PREMIUM SEARCH Search by job title, geography and build a list of executive contacts
Just after the September 11 terrorist attacks on the World Trade Center and the Pentagon, a number of companies called the FBI to offer up data they thought might be useful in tracking down the culprits. There were no court orders. No subpoenas. And handing over customer information violated just about every corporate privacy policy on the books. A surge of patriotism spurred the data-sharing, says privacy consultant Larry Ponemon. And it hasn't subsided: Nearly three months after the attacks, Ponemon says, most of those dozen-or-so outfits continue to hand over customer data to the FBI.
It's just one sign of how the privacy of nearly every American has been diluted in the past 10 weeks. By approving the Patriot Act in October, Congress made it infinitely easier for law-enforcement officials to collect more personal info legally. That far-reaching law has been accompanied by countless other calls for legislation to ramp up security -- all bolstered by overwhelming public support for just about anything that will increase America's safety.
The government's new powers of surveillance could quickly go too far, however. Sooner or later -- probably after the war in Afghanistan is over -- there will the type of backlash that has happened before, where a pendulum completes its initial arc and starts to swing back. Once that happens, there will be a hue and cry for new rules or regulations -- maybe even a long-needed federal privacy oversight agency -- that will start to limit the use of the most sweeping forms of surveillance against ordinary citizens. A look at the Patriot Act provides a sense of the dry tinder that's waiting to be ignited:
Phone Tapping: Before September 11, the probability of your phone being tapped was remote. That's still true, but the Patriot Act has increased the likelihood of a tap by a factor of 10, estimates Ponemon, CEO of the Privacy Council, a consultancy that advises corporations on privacy issues.
Here's why: Previous wiretap laws required government officials to convince a judge that there was cause to believe that, say, Jane Black was involved in criminal activity. Law enforcers no longer need to be so specific. They can simply say they believe a BusinessWeek Online correspondent is a suspect in criminal activity. The result, according to Ponemon, could be the monitoring of everyone's phones in the entire organization.
The new law also provides a lot of leeway for the police and intelligence gatherers to justify random and periodic monitoring of large groups of people, adds Ponemon. He predicts that, over the next year, software that can listen for key words, such as "anthrax" or "bomb," will be deployed across telecommunication networks in an effort to ferret out suspicious activity. That means that, even if you aren't a suspect, simply uttering one of those words in an innocent conversation could lead to your calls being monitored.
The Internet: The Patriot Act also expands the "pen register" statute to include e-mail and Internet surfing. Until now, pen register referred to law enforcement's ability to trace phone numbers called by suspected criminals. By broadening the concept to include the Internet, the statute allows officials to collect information such as the address and subject lines of an e-mail -- arguably the Internet equivalent of a phone number.
The law also requires Internet service providers (ISPs) to make their servers more law-enforcement friendly. They must either use technology that provides pen-register information on demand -- or allow the government to install "Carnivore," an FBI snooping technology that monitors the flow of communications across ISP networks. In practice, this isn't likely to affect the way large ISPs, such as EarthLink, AOL, and MSN, monitor data across their networks. These providers have the scale and the cash to install software that will be able to provide the FBI with information when necessary, and to do so without constantly monitoring of every user.
For the more than 7,000 small U.S. ISPs, however, it may mean installing Carnivore. Many will be happy to comply. Says David Stephens, the CEO of SpruceNet, an Denver-based ISP with about 1,500 customers: "The Feds can have whatever they want from me because I'm an American. If they want to install their own equipment, à la Carnivore, that's fine."
So far, SpruceNet has had no requests from the FBI, nor has any other ISP reported any requests from the agency regarding Carnivore. Still, Internet users wary of government monitoring might consider using a large ISP. And they should carefully read their ISP's terms of service to see how, and under what circumstances, information is handed to the government.
Biometrics: Much of the recent privacy furor surrounds facial-recognition technology, software that analyzes 80 points on the human faces and looks for a match in a database of terrorists and known criminals. The technology has been around for some time -- it was used to screen fans who attended Super Bowl XXXV in February, 2001 -- but it has gained momentum since the September 11 attacks. In recent weeks, airports in Oakland and Fresno, Calif., Providence, R.I., and Boston all have announced plans to use the technology to screen for terrorists.
Experts say that facial-recognition technology, if used only to scan for matches, doesn't really invade privacy. Rather, privacy advocates worry that the technology might be used to create a database of travelers, or that it's use might be widened to include driver's license photos, rather than just the FBI's most wanted list, in order to keep tabs on the travel habits of average Americans. Airport authorities that are installing the technology say they have no plans yet to expand the system.
Experts on both sides of the debate agree that, as biometric information becomes increasingly commonplace, it could pose a severe risk to privacy. Since September 11, Ponemon already has sat in on one meeting where a diet company discussed the possibility of buying information collected from sophisticated X-ray technology that sees through clothing. The idea: To match up scans over time and market diet products to individuals who may need to lose weight. But in the long run, Ponemon believes people will get used to the new technology. "We, as a society, will accept this as part of the cost of security," he predicts. "We'll probably become complacent, as we've become complacent about data sharing. This isn't science fiction. It's going to happen."
SWINGING BACK. Which brings us to the inevitable backlash. Though many of the provisions in the Patriot Act might make sense right now, history shows that their impact on ordinary citizens is likely to raise questions once the specter of terrorism fades. "In the past, there have been powers granted that, at the time, the public felt all right about. But as soon as they could look at it more objectively, the almost universal verdict was that it was an abuse of power," says David Sobel, general counsel for EPIC, a Washington D.C.-based privacy group.
Sobel points to the '60s as a good example. With the country divided over the Vietnam War, many citizens supported increased surveillance as a way to maintain order. By the mid-'70s, however, when the public learned the extent of what was happening, people were outraged. Why did the FBI bug Martin Luther King and intrusively monitor peace activists? And what was President Richard Nixon doing bugging Democratic National Committee headquarters at the Watergate?
That led to a series of laws that imposed new restraints on government snooping, including the the Freedom of Information Act, which allowed citizens access to some hitherto secret information. "Events are a driving force for the privacy pendulum," says Paul Schwartz, a professor of privacy law at Brooklyn Law School.
WORST-CASE SCENARIO. Until the backlash happens, however, reams of data on ordinary citizens is going to be collected, parsed, and possibly sold. At best, it means that some Americans may receive a few unwanted solicitations for diet products. At worst, data collected about private phone conversations and e-mails could be filed away as suspicious -- perhaps coming back to haunt innocent individuals.
In the meantime, the Justice Dept. should make every effort to ensure privacy violations don't go too far. And Americans must remain vigilant.
Black covers privacy issues for BusinessWeek Online. Follow her twice-monthly Privacy Matters column, only on BW Online Edited by Douglas Harbrecht
Get BusinessWeek directly on your desktop with our RSS feeds.
Add BusinessWeek news to your Web site with our headline feed.
Click to buy an e-print or reprint of a BusinessWeek or BusinessWeek Online story or video.
To subscribe online to BusinessWeek magazine, please click here.
Copyright 2001 , by The McGraw-Hill Companies Inc. All rights reserved.
Printer-Friendly Version
