Past Releases and Reports
About Privacilla
Privacy Fundamentals
Privacy and Government
Privacy and Business
Online Privacy
Financial Privacy
Medical Privacy
Report your thoughts to Privacilla!
Your Source for Privacy Policy from a Free-market, Pro-technology Perspective

Click to return to list of releases and reports

Home > Past Releases and Reports > Remarks to the Panel Entitled "Constitutional Problems of High Tech Surveillance" at the Georgetown Journal of Law and Public Policy Symposium on Security, Technology and Individual Rights: The Convergence of Our History, Our Ideals and Our Innovative Spirit

Prepared Remarks of Jim Harper, Editor of, to the Panel Entitled "Constitutional Problems of High Tech Surveillance" at the Georgetown Journal of Law and Public Policy Symposium on Security, Technology and Individual Rights: The Convergence of Our History, Our Ideals and Our Innovative Spirit

March 28, 2003

I put a great deal of importance in speaking to you here today because I was an Editor-in-Chief when I was in law school. My journal did a symposium like this one and I learned about some issues I hadnít considered very much before. Itís fair to say that the experience brought me to Washington and caused me to devote my career to working on public policy issues.

It was a huge mistake, people. Huge mistake.

I donít know if any of you are familiar with Privacilla, but those of you who are probably know that my strength is advocating for market-based solutions to privacy problems. You and I would both expect to find me on the panel that is coming up this afternoon on ďMarket Responses.Ē But the more I work on privacy policy, the more I am recognizing that we need to develop our thinking on the topic at a fundamental level. So I lobbied the organizers to be on this morningís constitutional panel. I want to share with you some constitutional and definitional thinking about privacy.

Privacilla is a Web-based think-tank devoted to privacy as a public policy issue. We try to cover the entire range of issues, including privacy fundamentals, privacy from government and privacy in the private sector. Within the private sector, we break it down between financial, medical, and online privacy.

I am also an Adjunct Fellow with The Progress & Freedom Foundation and I run a consulting firm called PolicyCounsel.Com. In the latter capacity, I consult to clients on privacy and many other issues. For that reason, do keep in mind my potential for bias, as you would any privacy advocate.

First Iím going to talk about why itís important to define privacy. Then Iím going to give you my definition of privacy and fit it into our scheme of individual rights. Finally, Iím going to give you an argument about privacy and government surveillance that I think is novel and interesting ó and maybe right.

Believe it or not, I have to talk to you first about why itís important to define privacy. Iím surprised that I have to go into that, but I sat on a panel of Washingtonís privacy gurus the other day and most of them either didnít care about defining privacy ó they just wanted to talk around it ó or they affirmatively advocated leaving the concept undefined.

You law students here today know the definition of battery, you know when property has been abandoned, and you know when a contract has been formed ó because, through the haze of all that Socratic dialogue, your professors taught you some doctrine. The black letter law is there for you.

If battery was undefined, who would get to decide when someone had been a victim of it? Maybe the police if you could convince them that something had been done to you. Maybe regulators if they decided some bad behaviors should be called battery. Maybe ďanti-battery advocates.Ē Maybe politicians.

As citizens, we certainly wouldnít know when we have been battered, or who to complain to if we think weíre the victims of a battery. The scope of the crime and tort known as battery wouldnít be subject to the rule of law. It would be subject, instead, to the rule of politics. Itís mind-bending to think of a world where battery is undefined, and it should be mind-bending that we operate in a world where privacy is undefined.

If we donít arrive at a definition of privacy, it becomes a political football rather than a cherished value. Your privacy depends on how well interest groups advocate for privacy and the dumb luck of whether they argue for the version of privacy that you want. Privacy certainly doesnít end up in the hands of consumers. I donít think thatís the zone we want to be in.

Essentially, defining privacy and other key legal terms organizes and distributes power in the society away from the elites and out to the people. When politicians or regulators pass laws claimed to give us privacy without defining the term, as they did in the Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act, power remains with the bureaucrats and politicians.

I donít know if there are any privacy or information law classes being taught here at Georgetown today, but if there are, they should include a lot of time on the definition of privacy and other basic information policy concepts. If your professor tells you to study a bunch of statutes and take his or her word that they are about privacy, the professor is not a teacher, but a dictator. If you have skipped over definition and doctrine to go straight to policy, you are in a politics class, not a law class, and it doesnít belong in the law school.

So let me encourage you to be skeptical about every privacy claim you hear. Whenever someone tells me that they are an actor or a writer, I always ask them what restaurant they work at. (Itís not always funny, but itís supposed to be . . . .)

When you hear about privacy, you should do the same. Try to figure out the true interest that is under discussion. Very often itís crime control, as is the case in discussions of identity fraud. It can be security, and sometimes itís freedom from advertising. Sometimes, ďprivacyĒ is even put forward to prevent insurers from considering certain risks ó thatís a way of subsidizing victims of certain medical conditions. All these interests and arguments should be discussed in the light of day.

Thereís a 1999 case in the 10th Circuit, FCC v. U.S. West, 182 F.3d 1224, where the court was presented with a privacy claim by the Federal Communications Commission and the court didnít blink. It said ďWhat are you really talking about?Ē and found the governmentís interest in some amorphous Ďprivacyí protection insufficient to abridge First Amendment freedom of speech.

So I'd like to weigh in with the definition of privacy weíve developed at Privacilla. Our definition of privacy is this: Privacy is a subjective condition that individuals enjoy when two factors are in place ó legal ability to control information about oneself, and exercise of that control consistent with one's interests and values.

To a group of lawyers and law students, I donít have to parse this definition too much. Most importantly, privacy is a subjective condition. It is personal. That means that my sense of privacy is my own, and yours is yours. Legislators and regulators canít pass laws to tell us we have privacy when we think we donít. Those laws can only represent guesses about what privacy might look like.

The first factor I mentioned is the legal power to control information. This essentially asks whether the law has deprived people of power to control information in some way. There are thousands of laws and regulations that reduce peopleís power over information about themselves. Let there be no mistake about the good intentions of these laws, but they undermine privacy all the same. Indeed, there is a neat correlation between how much laws are designed to help people and how much they undermine privacy. The helping hand of government strips away privacy before it goes to work.

Of course, many laws also protect privacy ó or, more accurately, support the privacy-protecting choices we make. These are laws like contract, tort, trespass, and property.

The second factor I mentioned is exercise of control consistent with our interests and values. Ultimately, the only thing that can deliver privacy on the terms consumers want it is consumer awareness and education. If you donít know how information moves in the Information Economy, you canít reject practices that you disapprove of. It is the actions of educated and aware consumers in the marketplace that determine whether the uses made of information are acceptable.

This is the area where pro-regulation privacy advocates are incredibly keen to impose their own values on the rest of us. Nobody could possibly want to get various types of advertising, they assume, so letís strike the balance heavily in favor of privacy and heavily against information use by marketers. Consumers get nothing back from sharing of financial information, they think, so letís make it all private. This overlooks the fact that the credit reporting system returns hundreds of dollars to families each year by aggregating information that is otherwise essentially worthless.

A lot of these folks also characterize privacy as an individual right. For years now, there has been a sort of grade inflation among advocates who try to give constitutional status to everything important. It would be kind of reassuring to have everything important be a constitutional right, but once that was true constitutional rights would have lost any meaning.

I take a back seat to nobody in arguing for privacyís importance, but it is not a civil or constitutional right. Consider other important conditions like happiness, success, or piety. Are they rights? No, but they are essential conditions and parts of the social fabric.

Rather, privacy is a condition that we protect and enjoy in the shelter of other rights. The Fourth Amendment contains no right to privacy, but it allows us to protect privacy by excluding government officials, when we exclude everyone else, from examining our houses, papers, and personal effects.

There is not an individual right to privacy. And privacy is not granted by governments. But individual rights are the most important privacy protections because they shield us from governments.

When it comes to privacy, there is no greater threat than governments. They, alone, have the power to take information from people by force of law. They, alone, can change the uses they make of information even in the face of contrary statements at the time of collection. There is no entity in the private sector that can decide, based on information it collects about you, to take your money or put you in jail. The real action on privacy is now, and always has been, privacy from government

So let me turn to surveillance and lay out an argument that even public surveillance can offend the Fourth Amendment expectation-of-privacy test from Katz v. United States. It is based on boiling privacy down to what it is ó exercise of control over personal information ó and I use the recent case of Kyllo v. United States, which was decided in June of 2001.

As you probably know, in the Kyllo case, agents of the U.S. Department of the Interior without a warrant used an Agema Thermovision 210 thermal imager on the defendantís triplex at Rhododendron Drive in Florence, Oregon. The imager detected significantly more heat over the roof of the garage and on a side wall of Kylloís home than elsewhere on the premises. Using this information, the agents got a warrant, searched the home, and found the grow-lights and drugs they suspected.

The Supreme Court reversed Kylloís conviction, finding that when a novel device like the thermal imager is used "to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a Ďsearchí and is presumptively unreasonable without a warrant."

There are many ways to distinguish the facts in Kyllo, and future cases will decide its meaning better than I know how, but boiled down to its essence, the Court found that the reasonableness of a search is to be judged in light of common privacy-protecting practices, not in light of privacy protection from the best technologies available. Thermal imagers are not in general public use so people desiring to keep the hours of their sauna private from neighbors do not line their walls with asbestos.

Surveillance technologies today are not quite there yet, but public surveillance will soon include the capability to database terabytes of information and to determine identity, through facial recognition software or optical character recognition for reading license plates. There may be databased DNA-sniffers as well. These have the potential to allow authorities to learn where in a city a particular car has traveled or where a particular person walked to or from, on a given day or historically. This is the potential, but it should not be permissible with non-suspects.

Now, only a simpleton thinks that you give up privacy when you go out in public. You only give up privacy in a few facts, such as the fact of where you are, the fact of what you look like and how you are dressed, facts about how you comport yourself, how you sound, and so on. You do not give up privacy in the contents of your head or wallet, your purpose in being outside, and so on.

The folks on the prosecution side of the Kyllo case undoubtedly made the argument that people give up privacy in heat emanating from their house because it can be observed from a public street, but that argument was rejected. Kyllo turned on what reasonable actions people take to keep facts private. Given the state of current technology, people who live in houses put up walls to conceal what goes on within. Likewise, people who walk or drive the streets keep their destinations private by keeping their mouths shut.

A networked surveillance system that can identify people and trace their movements presents, I think, a decent Fourth Amendment problem if you dig down to the essence of what privacy is and the essence of what Fourth Amendment law is. Privacy is about exercise of control over facts, and the Fourth Amendment prevents officials from depriving non-suspects of control over facts that they have taken reasonable steps to safeguard.

I am not a constitutional scholar, but a loud-mouthed privacy activist. So I humbly submit this thesis to you and my colleagues on the panel. I am not so humble in my claim that privacy must be defined if we are going to have successful discussions about it and if we are going to have a society where privacy is adequately protected.

©2000-2003 All content subject to the Privacilla Public License.