broker industry is one salient example here, but there are many others. In these cases, in which the market fails to adequately promote or protect trust, we offer the second prong of our privacy strategy, which is overtly regulatory. In cases where the market fails to provide adequate incentives to promote trust, we believe that the law should step in to regulate in trust-protective ways and require companies to be honest, discreet, protective, and loyal toward those people whose data they hold, process, and exploit for gain. In this way, the law could recognize a kind of constructive information relationship between a person and a large commercial entity that trades in large quantities of information about them. Such examples are further afield than our core case of a close information relationship, however.
An entirely different approach could be for courts to reinvigorate the languishing tort of breach of confidentiality to reinforce expectations of nondisclosure and protection within intimate relationships and those that involve significant personal disclosure. In other work, we have explored the ways in which American tort law has failed to fully embrace the idea of a duty of confidentiality that protects information disclosed in relationships.152 By encouraging discretion and loyalty in particular in these relationships, tort law could be leveraged to promote digital trust as well.
The third part of our proposed strategy deals with government surveillance. All citizens of digital societies are in information relationships with their governments, who collect data on them from cradle to grave and beyond. The dangers of government databases were a stimulus for the passage of federal and state laws placing limits on government data usage like the Federal Privacy Act of 1974 and its state law equivalents.153 But as noted above, as modern technology has marched on, new dangers of government recordkeeping and surveillance have emerged, whether by direct surveillance or by obtaining personal data from companies that hold it on behalf of their customers.154 The revelations of Edward Snowden shattered the trust of many ordinary and law-abiding Internet users in the privacy and confidentiality of their communications and online activities.155 Law can (and should) be used to rebuild trust between citizens and their government, whether by explicitly extending Fourth Amendment law to digital communications and evidence,156 or by using statutory law to achieve similar goals.157 There are a variety of ways to rebuild trust between governments and citizens; our argument does not depend upon any particular form, but we believe more generally that the information relationships each of us have with our governments will benefit from the trust that clear legal rules can create. In particular, the governments that democratic citizens create to govern their societies must be honest, discreet, protective, and loyal.
There will no doubt be difficult cases to regulate, but we believe that trust-promoting regulation is a superior alternative to doubling down on obfuscation. More fundamentally, if we think about personal information in terms of trust, we start to ask better regulatory questions, ones that focus on the kind of sustainable digital future we want to build, rather than on fictive notions of consent or illusions of consumer choice. This, we believe, is the policy path forward to a first-best kind of privacy.
In Obfuscation, Brunton and Nissenbaum have done us an enormous service by identifying obfuscation as a strategy, describing its potential, and engaging deeply with many of its ethical pitfalls. They also powerfully remind us that, when it comes to protecting our data, pretty good protection is frequently good enough. Our understanding of the strategies of privacy and security is substantially richer as a result of their work.
Obfuscation may well be one of the most appealing strategies of the digital age, but we must resist the full force of its siren call to “revolution.” While the practices of obfuscation will certainly have their uses, a full embrace of obfuscation will lead to distrust at a time when there is good evidence to believe that a strategy of market and regulatory trust building can produce meaningful benefits in our struggles over personal information in the digital society. The deployment of legal and policy tools to promote trust in sustainable information relationships certainly has less romantic appeal than obfuscation, but there is good reason to believe that trust, not obfuscation, is the way toward a better digital future.
Id.; see Ryan Calo, Can Americans Resist Surveillance?, 83 U. Chi. L. Rev. 23 (2016).
Finn Brunton & Helen Nissenbaum, Obfuscation: A User’s Guide for Privacy and Protest (2015).
Id. at 1 (emphasis omitted).
See e.g., id. at 85 (“How can obfuscation work for me and my particular situation?”).
Brunton & Nissenbaum, supra note 3, at 48, 57-58.
See sources cited supra note 13.
See sources cited supra note 47.
See Ira S. Rubinstein, Voter Privacy in the Age of Big Data, 2014 Wis. L. Rev. 861.
Warren & Brandeis, supra note 65, at 205; see Richards, supra note 12, at 15-26.
See Richards, supra note 12, at 145.
See Richards & Solove, supra note 65.
See Priscilla M. Regan, Legislating Privacy: Technology, Social Values, and Public Policy (1995).
See Hoofnagle, supra note 51.
Brunton & Nissenbaum, supra note 3, at 15, 21.
See supra note 15 and accompanying text.
Brunton & Nissenbaum, supra note 3, at 53.
Brunton & Nissenbaum, supra note 3, at 53-55.
Brunton & Nissenbaum, supra note 3, at 12-13.
Brunton & Nissenbaum, supra note 3, at 15.
See Richards, supra note 16, at 33.
United States v. Jones, 132 S. Ct. 945 (2012).
See Hoofnagle, supra note 51; Solove & Hartzog, supra note 60.
FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015).
250 U.S. 616, 630 (1919) (Holmes, J., dissenting).
Richards & Hartzog, supra note 10 (manuscript at 36-48).
133 S. Ct. 1138, 1143 (2013).
See Richards, supra note 61 (manuscript at 3-6).
Richards & Hartzog, supra note 10 (manuscript at 8).
Brunton & Nissenbaum, supra note 3, at 2, 57.
Gonzales v. Google, Inc., 234 F.R.D. 674, 678-79 (N.D. Cal. 2006).
Richards & Hartzog, supra note 10 (manuscript at 6).
Hoofnagle, supra note 51, at xiii-xvi.
See also Richards, supra note 1, at 1937-41 (giving examples of some of these practices).
Richards, supra note 12, at 185-86.
See Richards, supra note 61 (making an extended argument along these lines).
Neil M. Richards, The Dangers of Surveillance, 126 Harv. L. Rev. 1934 (2013) (outlining the modern surveillance problem, in which individuals are monitored by government and corporate watchers, and explaining when and why surveillance is particularly dangerous).
Id. at 3 (“Obfuscation has a role to play, not as a replacement for governance, business conduct, or technological interventions, or as a one-size-fits-all solution (again, it’s a deliberately small, distributed revolution), but as a tool that fits into the larger network of privacy practices.”).
For extended critiques of this narrative, see Neil M. Richards & Woodrow Hartzog, Taking Trust Seriously in Privacy Law, 19 Stan. Tech. L. Rev. (forthcoming 2017), http://ssrn.com‌/abstract=2655719 [http://‌perma.cc/5HAU-ZRLS]; and Daniel J. Solove, Introduction: Privacy Self-Management and the Consent Dilemma, 126 Harv. L. Rev. 1880 (2013).
Woodrow Hartzog, The Fight To Frame Privacy, 111 Mich. L. Rev. 1021 (2013) (reviewing Daniel J. Solove, Nothing To Hide: The False Tradeoff Between Privacy and Security (2011)); Neil M. Richards, The Information Privacy Law Project, 94 Geo. L.J. 1087 (2006) (reviewing Daniel J. Solove, The Digital Person: Privacy and Technology in the Information Age (2004)).
E.g., Neil M. Richards, Intellectual Privacy: Rethinking Civil Liberties in the Digital Age 90-92 (2015); Woodrow Hartzog, A Stronger Online Eraser Law Would Be a Mistake, New Scientist (Nov. 6, 2013), http://www‌.newscientist‌.com‌/article/mg22029420-200-a -stronger-online-eraser-law-would-be-a-mistake [http://perma.cc/8M8C-EYTY].
See Eoin Carolan & M. Rosario Castillo-Mayen, Why More User Control Does Not Mean More User Privacy: An Empirical (and Counter-Intuitive) Assessment of European E-Privacy Laws, 19 Va. J.L. & Tech. 324, 326 (2015); Anupam Chander & Uyên P. Lê, Data Nationalism, 64 Emory L.J. 677, 677 (2015) (arguing that concerns about surveillance and security “are justifying governmental measures that break apart the World Wide Web, without enhancing either privacy or security”); Omer Tene, Privacy Law’s Midlife Crisis: A Critical Assessment of the Second Wave of Global Privacy Laws, 74 Ohio St. L.J. 1217, 1247-48 (2013).
Neil M. Richards, The iPhone Case and the Future of Civil Liberties, Bos. Rev. (Feb. 25, 2016), http://www.bostonreview.net/us/neil-richards-apple-iphone-privacy [http://‌perma‌.cc‌/RNC6-QXDA].
Id. In February 2016, the FBI attempted to compel iPhone maker Apple to create a piece of software that would allow the FBI to access the locked iPhone that belonged to Syed Farook, a man who, together with an accomplice, killed fourteen people in San Bernardino, California. The FBI relied upon the authority granted under the All Writs Act to compel Apple to create this software. Apple refused and after a brief but intense legal challenge, the FBI withdrew its request, saying it had found another way to access the phone. See Julia Powles & Enrique Chaparro, In the Wake of Apple v FBI, We Need To Address Some Uncomfortable Truths, Guardian (Mar. 29, 2016), http://‌http://www.theguardian.com‌/technology‌/2016/mar/29‌/apple-fbi-encryption-san-bernardino-uncomfortable-truths [http://perma.cc/GNH6 -BBWV]; Neil Richards & Woodrow Hartzog, Apple v the FBI: Why the 1789 All Writs Act Is the Wrong Tool, Guardian (Feb. 24, 2016), http://www.theguardian.com/technology‌/2016‌/feb/24‌/apple-v-the-fbi-why-1789-all-writs-act-is-the-wrong-tool [http://perma.cc/TE8L -RAPF]; Sam Theilman, Apple v the FBI: What’s the Beef, How Did We Get Here and What’s at Stake?, Guardian (Feb. 20, 2016), http://www.theguardian.com‌/technology‌/2016‌/feb/20‌/apple-fbi-iphone-explainer-san-bernardino [http://perma.cc/UX49-CJ3G]. Microsoft has also challenged the authority of the DOJ to force the disclosure of customer emails stored on servers outside of United States under the Stored Communications Act. In July 2016, a federal court of appeals found in favor of Microsoft, forcing the DOJ to seek the emails through alternative international frameworks, such as the mutual assistance in law enforcement treaty, a legal device facilitating international cooperation between police departments. Sam Theilman, Decision in Microsoft Case Could Set Dangerous Global Precedent, Experts Say, Guardian (Sept. 9, 2015), http://www.theguardian.com‌/technology‌/2015/sep‌/09‌/microsoft‌-federal-case-data-security-precedent [http://perma.cc‌/ZW3M-Y65V]; Sam Theilman, US Cannot Force Microsoft To Hand over Emails Stored Abroad, Court Rules, Guardian (July 14, 2016), http://www.theguardian.com‌/technology/2016‌/jul/14‌/microsoft -emails-court-ruling-us-government [http://perma.cc‌/YY5G-FFHE].
E.g., David Brin, The Transparent Society: Will Technology Force Us To Choose Between Privacy and Freedom? (1999); Thomas Friedman, Four Words Going Bye-Bye, N.Y. Times (May 21, 2014), http://www.nytimes.com/2014/05/21/opinion/friedman-four -words-going-bye-bye.html [http://perma.cc/CCP3-ALQZ] (declaring that “privacy is over”). But see Neil M. Richards, Four Privacy Myths, in A World Without Privacy: What Law Can and Should Do? 33 (Austin Sarat ed., 2015) (debunking the “Privacy is Dead” myth); A. Michael Froomkin, The Death of Privacy?, 52 Stan. L. Rev. 1461 (2000).
Brunton & Nissenbaum, supra note 3, at 1 (“We mean to start a revolution with this book. But not a big revolution—at least, not at first.”).
See e.g., Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy, White House 9 (Feb. 23, 2012), http://www.whitehouse.gov/sites/default/files/privacy-final.pdf [http://‌perma.cc/2EEV -ZFCZ] (“To meet this challenge, the Consumer Privacy Bill of Rights carries FIPPs [Fair Information Practice Principles] forward in two ways. First, it affirms a set of consumer rights that inform consumers of what they should expect of companies that handle personal data. The Consumer Privacy Bill of Rights also recognizes that consumers have certain responsibilities to protect their privacy as they engage in an increasingly networked society.”).
Aleecia M. McDonald & Lorrie Faith Cranor, The Cost of Reading Privacy Policies, 4 I/S 543, 565-68 (2008); 250,000 Words of App Terms and Conditions, Norwegian Consumer Council (May 24, 2016), http://‌http://www.forbrukerradet.no/side/250000-words-of-app-terms-and -conditions [http://‌perma‌.cc/RK5B-4E5N] (“The Norwegian Consumer Council has downloaded the terms of service and privacy policies for apps that you would find on an ‘average’ mobile. Together they exceed the New Testament in length—and would take more than 24 hours to read out loud.”).
Lior Jacob Strahilevitz, A Social Networks Theory of Privacy, 72 U. Chi. L. Rev. 919, 923-25 (2005).
See Helen Nissenbaum, Privacy in Context 91 (2010) [hereinafter Nissenbaum, Privacy in Context] (critiquing the “public/private” dichotomy); Daniel J. Solove, The Digital Person: Technology and Privacy in the Information Age 42-43 (2004) (critiquing the “secrecy paradigm”); Helen Nissenbaum, Privacy as Contextual Integrity, 79 Wash. L. Rev. 119, 136-37 (2004) [hereinafter Nissenbaum, Privacy as Contextual Integrity]; Helen Nissenbaum, Protecting Privacy in an Information Age: The Problem of Privacy in Public, 17 L. & Phil. 559, 570 (1998) [hereinafter Nissenbaum, Protecting Privacy]; Strahilevitz, supra note 36, at 924.
Romano v. Steelcase Inc., 907 N.Y.S.2d 650, 657 (Sup. Ct. 2010) (quoting Dana L. Fleming & Joseph M. Herlihy, What Happens When the College Rumor Mill Goes Online? Privacy, Defamation and Online Social Networking Sites, Bos. B.J. 16, 16 (Jan./Feb. 2009)).
Nissenbaum, Privacy in Context, supra note 37, at 6-7; Nissenbaum, Privacy as Contextual Integrity, supra note 37, at 124; Nissenbaum, Protecting Privacy, supra note 37, at 581-82.
Brunton & Nissenbaum, supra note 3, at 45 (“The house of privacy has many rooms. Some are concerned with the integrity of family life, some with state oppression (now or in the future), some with utility and value of data, and some with a true inner self that can only emerge in anonymity, and many have intersections and communicating doors.”).
Id. at 59 (“There are situations in which many people may periodically find themselves obligated to give things up, with uncertain consequences and without a clear mechanism for reasserting control—moments when obfuscation can play a role, providing not a comprehensive military-grade data-control solution (though it may be usefully combined with such a solution) but an intuitive approach to throwing up a bit of smoke.”).
Id. (“Martyrdom is rarely a productive choice in a political calculus; as straightforward as the rational-actor binary of opting in or out may be, a choice between acceptance and dropping off the edge of the (networked) earth isn’t really a choice at all.”).
See Woodrow Hartzog & Evan Selinger, Surveillance as Loss of Obscurity, 72 Wash. & Lee L. Rev. 1343, 1355 (2015) [hereinafter Hartzog & Selinger, Surveillance]; Woodrow Hartzog & Frederic Stutzman, The Case for Online Obscurity, 101 Calif. L. Rev. 1, 4 (2013) [hereinafter Hartzog & Stutzman, The Case for Online Obscurity]; Woodrow Hartzog & Frederic Stutzman, Obscurity by Design, 88 Wash. L. Rev. 385, 388 (2013) [hereinafter Hartzog & Stutzman, Obscurity by Design]; William McGeveran, The Law of Friction, 2013 U. Chi. Legal F. 15, 18; Neil M. Richards, The Perils of Social Reading, 101 Geo. L.J. 689, 692 (2013); Evan Selinger & Woodrow Hartzog, Obscurity and Privacy, in Routledge Companion to Philosophy of Technology (Joseph Pitt & Ashley Shew eds., forthcoming 2017), http://‌ssrn.com/abstract=2439866 [http://perma.cc/VN3R-FGBU]; Harry Surden, Structural Rights in Privacy, 60 SMU L. Rev. 1605, 1607 (2007); Woodrow Hartzog & Evan Selinger, Obscurity: A Better Way To Think About Your Data Than ‘Privacy,’ Atlantic (Jan. 17, 2013) [hereinafter Hartzog & Selinger, A Better Way], http://‌http://www.theatlantic.com‌/technology‌/archive/2013‌/01/obscurity-a-better-way-to-think-about-your-data-than-privacy/267283 [http://‌perma‌.cc/FA9K-B2TQ].
See, e.g., Alexandra Benham & Lee Benham, The Costs of Exchange, in The Elgar Companion to Transaction Cost Economics 107, 107-08 (Peter G. Klein & Michael E. Sykuta eds., 2010); Douglas W. Allen, Transaction Costs, Simon Fraser U. (1999), http://www‌.sfu.ca‌/~allen/allentransactioncost.pdf [http://perma.cc/8UZS-6QN5].
For sources exploring obscurity theory, see Hartzog & Selinger, Surveillance, supra note 45; Hartzog & Stutzman, The Case for Online Obscurity, supra note 45, at 4; Hartzog & Stutzman, Obscurity by Design, supra note 45, at 388; Selinger & Hartzog, supra note 45; and Hartzog & Selinger, A Better Way, supra note 45.
McGeveran, supra note 45, at 18 (“In the physical world, too much friction can impede movement or even start fires, but too little would cause objects to slide off tables and cars off roads. The key to online disclosures also turns out to be the correct amount of friction, not its elimination.”); Richards, supra note 45, at 692 (“[S]ocial reading and frictionless sharing menace our intellectual privacy.”).
Surden, supra note 45, at 1607 (“Structural constraints are regulators of behavior that prevent conduct through technological or physical barriers in the world. These barriers make certain conduct costly.”).
See generally Chris Jay Hoofnagle, Federal Trade Commission Privacy Law & Policy (2016) (giving numerous examples of privacy scams investigated and punished by the Federal Trade Commission (FTC)).
See Chris Jay Hoofnagle, Big Brother’s Little Helpers: How ChoicePoint and Other Commercial Data Brokers Collect and Package Your Data for Law Enforcement, 29 N.C. J. Int’l L. & Com. Reg. 595 (2004). These companies collect information from other data collectors that have a more direct relationship with the data subjects, such as government and social media. Id.
See generally Symposium, Privacy and Big Data, 66 Stan. L. Rev. Online 25 (2013) (providing examples of big data uses outside information relationships).
Andrew D. Selbst, Disparate Impact in Big Data Policing (Aug. 5, 2016) (unpublished manuscript),http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2819182 [http://perma.cc‌‌/GK4C-F4GP]; Clare Garvie, Alvaro M. Bedoya & Jonathan Frankle, The Perpetual Line-Up: Unregulated Police Face Recognition in America, Geo. L. Ctr. on Privacy & Tech. (2016), http://www.perpetuallineup.org/sites/default/files/2016-10/The%20Perpetual‌%20Line-Up‌%20‌-%20Center%20on‌%20Privacy%20and%20Technology%20at‌‌%20Georgetown‌%20‌Law‌.pdf [http://perma.cc/CXT7-9YWG]; Zack Whittaker, Britain Has Passed the ‘Most Extreme Surveillance Law Ever Passed in a Democracy,’ ZDNet (Nov. 17, 2016, 8:00 AM GMT), http://‌http://www.zdnet.com/article/snoopers-charter-expansive-new‌-spying‌-powers-becomes -law [http://perma.cc/2XAV-X4VR].
Heather Dockray, There’s Already a Plan To Fight Trump’s Muslim Registry, and It’s Brilliant, Mashable (Nov. 17, 2016), http://mashable.com/2016/11/17/ways-to-fight-muslim-registry [http://perma.cc/9NNL-QKBX]; Taj James, I Pledge To Register as Muslim If Trump Is Allowed To Take Power and Starts a Registry, MoveOn Petitions, http://‌petitions‌.moveon‌.org/sign/i-pledge-to-register [http://perma.cc/AX7F-RJ5S]. But see Stopping the ‘Muslim Registry’: A Serious Approach, Samir Chopra (Nov. 17, 2016), http://samirchopra ‌.com‌/2016/11/17/stopping-the-muslim-registry-a-serious-approach [http://‌‌perma.cc‌/99UC -Y9YB].
See generally Dennis D. Hirsch, The Glass House Effect: Big Data, the New Oil, and the Power of Analogy, 66 Me. L. Rev. 373 (2014) (illustrating and exploring the consequences of the “privacy is the new oil” metaphor).
See Anne Wells Branscomb, Who Owns Information? 3 (1994); Daniel J. Solove, Understanding Privacy 1, 24 (2007) (“One of the most predominant theories of privacy is that of control over personal information.”); Alan F. Westin, Privacy and Freedom 7 (1967) (“Privacy is the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.”); Randall P. Bezanson, The Right to Privacy Revisited: Privacy, News, and Social Change 1890-1990, 80 Calif. L. Rev. 1133, 1135 (1992) (“I will advance a concept of privacy based on the individual’s control of information . . . .”); Charles Fried, Privacy, 77 Yale L.J. 475, 482-83 (1968) (“Privacy is not simply an absence of information about us in the minds of others; rather it is the control we have over information about ourselves.”); Ian Goldberg et al., Trust, Ethics, and Privacy, 81 B.U. L. Rev. 407, 418 (2001) (defining “privacy” in terms of “a person’s ability to control the flow of his own personal information”); Oscar M. Ruebhausen & Orville G. Brim, Jr., Privacy and Behavioral Research, 65 Colum. L. Rev. 1184, 1189 (1965) (stating that the “essence of privacy” is the “freedom of the individual” to decide which personal information will be “shared with or withheld from others”).
For years, as long as the data subject was given notice of data collection but “chose” to disclose anyway, data collectors largely operated without restriction. Daniel J. Solove & Woodrow Hartzog, The FTC and the New Common Law of Privacy, 114 Colum. L. Rev. 583, 592 (2014).
Under the third party doctrine, “information shared even with trusted ‘third parties’ loses a reasonable expectation of privacy under the Fourth Amendment, and with it, the protection of the warrant requirement.” Neil M. Richards, The Third-Party Doctrine and the Future of the Cloud, 94 Wash. U. L. Rev. (forthcoming 2017) (manuscript at 3) (on file with authors). The doctrine has been a source of controversy. See, e.g., Orin S. Kerr, The Case for the Third-Party Doctrine, 107 Mich. L. Rev. 561, 563 (2009) (arguing that critics of the third party rule overlooked its advantages and have overstated its weaknesses). But see Jack M. Balkin, Information Fiduciaries and the First Amendment, 49 U.C. Davis L. Rev. 1183, 1230 (2016) (arguing against the third party doctrine’s assumption that when people disclose information to a third party, the disclosers have “no reasonable expectation of privacy in the information” and proposing, instead, that many third parties “owe us fiduciary duties or duties of confidentiality”); Kiel Brennan-Marquez, Fourth Amendment Fiduciaries, 84 Fordham L. Rev. 611, 611, 616 (2015) (arguing that the third party doctrine should be limited where a person shares information with an “information fiduciary”); Richards, supra (manuscript at 4, 6) (arguing that the third party doctrine is inconsistent with both ancient principles and modern contexts of Fourth Amendment law).
See Woodrow Hartzog, There Is No Such Thing as “Public” Data, Slate (May 19, 2016, 9:15 AM), http://www.slate.com‌/articles/technology‌/future_tense‌/2016/05/okcupid‌_s_data‌_leak‌_shows‌_there_s_no_such_thing_as_public_data.html [http://‌perma.cc‌/C443‌-6AGQ].
See generally Daniel J. Solove, Nothing To Hide: The False Tradeoff Between Privacy and Security (2011) (critiquing the “nothing to hide” fallacy).
There have been notable exceptions, however. See, e.g., Edward J. Bloustein, Individual and Group Privacy (1978); Julie E. Cohen, Configuring the Networked Self: Law, Code, and the Play of Everyday Practice (2012); Joshua A.T. Fairfield & Christoph Engel, Privacy as a Public Good, 65 Duke L.J. 385 (2015); Rafi M. Goldberg et al., Trust in Internet Privacy and Security and Online Activity (Nat’l Telecomm. & Info. Admin., Working Paper, Aug. 31, 2016), http://ssrn.com/abstract=2757369 [http://‌perma.cc‌/ZBG7-4ZZC]; Robert H. Sloan & Richard Warner, “I’ll See”: How Surveillance Undermines Privacy by Eroding Trust (Mar. 14, 2016) (unpublished manuscript), http://ssrn.com‌/abstract=2747435 [http://perma.cc‌/M4ND-F59L]. See generally Social Dimensions of Privacy: Interdisciplinary Perspectives (Beate Roessler & Dorota Mokrosinska eds., 2015) (offering interdisciplinary commentaries on the social aspects of privacy); Dennis D. Hirsch, Privacy, Public Goods, and the Tragedy of the Trust Commons: A Response to Professors Fairfield and Engel, 65 Duke L.J. Online 67 (2016) (expanding on the work of Professors Joshua Fairfield and Christoph Engel, supra); Katherine J. Strandburg, Freedom of Association in a Networked World: First Amendment Regulation of Relational Surveillance, 49 B.C. L. Rev. 741, 741 (2008) (applying freedom of association rights to the issue of network surveillance); Ari Ezra Waldman, Privacy as Trust: Sharing Personal Information in a Networked World, 69 U. Miami L. Rev. 559, 561 (2015) (arguing that privacy law should protect “relationships of trust”).
Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193 (1890). But see Neil M. Richards & Daniel J. Solove, Privacy’s Other Path: Recovering the Law of Confidentiality, 96 Geo. L.J. 123, 125 (2007) (arguing that, contrary to conventional wisdom, “Warren and Brandeis did not invent the right to privacy . . . but instead charted a new path for American privacy law”).
William L. Prosser, Privacy, 48 Calif. L. Rev. 383, 388-89 (1960); see Neil M. Richards & Daniel J. Solove, Prosser’s Privacy Law: A Mixed Legacy, 98 Calif. L. Rev. 1887, 1924 (2010).
Privacy Act of 1974, 5 U.S.C. § 552a (2012); Stored Communications Act, 18 U.S.C. §§ 2701–2712 (2012); Video Privacy Protection Act, 18 U.S.C. § 2710 (2012).
Julie E. Cohen, Information Privacy Litigation as Bellwether for Institutional Change, 66 DePaul L. Rev. (forthcoming 2017), http://ssrn.com/abstract=2833922 [http://perma.cc‌/25HR-JCAS]; see, e.g., Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) (discussing statutory law); Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138 (2013) (discussing constitutional law).
Cf. Spokeo, 136 S. Ct. at 1544-45; Clapper, 133 S. Ct. at 1142-43; Laird v. Tatum, 408 U.S. 1, 13 (1972) (imposing such requirements in the data-gathering context).
In re Warrant To Search a Certain E-Mail Account Controlled & Maintained by Microsoft Corp., 829 F.3d 197 (2d Cir. 2016).
In addition to the authors themselves, other critics have noted the ethical issues inherent in obfuscation. See Rob Horning, Hide and Seek: The Problem with Obfuscation, L.A. Rev. Books (Nov. 10, 2015), http://lareviewofbooks.org/article/hide-and-seek-the-problem -with-obfuscation [http://perma.cc/3JCJ-WSZC]; Evan Selinger, Internet Privacy: Stepping Up Our Self-Defense Game, L.A. Rev. Books (Nov. 10, 2015), http://lareviewofbooks .org‌/article‌/internet-privacy-stepping-up-our-self-defense-game [http://perma.cc/MX73 -TKHA]. The authors themselves anticipate many of these objections, see, e.g., Brunton & Nissenbaum, supra note 3, at 71 (“Whether means [of obfuscating] are acceptable may rest on numerous ethical factors but, as often, may depend on the interaction of ends with various contingent and contextual factors, whose consideration resides in the zone of the political.”), and devote a substantial portion of the book to defending the ethics of obfuscation, see id. at 63-83.
Woodrow Hartzog, Website Design as Contract, 60 Am. U. L. Rev. 1635, 1636-37, 1652 (2011); Allyson W. Haynes, Online Privacy Policies: Contracting Away Control over Personal Information?, 111 Pa. St. L. Rev. 587, 588 (2007); Joel R. Reidenberg et al., Disagreeable Privacy Policies: Mismatches Between Meaning and Users’ Understanding, 30 Berkeley Tech. L.J. 39 (2015); Joel R. Reidenberg et al., Privacy Harms and the Effectiveness of the Notice and Choice Framework, 11 I/S 485, 487-88 (2015).
See Daniel J. Solove & Woodrow Hartzog, Should the FTC Kill the Password? The Case for Better Authentication, 14 Privacy & Security L. Rep. (BNA) 1353, at *1 (July 27, 2015) (arguing that passwords are a weak authentication method because “[p]eople select poor passwords, reuse them on many sites and have difficulty remembering them”); Maritza Johnson, Serge Egelman & Steven M. Bellovin, Facebook and Privacy: It’s Complicated, Symp. on Usable Privacy & Security (SOUPS) 10 (2012), http://‌www‌.cs‌.columbia.edu‌/~smb/papers‌/a9‌_Johnson.pdf [http://perma.cc/ZDZ8-J939] (stating that Facebook users often fail to use the site’s available privacy settings to achieve a stated desire to block profile content from certain members of their friend networks).
See David Brin, Obfuscation: Protect Privacy by Destroying the Web!, Contrary Brin (Nov. 24, 2015), http://davidbrin.blogspot.com/2015/11/obfuscation-protect-privacy-by.html [http://‌perma.cc/WNZ6-XJKW] (“[W]hat has worked is not—and never has been—hiding. . . . In the future, elites will have all sorts of tools to defeat obfuscation.”).
See Don Norman, The Design of Everyday Things 26 (2013) (“Mental models, as the name implies, are the conceptual models in people’s minds that represent their understandings of how things work . . . . Conceptual models are often inferred from the device itself. Some models are passed on from person to person. Some come from manuals. Usually the device itself offers very little assistance, so the model is constructed by experience.”).
See Neil M. Richards, Digital Laws Evolve, Wired World 2015, at 83-84 (2015), http://ssrn.com/abstract=2523748 [http://perma.cc/4RUP-DMQC] (predicting that privacy-related challenges will increasingly be met with legal and regulatory solutions).
Erin Kelly, Patriot Act Provisions Expire as Senate Compromise Comes Late, USA Today (June 1, 2015), http://www.usatoday.com/story/news/nation/2015/05/31/nsa-cia-data-collection‌/28259481 [http://perma.cc/XQ3M-SZQV].
Cal. Penal Code § 1546 (West 2016). See generally California Electronic Communications Privacy Act (CalECPA) - SB 178, ACLU N. Calif. [hereinafter CalECPA], http://‌http://www.aclunc.org/our-work/legislation/calecpa [http://perma.cc/LKQ4-A8JJ] (discussing how CalECPA protects cloud-stored data with a warrant requirement).
In response to public outcry, at least twenty-five states have passed laws restricting the ability of employers to, among other things, access employees’ social media accounts. See generally State Social Media Privacy Laws, Nat’l Conf. St. Legislatures (July 6, 2016), http://www‌.ncsl.org/research/telecommunications-and-information-technology‌/state‌-laws-prohibiting‌-access-to-social-media-usernames-and-passwords.aspx [http://‌perma‌.cc/BBX5-6AU3] (listing such laws).
See generally Hoofnagle, supra note 51, at 67 (“The FTC . . . changed its structure in 2006 in order to formalize its privacy role, and started hiring technologists to advise the lawyers about technology.”); Solove & Hartzog, supra note 60, at 666 (“Until recently, the FTC has largely limited itself to the four corners of privacy policies . . . . The implications of the FTC’s expansion of enforcement and shift to consumer expectations over company representations are profound.”).
European law has affected American privacy law in a number of ways, most directly in the self-regulatory “Safe Harbor” program that American companies have had to use if they wished to process data about European citizens. In connection with FTC oversight of this voluntary program, the Safe Harbor agreement has had a major effect on the privacy work done in many American companies. See generally Kenneth A. Bamberger & Deirdre K. Mulligan, Privacy on the Ground: Driving Corporate Behavior in the United States and Europe 60, 188 (2015) (documenting that corporations view European privacy laws as establishing a “floor” that shapes compliance-oriented measures); Paul M. Schwartz, The EU-U.S. Privacy Collision: A Turn to Institutions and Procedures, 126 Harv. L. Rev. 1966, 1966 (2013) (“The [European Union] has played a major role in international decisions involving information privacy, a role that has been bolstered by the authority of EU member states to block data transfers to third party nations, including the United States.”).
Cal. Penal Code § 1546 (West 2016). See generally CalECPA, supra note 106 (explaining both CalECPA and the ACLU’s work in shepherding it through the California legislative process).
E.g., Mary Dudziak, Cold War Civil Rights: Race and the Image of American Democracy (2011) (discussing civil rights); Michael J. Klarman, From Jim Crow to Civil Rights: The Supreme Court and the Struggle for Racial Equality (2004) (discussing civil rights); John Mendeloff, Regulating Safety: An Economic and Political Analysis of Occupational Safety and Health Policy (1979) (discussing workplace safety); Daniel B. Rodriguez & Barry R. Weingast, The Positive Political Theory of Legislative History: New Perspectives on the 1964 Civil Rights Act and Its Interpretation, 151 U. Pa. L. Rev. 1417, 1427 (2003) (discussing civil rights).
See Richard Polenberg, Fighting Faiths: The Abrams Case, the Supreme Court, and Free Speech 218-28 (1987).
Richards & Hartzog, supra note 10 (manuscript at 36-48); Neil M. Richards & Woodrow Hartzog, Trusting Big Data Research, DePaul L. Rev. (forthcoming 2017), http://‌ssrn.com‌/abstract=2717868 [http://‌perma.cc/YYJ6-6BTJ]; Neil Richards & Woodrow Hartzog, Facebook’s New Digital Assistant ‘M’ Will Need To Earn Your Trust, Guardian (Sept. 9, 2015), http://‌http://www.theguardian‌.com‌/technology/2015/sep/09/what-should-we-demand‌-of -facebooks-new-digital-assistant [http://perma.cc/BV78-W8RS].
See, e.g., Russel Hardin, Trust and Trustworthiness 3 (2004); J. David Lewis & Andrew Weigert, Trust as a Social Reality, 63 Soc. Forces 967, 968 (1985).
See Balkin, supra note 61, at 1205-09; Ethan J. Leib, Friends as Fiduciaries, 86 Wash. U. L. Rev. 665, 672 (2009).
For additional perspectives on the relationship between privacy and trust, see Balkin, supra note 61, at 1205-09; Brennan-Marquez, supra note 61; Hirsch, supra note 64; Waldman, supra note 64, at 561; and Kirsten Martin, Transaction Costs, Privacy, and Trust: The Laudable Goals and Ultimate Failure of Notice and Choice To Respect Privacy Online, 18 First Monday (Dec. 2013), http://firstmonday.org/ojs‌/index.php/fm‌/article/view‌/4838/3802 [http://‌perma.cc‌/SY9L-YFHT].
Cf. Richards, supra note 1 (describing how uncontrolled surveillance regimes distort relationships by facilitating blackmail and subversive persuasion).
See M. Ryan Calo, The Boundaries of Privacy Harm, 86 Ind. L.J. 1131, 1158 (2011); Woodrow Hartzog & Daniel J. Solove, The Scope and Potential of FTC Data Protection, 83 Geo. Wash. L. Rev. 2230, 2277 (2015); Strahilevitz, supra note 36, at 948-53; Daniel Solove, When Is a Person Harmed by a Privacy Violation? Thoughts on Spokeo v. Robins, LinkedIn (May 17, 2016), http://www.linkedin.com/pulse/when-person-harmed-privacy-violation-thoughts-spokeo -v-daniel-solove [http://perma.cc/5KDC-2W2T].
See Woodrow Hartzog, Promises and Privacy: Promissory Estoppel and Confidential Disclosure in Online Communities, 82 Temp. L. Rev. 891 (2009); Waldman, supra note 64, at 615 (noting the role of trust in good faith and fair dealing assumed in contractual exchange).
See Woodrow Hartzog, Privacy’s Blueprint: The Battle To Control the Design of New Technologies (forthcoming 2017) (manuscript at 7) (on file with authors).
Ronald J. Krotoszynski, Jr., Privacy Revisited: A Global Perspective on the Right To Be Left Alone xvi (2016).
E.g., Olivia Solon, You Are Facebook’s Product, Not Customer, Wired UK (Sept. 21, 2011), http://www.wired.co.uk/article/doug-rushkoff-hello-etsy [http://perma.cc/XCG7-GCUY] (quoting an argument by the media theorist Douglas Rushkoff).
For a more extensive discussion of this topic in the context of Facebook’s proposed digital assistant technology, see Richards & Hartzog, supra note 120.
E.g., Jason Tanz, How Airbnb and Lyft Finally Got Americans To Trust Each Other, Wired (Apr. 23, 2014), http://www.wired.com/2014/04/trust-in-the-share-economy [http://‌perma.cc‌/QBC5-VMSA].
Consider in this regard the definition of an “unfair trade practice” under federal law, which requires exactly this kind of direct tradeoff to be actionable. See Federal Trade Commission Act § 5, 15 U.S.C. § 45(n) (2012) (preventing the Federal Trade Commission from “declar[ing] unlawful an act or practice” on the basis of unfairness “unless the act or practice causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition”). Or consider the commonly held belief that privacy and national security are zero-sum. See generally Solove, supra note 63 (debunking this myth).
For more insight on the privacy advantages of making information “hard but possible” to find, see Paul Ohm, Good Enough Privacy, 2008 U. Chi. Legal F. 1, 49-50. For a discussion of the virtues of Ohm’s account, see also Woodrow Hartzog, The Value of Modest Privacy Protections in a Hyper Social World, 12 Colo. Tech. L.J. 333, 347-49 (2014).
See Ira S. Rubinstein & Woodrow Hartzog, Anonymization and Risk, 91 Wash. L. Rev. 703 (2016) (advocating for an approach to protecting data that focuses on procedural safeguards and “minimizing risk of reidentification”).
See Elizabeth Weise, Apple v FBI Timeline: 43 Days that Rocked Tech, USA Today (Mar. 30, 2016, 10:46 AM), http://www.usatoday.com/story/tech/news/2016/03/15/apple-v-fbi -timeline/81827400 [http://perma.cc/W2MQ-N6XC] (providing a timeline of events from February 16, when a judge issued the initial order for Apple to help the FBI access a suspect’s iPhone, to March 29, when the judge vacated her original order).
Nora Ellingsen, The Microsoft Ireland Case: A Brief Summary, Lawfare (July 15, 2016, 10:34 AM), http://www.lawfareblog.com/microsoft-ireland-case-brief-summary [http://‌perma.cc‌/DN6Y-VJ5A] (summarizing Microsoft v. United States as holding that “the government cannot compel Microsoft . . . to turn over customer emails stored on servers outside the United States”).
See, e.g., Jon Russell, Google’s Latest Transparency Report Shows Record Government Data Requests, TechCrunch (July 19, 2016), http://techcrunch.com/2016/07/19/googles-latest -transparency-report-shows-record-government-data-requests [http://perma.cc/U5J7 -2BBX] (describing the transparency reports as “provid[ing] a glimpse at how international governments and states are trying to use and access our data” and “an indicator as to how much information Google . . . gives up in these cases”).
E.g., Companies To Spend $130 Billion on Cybersecurity in 2011, Consumer Rep. (July 26, 2011, 9:08 AM), http://www.consumerreports.org/cro/news/2011/07/companies-to-spend -130-billion-on-cybersecurity-in-2011/index.htm [http://perma.cc/73BQ-5XNN] (discussing efforts by U.S. companies to improve their cybersecurity).
See Jack M. Balkin & Jonathan Zittrain, A Grand Bargain To Make Tech Companies Trustworthy, Atlantic (Oct. 3, 2016), http://www.theatlantic.com‌/technology/archive‌/2016‌/10/information-fiduciary/502346 [http://perma.cc/K7EP-BX9C].
See Woodrow Hartzog, Chain-Link Confidentiality, 46 Ga. L. Rev. 657 (2012); Woodrow Hartzog, Reviving Implied Confidentiality, 89 Ind. L.J. 763 (2014); Richards & Solove, supra note 65, at 124, 151-52.
See, e.g., Privacy Act of 1974, 5 U.S.C. § 552a (2012); Virginia Government Data Collection and Dissemination Practices Act, Va. Code Ann. § 2.2-3801 (1976).
E.g., Cal. Penal Code § 1546 (West 2016) (requiring the government of California to get a warrant before it accesses, inter alia, data stored in the cloud).

References: v. 
 v. 
 v. 
 v. 
 v. 
 § 552
 § 2710
 v. 
 v. 
 v. 
 § 1546
 § 1546
 v. 
 § 5
 § 45
 v. 
 § 552
 § 2
 § 1546