Rethinking Privacy

TOMMY COLLISON
Hi everybody -- thanks for coming out this evening. I call this talk rethinking privacy, because I find
that we all think about privacy differently. Is it secrecy? From who?
Usually when you go to talks Ill be up on a stage somewhere with a mic and Ill be talking and youll be
listening or, yknow, not. That feels very transactional to me. I talk about privacy, you hear about privacy,
we all go home. As a talk structure, I actually think that kind of sucks.
Thats why Im sitting in a circle with you. I want to hear what you think privacy is. I want to know why
you heard about a privacy workshop and said, huh, thats something I want to go to. What concerns you?
What are you hoping to learn?
[We do that.]
Heres how this talks going to go:
- were going to talk about privacy and surveillance for about a half hour why its important, how
privacy activists are working to ensure that the government doesnt totally erode it.
- Then, well have a Q&A. Ill try and answer any questions you have.
- Finally, I want to dedicate the last hour to an actual tutorial how to use the tools Im going to talk
about.
Okay, first, a little activity to warm us up. Put your hand up if you dont think youre monitored as you
browse the web? [Pause] Okay, my goal with this talk is that you dont raise your hand again if youre
asked this question in the future.
First, a bit of an introduction. My name's Tommy Collison, and I'm a journalism student at New York
University. When I'm not studying, I teach other journalists and activists how to use privacy software. My
background is both journalism [hand] (I wrote a column about the intersection of technology and
education in high school) and [hand] computers, in that I had two computer science nerds for brothers. I
also volunteer for the Tor Project, which is an online anonymity project used by journalists, activists and
businesspeople doing events like these and writing about why I think privacy is a right and not a
luxury. Finally, I write a weekly column with NYUs student newspaper about the intersection of
technology and well, everything else. [hand-wavy motion]
Oh, also raise your hand if youre currently carrying a tracking device. Okay, now, raise your hand if
youre carrying a cellphone? [Pause.]
If youre carrying a cellphone, youre literally carrying a tracking device that also happens to make calls
and send tweets. AT&T, Verizon or whoever know where you are in the country at any time they care to
check. Now, maybe you think thats fine, or that its a price youre willing to pay to be able to use a
telephone, and thats true: Im not asking you to be a technical luddite here, because I know thats an
unreasonable expectation in 2014.
But Im going to encourage you to contextualize that information, to look at it through a different lens.
[Slide!]

On Christmas Eve, I wrote an article about Instagram and how sometimes, people forget that they attach
a location to their photographs. I guessed that people were tagging photos of their Christmas trees, and
that if there was a location attached to these photos, any attacker could see the location of someones
house by searching through an Instagram profile. You can see on the right there, thats a housing estate in
central Florida. I just got someones home address from their Instagram profile. This is how a lot of
stalking cases start, but Im not saying that nobody should use Instagram ever. My point is that nobody
thought of that eventuality when they signed up for Instagram, which is what we have to be careful of
when were using these online tools. As it happened, I write about online privacy and everything, and
this became my most popular blogpost of the year overnight, when I posted it on Christmas Eve.
Short Activity: True or False?
But before going too much further, I want to do a short activity about privacy and surveillance. I want to
split you into groups of two. I'm going to give you four statements, you're going to decide whether
they're true or false, and then we're going to come together and talk about them.
1.
2.
3.
4.
5.

Information collected by the NSA is shared with other government agencies, like the Drug
Enforcement Agency (DEA).
If we're both careful not to give out our passwords, nobody can read our Facebook chats except me
and the other person.
My e-mails are private nobody but the sender and the receiver can read them.
If I'm using free wifi in a caf, it's possible for someone else in the caf to virtually snoop on all
my e-mails.
Ad agencies track my browsing habits, but if I'm searching for something sensitive, like diabetes
or suicide prevention hotlines, the ad agencies don't track me.

Theres no one way to protect yourself when it comes to online privacy. Its a process -- understanding the
threats you face to your privacy and your identity. You have to ask yourself: what am I protecting, and
who am I protecting it from? For Glenn Greenwald, the journalist whos breaking the Snowden story, the
documents are what he's protecting, and the US government are who he's protecting himself against. If
you're someone with a chronic illness, that's sensitive information you want to keep private from online
advertising agencies. Or maybe you're just someone who doesn't want the intimate details of their
relationship plastered across the Internet. As we move through this workshop I want you to think of what
you're trying to protect. If you think that you've nothing to protect, I'd encourage you to think a little
harder -- you probably don't want someone to steal your identity on Facebook or Gmail, and if youre a
businessperson, you probably dont want your money stolen or your business taken away by a
competitor.
[Table slide]
The convenience and flexibility of computers and the Internet and e-mail and everything is obviously
great, but it's definitely changed the landscape when it comes to controlling your personal information. If
you Google "blood sugar," you'll almost certainly be tagged as being diabetic by one of the thousands of
ad agencies who make money from having a profile on you, who then make money by targeting you with
ads for diabetes medication. There's a funny story in the US of a father storming into a local Target,
demanding to know why they thought his wife was pregnant, because he was getting all sorts of coupons
for maternity items in the mail. He had to come back the next day and apologize, because it turned out
his teenage daughter was pregnant -- Target had guessed this fact based on the items the daughter, using
the home computer, was searching for and buying.

In June 2013, Edward Snowden came forward and revealed that the National Security Agency (an
intelligence agency in the US) was spying on millions of people around the world. This happened as
people started to become aware that Facebook was building a data file on everyone, their interests, their
location, identifying information like that. So yeah, I think it's safe to say that privacy and everything has
been on people's minds recently.
A lot of this stuff hinges on what I call linkability. This is when you take a piece of data and you link it to
another piece of data. When taken individually, the data isnt very useful, but when you start connecting
dots, another story emerges. Maybe you dont care that somebody knows you made a phone call late one
night last week. But what about when we know that youre gay, and that the number you called leads to
an HIV testing clinic? And that just after you made that phone call, you called a suicide hotline? Now,
what about if we knew that you made those calls standing on a bridge over the Hudson? Then, a story
starts to emerge.
So linkability is all about connecting pieces of data to tell a bigger story. Nowadays, everyone has a Metro
card to get around on the subway. Theres a feature on it that if you give it your credit or debit card, it
can automatically top you up so that you never run out. Sounds like a handy feature, right? But what
youre doing is [one hand] linking your debit card to your Metro card. [two hand] Now, anyone who can
see your bank card can see your what purchases youve made, and your Metro card can tell where youve
been. Well, now were starting to see a pattern emerge here.
So, back to debit cards. If youre able to draw a line connecting cellphone data to location data, and from
there to someones purchasing history, you start to build up a story of someones life. And also, not only
do they have your location data, but they have everyone elses, too so they know where you traveled,
and they have a good idea of who was with you at the time. Im not trying to scare you with this stuff, Im
not immediately saying that LEAP is evil and that you cant trust the Irish government (although, Im not
saying you always can, either), but I think people should be aware of these sorts of data trails.
Now, I bet I can guess what you're thinking -- most people, when they hear that the NSA is watching
everything they do online kind of tune out because they think they're not interesting, they don't care if
they're surveilled. Part of this event is to convince you that's the wrong way to look at things, that you
should have privacy even if you're doing nothing wrong. Even this idea of widespread surveillance is
new: in the past, it was only kings, presidents, and criminals who were under constant watch. Now, with
Google Street View cars, online ad trackers, and the NSA, everyone should be asking themselves "who's
watching me?". Most people think that only other people, are spied on -- people who "deserve it", for
whatever unclear definition of deserving it you use.
Internet surveillance depends on something called a dragnet, which impacts everyone, not just people
suspected of committing a crime. A police roadblock where they breathalyze every driver is an example
of a dragnet, or a store training a CCTV camera on their door, so that they record everyone coming in.
Increasingly, we're starting to see these sorts of dragnets move online and invade our personal privacy.
PatientLikeMe.com was a forum for patients to chat about their mental illnesses. It wasn't public -you
needed a password to get in- and so people really started opening up about something that still,
unfortunately, has a lot of stigma around it. Patients opened up in a way that they couldn't do offline, and
they had this sort of support group when people were going through a rough time. They were all
different ages from all around the world, it should have been a great Internet success story, connecting
these very different types of people.

Except that they were being watched on the private social network. The people who ran the forum
noticed that a new member of the site was trying to download every message on the site. Turns out, the
new member was Nielsen Company, the New York media-research firm who monitors online "buzz"
about new products. They were working with major drug companies in the US, using the data to build a
profile of people. Except it's like you're at an AA meeting and someone is recording you on video, it's a
complete violation of the spirit of the meeting, a complete disregard for someone's desire for a safe space.
The worst part? Even though downloading those messages was against PatientsLikeMe.com's terms of
service, those terms are rarely legally enforceable. That's why I think we have to take privacy into our
own hands, because whether it's a government who wants to spy on you, a company who wants to turn a
profit, or a hacker trying to steal your personal information, nobody's inclined to give you your privacy.
Eavesdropping on the forum posts of PatientsLikeMe might be socially acceptable if it was a forum
frequented by convicted criminals or drug dealers, but what happens when people's private
conversations are monitored in the name of "buzz"?
That's the thing about technology: it can be used in ways we think are both good and bad, even though,
in practice, it's really hard to define "good" and "bad." Companies will try and sell you a piece of software
that logs every action taken on a computer. "Monitor what your kids do online, keep them safe!", they say.
Sounds reasonable, right? Except what when that technology is used by a paranoid boyfriend in a
domestic abuse scenario, to spy on his girlfriend?
But anyway, back to privacy.
There's an entire subsection of YouTube that's devoted to a certain class of video that I'm sure we've all
seen. Basically, it involves someone who thinks they're alone, and engages in a behavior like singing or
dancing enthusiastically. Except, they discover that they're not alone -- someone else is filming them and
putting it on YouTube. The discovery that somebody is watching them makes the person doing the
behavior stop what they're doing immediately. I was going to like, show one of these videos, but then I
realized that y'all already know the type of video I'm talking about: you can see the look of guilt and
horror that's on their face. They were only doing the behavior because they thought nobody was
watching.
And that's where the privacy debate comes in. This is the crux of the work I've been doing over the last 12
months. Convincing people that privacy isn't a luxury, something that doesn't matter, or is only
something that criminals want. After the revelations of Edward Snowden that the US and its partners had
converted the Internet, this unprecedented tool for social and economic benefit, into an unprecedented
instrument of indiscriminate spying.
Over the last year, I've talked to maybe 1,000 people about privacy and surveillance. I've worked with
journalists, students, and activists in the US and in Europe, trying to make them a little safer. But even as
they come to talks like this one, there's always some lingering doubt about surveillance. Part of it is
because the actions of the NSA largely go largely unchallenged in mainstream media outlets in the US.
The NYT continues to lean on anonymous sources too much, and talking heads like Lawrence O'Donnell
continue to regurgitate the same pro-NSA lines with no thought at all.
It's easy to get lulled into the thinking that the NSA only spy on us for national security reasons, that if
you have nothing to fear, you have nothing to hide, or that, hey, we're all using Facebook anyway, so
privacy doesn't matter. I hear this last claim a lot, probably because I work a lot with students, but I get

really worried when someone from my generation says this, because despite all the jokes about "oh, if I
say this I'm going to end up on a list," I actually think that teenagers care about privacy a lot.
But privacy is something that's not actually a luxury, it's embedded in what it means to be human, and it
always has been, across time periods and across cultures. One of the argument that typically gets made is
one that I'm sure you've heard so many times, and it's that "I'm not one of the bad people -- I'm not doing
anything. Therefore, I don't actually have anything to hide. I don't mind if I'm surveilled by the
government because I don't think I'm doing anything wrong."
Leaving aside the fact that talking indirectly about not being one of "the bad people" usually translates to
not being someone who "deserves" surveillance, which is usually just coded racism for Muslims, this
argument just doesn't hold water.
This line of thinking was stated most clearly and most repugnantly in 2008 by Eric Schmitt, the CEO of
Google. He was asked about the million ways his company is invading the privacy of millions of people
around the world. Here's what he said. He said, "If you're doing something that you don't want other
people to know, maybe you shouldn't be doing it in the first place."
Oh man, where to start with that line of thinking. Actually, before I torpedo the logic behind such a
moronic and short-sighted statement. Eric Schmitt ordered Google employees to stop talking to the online
Internet magazine CNET after the site published personal, private information of Eric Schmitt, which it
obtained exclusively using Google searches. Mark Zuckerberg, the Facebook CEO, said in an interview in
2010 that privacy is no longer a "social norm," and then went off and spent 30 million dollars buying not
only a house in Palo Alto, but the adjacent four houses so that he could enjoy a zone of privacy.
So, I call bullshit on that. But even on an everyday level, the people who say that privacy isn't important
literally do not believe what they say. They say that privacy doesn't matter but then their actions speak so
much louder. They put locks on the bathroom door, they put passwords on their e-mail and Facebook
accounts. They do all these things to design a private realm to do things without being watched by others.
The reason for that even the people who say they don't value privacy or set a high store by it understand
on an instinctive level why privacy is important to who we are as human beings. We are social animals
and we do need interaction with other human beings, we need other people to hear what we're saying
and know what we're doing, which is why a lot of people voluntarily put information about themselves
online -- it's part of the reason Facebook is so popular.
But what's also essential to human freedom is the ability of humans to go somewhere in the world and
choose and be in the world without someone watching them, and feeling that judgment was being passed
upon them. Only when we have a realm where we can go and have nobody watching that we can really
explore without hesitation and boundaries. The private realm is the realm in which creativity and dissent
and exploration and human freedom exclusively reside.
The reason is that when we're in a state where we can be monitored, where we can be watched, our
behavior changes dramatically. The range of behavioral options that we consider when we think we're
being watched severely reduce. This is just a fact of human nature that has been recognized in social
science and in literature and in religion and in virtually every field of discipline. There are dozens of
psychological studies that prove that when somebody knows that they might be watched, the behavior
they engage in is vastly more conformist and compliant.

[[The 20th-century French philosopher Michel Foucault realized that that model could be used not just for
prisons but for every institution that seeks to control human behavior: schools, hospitals, factories,
workplaces. And what he said was that this mindset, this framework discovered by Bentham, was the key
means of societal control for modern, Western societies, which no longer need the overt weapons of
tyranny punishing or imprisoning or killing dissidents, or legally compelling loyalty to a particular
party because mass surveillance creates a prison in the mind that is a much more subtle though much
more effective means of fostering compliance with social norms or with social orthodoxy, much more
effective than brute force could ever be.]]
It's almost become a clich to bring up George Orwell's 1984 at this point. It's a world of propaganda and
omnipotent tele-screens. But the chilling part of 1984 isn't a government who constantly rewrites history,
it's the fact that people could be monitored at any time without their knowledge. Here's how Orwell's
narrator describes the surveillance. "There was, of course, no way of knowing whether you were being
watched at any given moment. At any rate, they could plug in your wire whenever they wanted to. You
had to live, did live, from habit that became instinct, in the assumption that every sound you made was
overheard and except in darkness every movement scrutinized."
So the last thing I want to say on this point is that the whole "if you have nothing to hide, you have
nothing to hide" line of thinking breeds two really destructive ideas in society. The first one is that if we
accept this notion, the people who seek out privacy are "bad people," for whatever definition of bad
people you want to use. US military field agents use private communications to safely talk to home base,
US law enforcement officials use anonymous browsers to conduct sting operations, citizen journalists
write about government abuses in China, and human rights workers in repressive regimes use it to
communicate without being arrested, tortured, or killed.
The other really destructive lesson this whole privacy-is-dead line of thinking enforces is that it forces you
to implicitly accept a really shitty bargain. The people who blindly accept mass surveillance are implicitly
saying this: I am not worried about the government reading my e-mail. But think for a second -- who are
these people? Well, they're the people who aren't doing anything the government might find
questionable. They're saying "I'm making myself unthreatening, I'm making myself sufficiently
subservient and docile such that the government will go after the other guy." We should be against this
line of thinking in a really, really strong way. Maybe you don't want to engage in that questionable
behavior now, but what if you do in the future? If you somehow know that you'll never want to, it's still
in the collective good to have dissidents and investigative journalists and activists because without those
people, we have no checks on power and our democracy turns sour.
In Mubarak's Egypt, it wasn't the people going around saying how great the Hosni Mubarak government
was who got arrested and tortured and killed -- it was only the people out in the streets fighting for
democracy. If you go into American Muslim communities or the organizers in the Occupy movement or
who work for transparency online, you will never hear anyone say "oh, I'm not worried." I think this is
really a crucial point: we should not be comfortable or okay with a society where the only way to be free
of surveillance and oppression is if we make ourselves as unthreatening and as compliant as possible.
So I think thats a good note to end on