º£½Ç´óÉñ

Opinion: The reasonable expectation fallacy

The ability to delete yourself from the Web doesn't really matter. What really matters in the age of advanced surveillance is the right to not be correlated. Technology is always watching and capturing you, but the correlation is where the danger lies. Laws can change that, but only if enacted soon.

Privacy

If I take your picture on the public street, I do not need to giveÌýyou any notice – and you have no basis to complain about it. IfÌýthere's visible light, your image is fair game.

My porch light has a motion sensor that can see as far as the publicÌýsidewalk. If you walk by, it will light up – and you have no basisÌýto complain that it captured your movement. If there's infraredÌýlight, you are fair game.

Even your heart emits unique electromagnetic pulses. What if I canÌýdetect and capture those signals? If there are microwaves, you areÌýfair game.
If you have a new car, it broadcasts several unique BluetoothÌýsignals. High-frequency radio? You're fair game.

The inexpensive Wi-Fi router in your home continuously advertisesÌýits name – the service set identifier – that was probably selectedÌýby you. That information is being broadcast on a 2.4GHz radio bandÌýthrough the air – and, so, that information is fair game.

Let's be rational and thus concrete: Wavelength does not matter.ÌýWhat is fair game to observe is independent of wavelength – I haveÌýthe right to capture what you emanate.

Even just in visible light, the technology is readily availableÌýtoday to capture and recognize your iris – increasingly used inÌýsecurity systems – from a distance of 50 yards. Facial recognitionÌýis feasible at 500 yards. The unique pattern of your gait can beÌýdetected in just 10 paces. Again, being concrete, does my right toÌýlook at you – and capture your identity and identifiers – dependÌýon what I'm looking for? Hardly.

Most privacy laws exist to block government actions. A few existÌýto block private institutional actions. But none exist to blockÌýindividuals' actions.

In the Supreme Court case , defendant Danny Lee Kyllo,Ìýa marijuana grower, argued that police use of a thermal imager toÌýdiscover the high-intensity lights growing marijuana in his garageÌýconstituted a search for which a warrant was necessary.

The Court held: "Where, as here, the Government uses a device thatÌýis not in general public use, to explore details of a private homeÌýthat would previously have been unknowable without physical intrusion,Ìýthe surveillance is aÌýFourthÌýAmendment 'search,' and is presumptivelyÌýunreasonable without a warrant."

Read that carefully – the requirement for a warrant exists solelyÌýwhere the device to be used to gather photons is "not in generalÌýpublic use."

As anyone knows, what the government and only the government hasÌýtoday, the rich will have tomorrow. What the rich have tomorrow theÌýlumpen proletariat will have it the day after tomorrow – it isÌýgeneral public use that removes any prohibitions on use by governmentÌýor other institutions.

Now consider the thermal imager. Fifteen years ago when Kyllo wasÌýdecided, the devices were not in general use. Now, they are readilyÌýavailable. One ad reads: "Multispectral imaging – maximizes detailsÌýand image sharpness, adds GPS location to images, self-calibratesÌýfor optimum image and accurate temperature calculation, combinesÌýinfrared with visual input, records audio with the video which isÌýdirectly stored in the iPhone photo gallery."

That description begins with "multispectral," meaning that itÌýcombines multiple wavelengths – visible light, infrared light, andÌýGPS radio. The number of emanations that are capturable by devicesÌýthat are in general public use is large and growing. You tell me,Ìýwhat does "appearing in public" mean as that variety grows? ThatÌýmultiple spectra are correlatable is hardly a surprise, but doesÌýyour intuition tell you that the net effect is additive, that eachÌýnew correlation adds "1" to some pre-existing sum?Ìý Or is the powerÌýof correlation such that each new one added does not increase a sumÌýthrough addition but a product through multiplication like a compoundÌýinterest sort of calculation?

This is the point: No society, no people need rules against thingsÌýthat are impossible. If your personal "expectation of privacy" isÌýbased on the impossibility of observability or even the impossibilityÌýof identifiability, then your logic, like that of the Supreme Court,Ìýis temporary and weak. A long view in the face of rapid technologicÌýchange is far harder.

In past months, well-informed individuals have warned aboutÌýadvances in artificial intelligence as being likely to introduceÌýirreversible unintended effects that are permanently incompatibleÌýwith fundamental values. In past months, well-informed individualsÌýhave warned about advances in genetic engineering as being likelyÌýto introduce irreversible unintended effects that are permanentlyÌýincompatible with fundamental values. I am here to say that I sideÌýwithÌýthose well-informed individualsÌýin both cases, and hope that they, and you, sideÌýwith me that advances in observability are introducing irreversibleÌýand unintended effects that are permanently incompatible withÌýfundamental values.

It is easy to drift toward "making the best be the enemy of theÌýgood." Baking radio frequency identity tags in your microwave doesÌýnot, in the end, do anything if your cellphone, Bluetooth gizmos,Ìýiris, and auto registration are each collected and then correlated.ÌýWe cannot – nor should we waste political capital trying to –Ìýserially forbid collections by name or by type or by wavelength.

We can only sabotage use. We must change liability law so thoroughlyÌýand so substantially that data acquisition is no different fromÌýstockpiling combinations of lethal chemicals that grow increasinglyÌýdangerous as their varieties increase. There is no mechanisticÌýdifference whatsoever between personalization and targeting saveÌýfor the intent of the analyst. To believe otherwise is to believeÌýin the Tooth Fairy. To not care is to abandon your duty.

Dan Geer is the chief information security officer forÌýIn-Q-Tel, a not-for-profit investment firm that works to invest in technology that supports the missions of the Central Intelligence Agency and the broader US intelligence community.

Ìý