Communications of the ACM

Communications of the ACM

Legally Speaking: The Individual in the New Age

By Andrew Grosso
Communications of the ACM, July 2001, Vol. 44 No. 7, Pages 17-20
10.1145/379300.379325
Comments

I want to be an individual.

This is a proud statement to make. In many countries, in many times, people have been persecuted for this ideal and for their attempts to live up to it. Many are still persecuted today. What worries me is the real danger that, in the age of computing and the Internet, this ideal may be quietly facing a final stand. And it may not survive.

First I define what I mean by being an individual. To me, it means the right to separate myself from others, and particularly the right to stand separate from the state. It is this latter characteristic that most concerns me.

We are familiar with the debate on privacy. The words "Clipper Chip," "CALEA," "encryption," and "Carnivore" are hot-button topics in the computer professional community. Yet, privacy is but one aspect of what it means to be an individual. Remove privacy, and one can still be an individual, albeit at great risk of ridicule and retribution. However, remove the concept of the individual and privacy becomes meaningless: there can be no right to keep private what belongs to the state; if I am not an individual, what I am and what I do belongs not to me, but to the state.

So why is this distinction important? Because it rephrases the debate. Dilution of privacy can be justified on many grounds, usually in the name of law enforcement, security, and safety; the U.S. Constitution permits "reasonable" invasions of privacy. Dilution of the individual, however, is more serious, and more rarely permitted. Witness the "beyond a reasonable doubt" standard in criminal cases. Since we are, in fact, engaged in a war over the right of the individual to remain separate from the state, we must frame the question correctly, to take back the quarter given when mere privacy is the issue.

Back to Top

The Wrong Question

Has the question been wrongly framed? Yes. Take as a case study the CALEA¹ and Clipper Chip controversies of the last decade. In both instances, adversaries to these initiatives opposed them as intrusions on the people's right to privacy. Let us examine this approach.

Liberty can no more survive anarchy than it can despotism, except perhaps in name only. Thus, Western jurisprudence permits intrusions on "private communications." Granted, burdens must be met; criminal conduct must be suspected; probable cause must be established, usually by investigation; court orders must be obtained; procedures must be followed. However, once these burdens are met, surreptitious monitoring of a "private communication" is authorized and endorsed to satisfy urgent societal needs. In a system where people live and interact together, such intrusions are necessary to ensure order.

The emphasis in Western jurisprudence is on recognizing that what is occurring is an intrusion. We allow an individual to take actions that would give him or her an expectation of privacy. That is, we recognize that an individual has a right to seek protections for his or her "private" communications. Also, we (simultaneously) recognize the right of the state to try to overcome these protections. This becomes a game, and there are no absolutes. The individual has no absolute expectation of privacy, as the state may always figure out a technological means to legally overcome the protections he or she has implemented. On the other side of the ledger, the state can never be certain it has uncovered all the communications made by a targeted individual, and can never be sure that it can overcome all the technological means a target may use to protect communications. The important factor here is that the state is not preventing a person from attempting to protect his or her communications; it is, rather, merely trying to listen in.

---

The individual has no absolute expectation of privacy, as the state may always figure out a technological means to legally overcome the protections he or she has implemented.

---

This game is more than just a game. As long as it is organic—that is, active and evolving—there is a meaningful independence of the individual from the state, and a means to ensure that the individual will not devolve to a mere appendage of the state.

Let us return to CALEA and the Clipper Chip. What did they propose? It was more than simple intrusion. It was the elimination of the necessity for intrusion, as they removed the ability of individuals to attempt to protect themselves. Clipper would have forbade, as a legal matter, the use of effective encryption by private individuals. A government would always have access to the keys for any encryption a person might legally use. CALEA, which is now law, mandates that all telecommunications facilities transmit to an off-site, government location any communication that passes through those facilities, upon U.S. government request. Our commercial telecommunications facilities serve as ears for the state, and I am not allowed to avoid them if I wish to use local or global telephone lines.

What is so offensive about Clipper and CALEA is not that they contradict society's notions of fair intrusion on private communications, it is that they remove the ability of the individual from acting as an individual in trying to protect his or her communications. The rules of this game permit but one player.

Back to Top

Anonymity vs. Accountability

David Brin, a popular science fiction writer (and a trained scientist) wrote The Transparent Society (1998). The premise of this book is that privacy can no longer be protected, and, for that reason, we must turn to the opposite of privacy so society can function. In Brin's world, everyone's actions are observable by everyone else, all the time—full accountability for all.

Brin's idea might work, after a fashion, if the concept of the state did not exist, and if every person was on equal footing in terms of resources, power, and, most importantly, ethics. This, however, is not reality. People in power and the state itself will always be able to shield what they want from the prying eyes of the masses. Those masses will then be left to account to the state. With such full accountability, the individual could no more stand up to the state than could an inmate stand up to a prison warden. The rules of the new game are not fair if only one player can make use of all the rules.

Back to Top

Quantity to Quality

I now turn to Whitfield Diffie and Susan Laundau, mathematicians both. They authored their own book entitled Privacy on the Line: The Politics of Wiretapping and Encryption (1998). A major tenet in their book is that technology's increasing ability to analyze available information has produced qualitative changes in what U.S. courts perceive to be reasonable surveillance. Let us examine this observation.

There is a principle in law that what is available to the public is not accorded privacy protections vis-à-vis the state. Here is an obvious example: Suppose I walk outside of my home, down the street, and visit a neighbor. Assume the local police are watching me, and videotape my every move. The police have not intruded upon my privacy. By stepping outside, by consenting to be seen by the public-at-large, the courts hold that I have no expectation of privacy in my journey.

Let us take another example. Suppose it is the day I was born. Medical records are maintained, in a computer database. I grow up. Scholastic records are maintained by computers. I start a career, marry, and have children. More records are maintained, by computers. I travel, use credit cards, use ATM machines, make telephone calls, file court cases, send email, surf the Web. More records are maintained, by computers. All of these records can be stored, retrieved, transferred, merged, and correlated—globally. Everything I have done since I was born can be retroactively tracked by the state. Is the state intruding upon my privacy?

The classical answer is no: by performing each of the these actions in the public arena, the courts would hold that I had no expectation of privacy in any of them. However, this doctrine was established before the technology advanced to the point where it was feasible for massive databases to be maintained, before it was feasible for people to use electronic media to conduct innocuous transactions, and before it was feasible for databases to be merged, correlated, and used to produce a day-by-day profile of my life from birth to death.

What has happened is that a quantitative change in the amount of public data the state can obtain and analyze has produced a qualitative change in the way the game is played between the individual and the state. I am accountable to the state, and I cannot hide as long as I wish to be part of normal society.

Technology's role in this debate is not yet done. Now, I wish to be alone. I stay indoors, in my home, behind my walls. Do I have an expectation of privacy? Years ago the walls of my own home would shut out prying eyes and ears. Today, thermal imaging and sound detection reduce their value as protectors. The heat and sound that escape from my house are in the public domain. So, I ask, do I retain an expectation of privacy in my own home?

Federal courts have already ruled on this question. The case concerned a defendant who admittedly was growing marijuana in his own home, and was using heat lamps to do so. The U.S. Department of Justice took the position that use of thermal imaging to identify these lamps did not intrude on any reasonable expectation of privacy, that its law enforcement agents merely "passively detected and recorded heat that escaped from the house." The U.S. Court of Appeals for the Ninth Circuit ruled in favor of the government, and the issue is now before the U.S. Supreme Court.²

Such "escaped heat" was not detectable when classic definitions of privacy were adopted. Should the Ninth Circuit's ruling stand, it would mean the following: the state will be able to continuously update its means of detecting our activities, while legislating away the legality of our attempts to conceal our activities, à la CALEA and Clipper.

The game has now drifted in one direction.

Back to Top

Whence Now?

I am not without hope. As an attorney, I seek the use of laws. There is no need to look too far: the enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people.³

These words were written more than 200 years ago. They comprise the Ninth Amendment of the U.S. Constitution.

What these words mean is the rights comprising liberty are not granted by the state to the people, but arise from the people and must be honored by the state. In simpler language, they are a concise mandate for the primacy of the individual over the state, depicting the wall that separates the two. Somewhere, among the varied and numerous rights with which each person is vested from birth, there lies one allowing the individual to separate from the state, and to take those steps reasonable and necessary to protect oneself from its modern means of intrusion. If nothing more, the U.S. Constitution, and its Ninth Amendment, show us that law was intended to serve the individual as well as the desires of government.

Somehow it is fitting that a refuge of liberty in this age of technological surveillance should be a single sentence from the pen of those who could not have conceived of a computer, let alone an Internet. But, then, the concept of liberty is self-evident and eternal, and its expression should be simple. The authors of the U.S. Constitution told us we can use law as a means to ensure the liberty of the individual whatever each age may bring. We need only now find the will to do so in our own age.

Back to Top

Back to Top

The Digital Library is published by the Association for Computing Machinery. Copyright © 2001 ACM, Inc.

---

No entries found