Privacy in Cyberspace - Realtime Chat

Professor Arthur R. Miller, March 22, 1999

ProfessorMiller: Welcome to our first live class session!
  I hope you are all getting the hang of this software and are ready to engage in a spirited discussion.
  I'd like to start out by saying a few things about how I hope our hour together today will work
  I'm going to start out with a few comments about the material you read for today
  and respond to some of the discussions I saw you having.
  About halfway into the chat, I'll take questions from you.
  You can submit answers to questions I ask by using the "ask" command.
  The easiest way to do this is to type slash, followed by the word ask, followed by your question (or answer).
  IF this isn't making sense, hit the help button for more detailed instructions. If you still don't get the hang of things, don't worry
  All of you, when you signed up for the class, submitted names, email addresses, information about your jobs, your education and so forth. I wondered whether you might wonder what we would do with that information, whether you had any fear that we might misuse it in some way.
  Let me hear from someone who has some concern that someone here at Harvard might misuse the information, or if you are not afraid, tell me why you believe we will protect your privacy.
James asks: you are assuming I have attached value to the information I supplied...
ProfessorMiller: James, why don't you attach value to the information you gave us?
  are you really saying your information is worthless?
  I bet I can sell it to a direct mailer!
James asks: because I gave you no more than I freely make available to strangers
Sherry asks: How do you know we gave you information we consider private?
ProfessorMiller: Sherry and James both make comments that should make us think
  about what we consider private information
  Would your reaction be different if the information included your social security number?
  How about your age and work address and telephone number?
aldon asks: I've had my name and address given to may direct mailers. That doesn't really affect me. What about the concern about what other students might do with some of the information?
ProfessorMiller: Aldon doesn't seem concerned about direct mailers; he is worried about giving it to other students. Why?
  Are other students more frightening than direct mailers?
noragerp asks: how do you know that I gave accurate info?
ProfessorMiller: I suppose noragerp's comment has a frightening implication to it
  namely, is the best way to protect privacy to give out false information?
  doesn't that have negative side-effects in a society that is so dependent on accurate information?
Sherry asks: One hopes that direct mailers are subject to some kind of restraints that individuals (esp. anonymous individuals) are not.
ProfessorMiller: Sherry, why do you assume that direct mailers are subject to restraints?
  where do those restraints come from?
  Are they forms of self-restraint by companies, are they legal restraints, are they moral restraints?
  what kind of restraints on the use of personal information should we have in our society?
  Bobvdv seems to be concerned about this:
BobVDV asks: Can we really expect to retain control of information once one gives it our?
Sherry asks: I think there probably no real restraints. But there is the perception of some kind of legitimacy -- equivalent to a Better Biz Bureau or something
ProfessorMiller: Sherry's reaction is close to the truth. There really are no legal restraints on direct mailers, but the direct mail advertising bureau does try to impose a code of good practices on its members
  but that still leaves a very deep and philosophical question.
  is it every person for himself or herself in terms of protecting privacy, or should society create privacy principles that protect all of us?
  (something to think about for next week's topic)
fitz asks: The Network Associates "privacy policy" is to inform you that they will remarket any and all information you provide, unless you email or call them with specific instructions not to do so. What's interesting is NAI is the company which distributes PGP encryption software which many advocate using to protect one's privacy!
ProfessorMiller: Thanks for the info, fitz
  Notice something:
  Associates put the obligation on us to protect our privacy by requiring us to tell them "NO"
  Why shouldn't the rule be that no one can use our information without getting our express permission first?
  In other words, put the burden on them to get us to say, "YES"
  before we lose our privacy
Kerry asks: Restraints are worthless without confirmation. Direct mailers have not always followed their own policies- (i.e. using info only for marketing purposes)- recently a marketing firm sold information to a candidate who used it to confirm voters in a past election.
ProfessorMiller: Kerry's comment seems to suggest that we need rules.
  It also seems to suggest that rules sometimes get broken, so we need ways to enforce the rules.
James asks: ask/Perhaps a free market equilibrium- How much are you willing to "pay" for what I am willing to "supply"
ProfessorMiller: James, we seem to be going through a period in which certain businesses have come to appreciate that privacy can be bought and sold.
  After all, the U.S. is a free market economy, and we believe deeply in freedom of contract
  So, arguably, it's okay for some company to offer me a free computer if I am willing to give them all sorts of marketable data about myself
  does everybody believe in those principles, or should there be restrictions on the buying and selling or private data, even when there is a willing buyer and a willing seller?
  A couple of people have made comments about free speech and public information and--I guess they were Americans--the First Amendment.
  What's bugging you people?
  Tell me what's bothering you
Sherry asks: I think suspicion by individuals is rising. Firms that can overcome that suspicion will receive good information in return for a fair agreement. That is of value to both parties.
ProfessorMiller: Sherry seems to believe that it is rational to create a marketplace in private information that enables the information subject to be compensated for giving privacy up.
  Aren't there possibilities for abuse?
  Don't' people have to be informed about the value of privacy and the risks to them once it's lost before they can intelligently exercise their right to sell their privacy?
  Or do we ignore the unequal bargaining position that buyers and sellers often are in?
fitz asks: Giving individuals "power" over their own information arguably restores something which has been lost with the advent of technology, and resets the rules to favor the individual rather than governmental or commercial interests.
slb asks: This seems to be a new phenomenon. People may not yet be aware of the full implications of giving out all this personal information. We may see a rise in litigation surrounding this new privacy -for-sale attitude.
ProfessorMiller: Those are two intelligent comments about this current trend to make the buying and selling of personal information a commercial transaction.
  Any other thoughts out there?
rewell asks: what about the concept of equity and the bar against an unconscionable contract?
ProfessorMiller: There are limitations to the freedom to contract and courts will upset "bargains" when they are unconscionable
  but that is rare
  and notice something very important--you are invoking the law to protect privacy
  and the major aspect of this course will be about when the legal system should establish behavioral norms about the handling of personal information, and impose legal consequences for its misuse. That might offend some of you true believers in the freedom of the Internet, and those who believe that it can continue to exist as an unregulated--or self-regulated--space.
aldon asks: Is this "privacy for sale" attitude all that new? The financial markets have always been based on what information one trader has over another. Look at Rothschild and the Battle of Waterloo.
Sherry asks: Professor, anyone with a phone book, half a brain, and the will could find out the information that a direct mailer might be willing to pay me for. Why not take the better deal?
ProfessorMiller: In response to aldon, privacy for sale is a relatively new concept when viewed from the perspective of the privacy subject.
  in the past, privacy intrusions have occurred without compensation to the subject.
  It is only the attention being paid to this subject that has led some to understand that "at the least", we should pay for personal information rather than simply rip people off.
  Sherry, in modern direct marketing, the seller wants to know as much about the profile of the prospective buyer as possible.
  right down to religion, gender, sexual persuasion, political affiliation, health characteristics, etc., etc.
  where do we draw the line between allowing the direct mailer with "half a brain" to go forage, and what we will not allow these companies to do?
fitz asks: When a quantitative change in the availability of info makes a qualitative difference in individual circumstances, can any bargain or any amount of compensation really be equitable? Shouldn't the focus be on technological solutions to technological problems?
ProfessorMiller: So it's a move from difference in degree to difference in kind?
  Where do we get the technological solutions?
  At some point, we may need to legislate to give direction to the technology.
Roger D.H. asks: Isn't the first protection to gathering all this information in the individual providing it?
ProfessorMiller: If the individual is to be responsible for the information, though, he or she has to know what will be done with it.
dhirsch asks: Why is hacking into someone's electronic world any less intrusive than bugging their phone?
ProfessorMiller: dhirsch asks a question that several cyberspace pundits, notably Jamie Boyle, often ask --
  how is this technology different from the telephone?
  The US Supreme Court responded to the increasing ease of telephone wiretaps with
  its ruling in Katz that people had a legitimate expectation of privacy
  when speaking on the telephone.
  So even if the technology now made it easy to intercept those calls, the law would prevent
  law enforcement from eavesdropping without a prior warrant.
  Do you think we need another "Katz" for the Internet?
  Okay, let me make this more concrete and pose a question to the group.
  Probably most of you read about Intel's decision to put a serial number in its Pentium III chip. It caused a great deal of controversy - so much so that Intel back off (partially) and decided to give users the option to turn off the so-called "feature."
  Please pipe up, say "yes" if you think that we have a right to prevent Intel from putting that chip in.
BobVDV asks: Prof Miller, you say we need to legislate to give direction to the technology, but isn't technology moving faster than the legislature can keep up?
ProfessorMiller: Well, don't we still need a legal framework? Novell just came out with this "digital me" product
  to help Internet users manage the way their information goes out, but does that mean
  that nobody *not* using that software has any expectation of privacy anymore?
  Okay, I'm being told that it's time to wrap up.
  There are many more questions queued up here on screen that I'd like to discuss.
  I hope that you'll hold those questions over and ask them in your discussion sections.
  I'll be reading those threaded messaging discussions and will try and may drop in and post myself.
  Reminder: There will be no chat next week, since your TF will be on spring break.
  I very much look forward to seeing you in two weeks, on April 5th.
  Thanks and good night.
  Oh, and there will be a transcript of this chat available in the archive section of the site.
  - Arthur Miller