So welcome. Thanks very much for coming. My name is Jennifer Valentino. I'm a reporter at the Wall Street Journal and for the past couple years, I've been covering privacy and surveillance issues and it is a good time to cover this because of precisely what we are going to be discussing today, this very timely conversation. The falling cost of surveillance is making a lot of these surveillance and tracking tools more prevalent and that means more stories for me and a lot more things to think about for these guys here. We're going to start out with an introduction by Ashkan Soltani and Kevin Bankston. Ashkan has most recently been working with the Washington Post on their coverage of NSA surveillance and before that he worked at a much cooler paper, the Wall Street Journal, working with us as our technical advisor on our privacy work. He's also been at the FTC and has his masters from Berkeley on technology and privacy issues and next to him is Kevin Bankston. They work together on the paper we'll be discussing today. He's the policy director here at New America's Open Technology Institute and he's kind of made the the rounds of the the freedom and technology initiatives in both here in DC and in San Francisco working also at the Center for Democracy and Technology and for quite a while at EFF, the Electronic Frontier Foundation. So I will turn it over to Ashkan I think first to discuss his work and then we'll have a discussion with some other panelists and open it up to questions. Hey everyone, thanks for coming. I'm going to start just briefly kind of going back to this case. I'm sure most people are probably familiar with this case. It's a landmark Supreme Court decision US versus Jones and the question they were grappling with was whether 28 days of continuous GPS surveillance constituted a search under the Fourth Amendment and the holding was that in fact it did attaching a device to a vehicle to monitor its locations, was a search and a lot of the opinion hinged on the physical attachment of the device to the to the vehicle and I'll let my colleagues speak to the legal aspects but there was a concurring or there was two concurring agreements by Sotomayor and also by Alito outlining kind of location surveillance and our reasonable expectation of privacy and shortly after this there was a Supreme Court hearing where it's one of Chris's colleagues spoke at on you know why this GPS surveillance or why this type of surveillance is a search and I'll kind of let the congressman kind of go through this line. Mr. Crump, it's been a while since I Studied constitutional law or search and seizure. What is the standard required for physical surveillance if law enforcement just wants to follow someone? The Supreme Court has set different standards for physical surveillance and electronic surveillance Physical surveillance the Supreme Court has not required a warrant based on probable cause to carry out. That's that that's what I thought So you can follow someone in their car without meeting any standard of proof That's right, and I think what about airspace surveillance. I Think that's a similar rule the line that just that Justice Alito I'm not going there yet. We're not we're not there yet I'm just asking you about physical surveillance both on land and air and There's no probable cause requirement for either that's that's certainly correct so this line of kind of question goes on and on and and Catherine is actually a great sports. She goes through it, but The rep raised an important question, which is what's the difference, right? Like you can always follow someone around on foot or by car or by Airplane why do these technologies like what makes them different such that there is now a search requirement or a search standard required for enabling them and So the kind of the obvious answer was maybe money, right? And so that was my thinking. So I did a quick talk on this topic Kind of right after this hearing actually like same day actually back of the envelope calculations, which then Kevin and I decided to kind of write up an entire paper about around what's the difference on the cost of surveillance and so I'm in the basic argument is can we calculate the cost per hour for tracking an individual's location? and here we're looking at the cost to acquire the information and we're not Kind of we're not counting fixed cost of purchasing equipment because Presumably once you have the equipment there's a little barrier to using it other than either the law or the cost and so We kind of look at kind of the most basic approach, which is Foot pursuit right so an FBI agent here. We have Keanu Reeves in Point Break can always follow you around on foot they could easily just follow an individual around and Kind of doing kind of some back of the envelope calculations Using the average salary of an FBI agent field agent with benefits comes into something to around $50 an hour for an individual Agent to follow you around but he's got obvious limitations. He's got to go to sleep Eat stop, you know human factors to and so conducting 24-hour surveillance is difficult for one individual not to mention to do it Covertly it's difficult for just the same person to track track you for 28 days Auto pursuit is also possible. We can look at how much it would cost for, you know, two officers in a car To follow you and we came out with a number of about something like a hundred and five dollars an hour based on the officer's salaries plus the kind of gas and maintenance costs for the vehicle using kind of IRS standard deduction plus the average mile expected to be driven and And then we looked at a technique that the FBI uses to Perform covert surveillance. This is kind of it's kind of the floating box is what it's termed as where they have multiple vehicles rotating In kind of in a way that essentially prevents the kind of the suspect from realizing they're being Surveilled and they'll this allows them to factor cars in and out take breaks, etc And that comes out to something around two thousand two hundred seventy five dollars an hour kind of not very advanced math But just some basic calculations we kind of threw in this is we didn't actually include this in paper But we also did it for helicopters and for drones for drones We use the number from a recent Senate hearing where I think it was a sheriff from Utah I can't add that quoted there hourly operating costs But drone, you know helicopters or something like six hundred dollars an hour drones are a bit cheaper You know to choir and to follow someone around by a drone usually takes one person operating and then the drone does the surveillance themselves We then started looking at some of the kind of technical means that The police use and this is a kind of an 80s technology I couldn't find an example of a picture, but it's essentially like this guy holding a divining rod where Essentially there's an officer in the car holding an antenna and there's a device placed on the car that they call it a bumper beeper or beeper and They the as long as you have reasonable line of sight or the reasonable kind of distance from the device You can you can track its location so it allows them to maintain a distance from the suspect and thereby reduce the number of agents required to Track the individual and we came that came down to the number about 105 to 113 dollars an hour depending on the duration and they're really the the variance is the Time it's required to install the device and remove the device Otherwise the the hourly cost is essentially the same as the two-car Scenario where two agents one holding the antenna and one driving We also looked at emcee catcher. This is Kind of a graphic from I think a story Jennifer did on this technology that the police used to Locate phones and it's very much likely the beeper technology except they don't have to install the device They just use your existing cell phone to triangulate location or to find location from a you know A moving vehicle like a van so here two agents want to drive one to manage the equipment and the cost the operating costs of the car So so far these are essentially human costs in these technologies And and I think Kevin will touch on what the kind of legal implications are but these are kind of ballpark numbers to give You an idea Now we look at a Technology that was this more widely used More recently, which is GPS devices This is the kind of device or one of the types of device that was used in usv Jones and These devices often attached to the car. They either wire to the car battery or they have their own power source and again here Once the device is is attached There is basically a service contract that law enforcement can use that essentially is able to track the device as it moves around So the device uploads its location Continuously to a web interface or a portal interface that the agents can use and those costs have dropped from say the $105 an hour for the beeper or MC catcher does something like $10 an hour to do one day of surveillance or even $36 sorry 36 cents an hour for 28 day Surveillance using this device right so pretty significant drop in cost. We also looked at Mobile tracking so the cell tower Tracking that the carriers provide so, you know, all of the carriers now allow law enforcement to Ping individual cell phones and find individuals location based on their cell phone signal using triangulation of cell phone tower Or cell phone tower dumps and these are approximate numbers that were reported to the ACLU They're available on their site But those numbers come down to somewhere from $5 an hour to sound something like four cents an hour to track a cell phone Using the kind of the existing cellular infrastructure. So somewhere, you know, somewhere these and these very based on the carrier and the duration but Significantly lower than then then the traditional methods of tracking And so this is kind of a breakdown of the of the costs, you know So we at the top we have foot pursuit of $50 an hour 250 for covert foot pursuit to 75 for covert car pursuit down to something like four cents An hour to track someone on for an entire month on Sprint, right? And so These things are you know to the question of what's the difference between those technologies These are these costs are significantly different and not just the cost per hour, but also the capacity, right? So one thing to look at and And I'll probably end right after this slide Shortly after the decision there was a panel which Juliang on one of our colleagues covered The FBI stated that they had three thousand devices in out in the field at the time and they had to request Kind of request approval to turn the devices back on so they could collect them It's kind of a funny story because you know They couldn't go get their device because of the the case but that aside It indicated that at that point in time there was three thousand at least three thousand devices in the field, right? And one of the things to realize is under that but under this rubric right if you need five agents per car Or five person agents per target to covertly surveil Individual that would require 15,000 agents, right? The FBI currently has 13,000 special agents that could actually do this work somewhere on 13,000 So they did not actually have the capacity if none of the agents slept of ignored all their other work Ignored food and bathroom breaks. They would still not have the capability to do even three thousand simultaneous Targeting or surveillance of three thousand simultaneous individuals at any given time So kind of to not only are the costs significantly lower But the actual capacity or the ability to ratchet up capacity is also significantly changed by these reductions of cost and so This is kind of just a overview of the difference in cost So it might be a little hard to see but for example That top line 53 X so cell phone tracking is 53 at its most expensive So this is remember it could be for one day of tracking Not 28 days for one day of tracking a cell phone tracking is still 53 times cheaper or less expensive than to traditional covert car tracking or 22 times cheaper than MC base catcher based tracking or something like only twice as or you know half as cheap as a GPS tracking so this is basically a way to try to visualize the difference in cost between the different technologies You want to go ahead and since we're bringing up the screen you can bring up the other folks with Ashkahn and Kevin today, we've got Some panelists who will give us their perspective on the issue of economics and surveillance So in the middle there is Christopher Segoian and he's the principal technologist at the ACLU and 2012 I believe received his PhD from Indiana University focusing on tech companies and their Facilitation of surveillance and he tends to somewhat like Ashkahn approach this from a technical perspective Unlike the the lawyers on this panel, which yeah, we're also very technical, but not Yeah Right, yes, exactly. We have Marcus Willinger the founder of Zwilljin PLLC and he's a specialist in internet law. So as we said among lawyers very technical Particularly ecba the electronic communications Privacy Act FISA which has been in the news a lot lately with the NSA surveillance and Notably he represented Yahoo in 2008 in a case About the precursor to FISA And finally last but not least we have Oren Kerr professor at George Washington University Law School who also writes extensively on fourth amendment issues and computer crime law and Both he and Mark were formerly at the DOJ Oren was a an attorney on Computer crime law in particular. So I think Kevin can can start us out Thank You Jennifer and Thanks to everyone who joined us for this panel Thanks to everyone in the audience and everyone who tuned in on the live stream to use an anachronistic term And thanks to Ashkahn for laying out the basic trend line of the falling cost of surveillance What I'm going to do in hopefully 10 minutes probably more like 15 minutes Give you the legal context for that technological and economic research and introduce the legal ideas in our paper And in the process hopefully give some context for the current NSA controversy that'll be helpful Speaking of our paper. I don't think we've mentioned the title of it yet It's a paper that was published in January with the Yale Law Journal online called tiny constables and the cost of Surveillance making sense as in sense in a dollar Of us v. Jones because we just can't pass up bad puns And if you're wondering why it's called tiny constables. I'll explain that very shortly, but I'm going to start with a But um, yeah, again, I can't pass up a bad pun Although actually no pun was intended so I'm going to start first with a whirlwind Magical mystery tour to make it sound really exciting of the modern fourth amendment Which is actually a pretty sordid tale of bootleggers and bookies and harassing phone calls and of course drugs drugs drugs lots of drug cases The fourth amendment if you're not familiar with it although if you're watching or in the room I expect you are is our primary protector of Privacy against the government it protects our persons our papers our effects against unreasonable searches and seizures and Searches and seizures without a warrant based on probable cause are presumably unreasonable and the fourth amendment requires that warrants only be issued with Probable cause and particularly describing what's going to be searched or seized But before the 1960s and the birth of modern fourth amendment doctrine the fourth amendment was very physical and property based Turning on whether and with a question of whether you had been searched or you had something of yours had been seized Turned mostly on whether your private space had been violated in some way What did they go into your bag? Did they go into your house or your office? and This is particularly evidenced in the Supreme Court's first tangle with wiretapping as an investigative technique in a case called Olmstead BUS Involving a bootlegger named Olmstead in his bootlegging shack which Progressive for the time like he had phone. He had a phone in his shack out in the woods where he was bootlegging And so the FBI Attached some alligator clips to his phone line to do a wiretap and listen to what he was saying And so he tried to get this evidence against him suppressed under the fourth amendment and the Supreme Court said no This was not a search This did not implicate your fourth amendment rights because they didn't actually enter your house or otherwise violate your public your private space You sent these electrical impulses out into the world And so they were not protected and so for over 40 years The fourth amendment did not protect against wiretapping by the government what I would view as a mistake and one that wasn't corrected until 1967 in what's considered the birth of modern fourth amendment law a case called Cats v us v cats rather Which instead of a bootlegger involved a bookie named cats in New York who had a particular phone booth that he liked to use a lot for his book making and There the cops attached an eavesdropping device a microphone to the outside of the phone booth to eavesdrop on his calls and the Government argued hey man under Olmstead. This is not a violation of his privacy This is not a search because we did not violate the private space of the closed phone booth and In a very important decision the Supreme Court said we are overruling Olmstead. We are deciding here and now that No, the fourth amendment doesn't protect places the fourth amendment protects people and In particular it protects people's reasonable expectation of privacy Which has come to be defined as if you have a subjective belief that something is private and that belief is one that Society would deem to be reasonable although how one decides that is a difficult question that we'll talk about Then you have a reasonable expectation of privacy and a violation of that expectation is a search under the fourth amendment This important principle was somewhat limited in a way that's very relevant to the NSA Dispute in a case in the 70s called Smith v. Maryland which this time involved a thief who was making harassing phone calls to the person He had stolen from And so the government conducted a type of surveillance called a pen register To track what phone numbers this suspect was dialing in order to prove that he was in fact calling the person who was being harassed and So a pen register is literally the device that one would place on a phone line To collect the impulses and then print it out on a piece of paper You know dashes and dots to indicate the numbers that were being dialed anyway The Supreme Court looked at this and they said we actually don't think this is a cat's type situation We don't think this is a search. We don't think this is a violation of privacy because When you dialed the phone number You were communicating it to the phone company so they could connect your call and when you expose that information To the phone company just like as they said in an earlier case in the 70s when you hand over Records to the bank when you engage in a transaction with your bank You've assumed the risk that they're gonna share that information with the government You have voluntarily exposed that information with a third party and you've assumed the risk that they'll share it So no violation of your privacy. No warrant required This has come to be known as the assumption of risk doctrine or what it deals with records the third party records doctrine And is the primary defense of the NSA's metadata collection program So that brings us to location tracking in the 80s and a couple of cases called caro and knots where the Supreme Court looked At the issue of when the government Uses a bumper beeper as Ashken described to track someone around on the public roads Is that a search and in those cases in both cases they didn't actually attach something to the bumper They placed beepers in the barrels that carried precursor chemicals for making drugs So they basically secreted a tracking device in the barrels that the drug dealer slash manufacturers were moving around and Then they would follow in relatively close proximity tracking with a radio device To make sure that they could maintain the surveillance even if they lost immediate visual contact and In both of these cases the Supreme Court concluded that well They were in public these cars were in public those movements were You know voluntarily and knowingly exposed to the public and so These suspects assumed the risk that they would be seen including by the cops and the fact that the cops Somewhat automated this process and it enabled them to follow at a longer distance or whatever Did not actually impact the fourth amendment amendment analysis Now in one of the cases the beeper was brought inside of a private space and in that instance They found that that tracking while it was in a private space was a search But doing the tracking on the public roads wasn't Which brings us to the Landmark case of US v. Jones that that Ashken talked about or it frankly It would be more of a landmark if it were actually clearer instead. It's a very confused opinion With a lot of different opinions in it again drug dealers a common feature of many fourth amendment cases Attachment of GPS device to drug dealers car and continuous monitoring of that GPS device for 28 days Question does this Implicate the fourth amendment. Is this a search that violates a reasonable expectation of privacy? Scalia wrote a majority opinion signed on to by four others That didn't address the question of the tracking, but instead found that the attachment of the device Was the fourth amendment moment and constituted a search Justice Alito wrote a opinion signed on to by four of his colleagues I'm signed on to by three of his colleagues rather That decried the Scalia opinion as a return to Olmsteady and physical based fourth amendment thinking and said no the real issue is the tracking and We think this tracking is different from the tracking in caro and knots and I'll talk about why shortly and Using logic that I'll talk about in a couple minutes Decided no this tracking Violated the fourth amendment and then finally so to my or Sort of you know united or not divided her she agreed with both of them She wrote a concurring opinion She signed on to the Scalia opinion saying I think that the attachment of the device violated the fourth amendment And then she wrote a concurring opinion that also said I and I agree with Alito and the signers of his opinion That this violated the fourth amendment that the tracking violated the fourth amendment while also calling into broad question Whether the third-party record doctrine makes any sense at all in the context of modern technologies where in order to participate in modern life We are constantly shedding information that is being collected by a wide variety of actors So we have five justices on the Supreme Court that do think that this tracking Unlike in caro and knots did violate the fourth amendment or rather was a search and seizure under the fourth amendment search under the fourth amendment But back to what Alito said Alito's basic argument was And there and hen and the name of come the reason for the name of our paper is he made a joke which was if you would If someone at the time of the founding if the cops at the time of the founding putting aside that there were There weren't really cops at the founding full-time police is a modern invention But at the founding if someone were to be tracked for 28 days The only way you could really accomplish that is if you had a really tiny constable who could somehow secrete himself into the Trunk of your your you know coach for 28 days and of course that's impossible and in fact even looking to modern times just you know Just a few years or a few decades ago It would have as Ash has demonstrated Taken multiple cars and many agents and cost an enormous amount of money to do this kind of long-term tracking such that one could reasonably expect That unless you were like a super criminal No one would spend the resources to do that it was simply practically impossible because of the expense and So Alito said and so do I or agreed that that is what defined our reasonable expectation of privacy in this case the Practical impossibility of it absent the new technology and now that there is this new technology that allows it We need the law to step up and protect us The problem with Alito is that he didn't really draw a line about where we go from permissible short-term surveillance that was practically possible before and Longer-term surveillance that new technology has made possible and so that's why we Chose to look at this write this paper because we wanted to try and give some ammunition to what Alito was doing Much of what Alito was doing is reminiscent of work that this gentleman has done or incur in articulating a what he calls the equilibrium theory of the Fourth Amendment as Where he describes the case law as a constant negotiation of the judges where they are balancing increases in capability by the criminals and increases of capability by the cops to sort of maintain a rough Equilibrium such that you know government power doesn't completely You know go out of whack or the criminals don't go completely insane He will articulate it much better than I am But another academic who did some similar work articulated a concept that was very important to our paper called and what he described as structural constraints as a privacy right or In more, you know clearer language perhaps practical constraints We have practical constraints the way the world is built that impact our privacy for example walls We have walls and you can't see through walls and so those walls act almost like a Regulation that protects our privacy however if we all had x-ray specs or say if the government were to obtain Devices that that detected heat signatures, which in fact is the subject of a Supreme Court case that would change the balance that would actually reduce the pre-existing structural constraint that we relied on to protect our privacy and The theory that Harry certain laid out was basically for policymakers saying we're in a Ero where technology is going to lead to a variety of these structural constraints that have protected our privacy dropping precipitously with radical shifts in our rights as a result and that it is important that the law Keep up that we replace those falling structural constraints with new legal constraints and so We looked at that idea and we looked at the decision and we looked at the math that Ash had started to do and to us it looked like This is a major rights shift in terms of the drop in cost of tracking technology And we wanted to quantify that and we wanted to well as one as one commentator put it Elito's decision seemed to be an empirical decision based on the falling cost of location tracking as an investigative method But it lacked the empirics. There wasn't actually any data there. So we wanted to provide that data and that's what we did and in doing that and Charting the drop in cost that you can look at in the graphics that that Ash can put together You can see really massive changes in cost sometimes Hundreds of orders of magnitude But we came up with a rough rule of thumb That's sort of our canary in the coal mine for whether a rights shift has has happened such that the court should step in and Provide additional protection by requiring but well by applying the Fourth Amendment We said basically if the cost of doing the surveillance has dropped Over an order of magnitude since the last generation of technology So for example if you were to compare bumper beepers with GPS if there is a drop in cost of an order of magnitude That probably means Your reasonable expectation of privacy that you weren't going to be followed has has been affected by that technology And we need the Fourth Amendment to step in so I mean just to throw you some numbers as an example one day of following you covertly in cars Is 28 times more expensive than doing it with GPS? 28 days of GPS tracking is 300 times cheaper than doing the same thing with a bumper beeper And so the concern and the need for Fourth Amendment protection increases As time increases and so that sort of maps with what Alito was saying, you know Shorter surveillance raises less concern longer concern surveillance raises more concern But to bring you and I'm almost done and then we'll get to the commentators. I Was struck by a recent example yesterday AT&T released a transparency report that describes all the requests It gets from the government. Well, not all of them. There are some obscure numbers regarding national security but when it comes to Location tracking they reported how many requests they get for real time They got for real-time location tracking of cell phones in the first half of the year Notably there were over 12,000 of those for the first half of 2013 and those those pen registers last 60 days typically those orders last 60 days so doing the math and looking at AT&T's costs Which are in our paper. They're actually pretty expensive sprint is like 30 bucks a month flat all you can eat AT&T charges a hundred bucks for setup plus 25 bucks a day But so you do the math on the number of times AT&T tracked people in real time this year The overall cost is 20 million dollars That's a lot of money. That is nothing to sneeze at But if you compare it to what it would have cost to track those people in Cars it would have cost five billion dollars 250 times More money and to echo the point that asking was being that would never happen The FBI does not have those resources is it has never had those resources, but now Thanks to technology It has all the millions of tiny constables it needs to follow you around all the time Which brings us to my final point, which is about mass surveillance Such as what the NSA is doing our basic approach would and is indeed meant to ensure that fourth amendment review is triggered when technologies enable mass surveillance because For most master the balance It will end up incredibly cheap per person. You you know you you Divide the entire divide the cost by the entire population of the country You could get to sense per day pretty quickly So for an example an original pen register like the one in Smith v. Maryland Again was a physical box that you attached to a phone line It was a retail technology not a wholesale technology and it cost money to do that But we've moved away from that and now we have IP switched phone networks where we can install a splitter and route all that traffic into a Surveillance box and place those around the domestic network and essentially have a pen register that runs on every person in the country We think that that technology is So fundamentally different from the technology that the Supreme Court looked at in the 70s that it does require a new rule and so So that's why we threw why why why we wrote this paper We do think the ideas that we we threw that that we put out in this paper Although it focuses purely on location tracking because that's what usb-jones was talking about could be applied to other issues drones And so and I hope that we'll talk about a variety of different things that might be applied to in the comments but now The commenters thanks Great, so I think We'll start out. I think with Chris if that's alright, but good. And do you want to come up here or stay? So I guess I will quibble with the math first and then I will give you praise about that you did the math This is what happens when lawyers outsource things to other people So I think really what this is about is marginal cost this is about the cost of one more hour of surveillance not not the overall cost of surveillance and and what I mean by that is There are some technologies that have high upfront costs high up front capital investment costs with relatively low marginal cost per each hour of use and others, you know Okay, I suppose you have to train the FBI agent, but Really what you were tracking there with the FBI agents was like their annual salaries But with a stingray that cost 150 grand, I don't see a stingray is a brand sorry capture Sorry, the IMZ catcher is very in-price, but some of them are quite expensive and I didn't see that in their Cell phone surveillance is actually one of cell phone surveillance perform with the phone companies It's actually one of the few forms of surveillance where the capital costs have basically been borne by the people who are being surveilled Rather than the government and so there aren't really any capital cost there But so it would be nice to see you sort of focus a little bit or clarify the marginal nature of this I mean This this paper really captures sort of the the financial cost of surveillance But the financial cost is just one piece of the puzzle as you observe You know the FBI just doesn't have the manpower to be able to track that many people and that's not just about It's not just about the money It's not just that they don't have the money in the budget They would have to divert resources from other places and in many ways the friction that the government has The friction that keeps their surveillance powers in check In in many of those sources of friction are more than just money They are the work of going to a judge and getting a warrant, right? So Bill Stunt's famous now deceased fourth amendment scholar talks about warrants as a form of friction as a tax on the government And some of the technological advances that you guys chart are not just Decreases in the financial cost, but actually decreases in the legal cost, right? So if the with a stingray for example the IMZ catcher which actually sends signals through the walls of your house Stingrays can be used for in two ways one is to locate a known phone And then another is to identify all the phones that are in a given area or in a given house, right? and so Pre IMZ catcher pre stingray the police would have had to go into the house and search every person to locate the phones that were in use there Posts stingray now they can sit outside the house with this magic device and Figure out which phones are in the house. Not only is it cheaper not only does it require less manpower But now they don't have to go to a judge anymore Potentially to go and and use this thing and there's no or phone company. These are unmediated forms of surveillance Not only that, but it's not even clear that in the pre IMZ catcher world that a judge would have authorized the police To search a hundred houses. There's no way that they could get a warrant from a judge to say, okay We're gonna go through this neighborhood. We don't really know which house the person's in We just think they're in you know Northwest Washington, DC We're gonna drive through every street until we we get a signal back from his phone There's no way they would authorize the search of hundreds or thousands of houses But with this technology they are now able to do things that they simply would have wouldn't have been able to do before and with far lesser legal process and and and I mean I think that only strengthens your argument This isn't just about the money. This is about the transaction cost and and as you noted also You know we seem to be going back and forth on this pendulum some forms of surveillance that take place now Involve a third-party other forms of surveillance don't involve a third-party the FBI following your vehicle Doesn't involve a third-party the FBI going to Verizon or Sprint involves a third-party and You know there there are split opinions here as to the value the privacy value provided by the phone companies Probably the tech companies push back a little bit more than the phone companies, but you know right now They're all we have the lawyers who work for the phone companies and the outside lawyers who they retain They're really the only thing we have other than magistrate judges to say no to the government and what my concern is that Many of the most chilling and terrifying technologies that the government is acquiring whether their stingrays or empty catchers Whether it's the rise of hacking by law enforcement. These were shifting back to Unmediated surveillance where there is no neutral third-party and where there really is no one to say no to the government and and again, that's that's the reduction of of Friction and a barrier that previously would have been there and previously would have slowed them down and and Maybe would have said no But otherwise fantastic paper So do you guys want a second to respond to that at all? So absolutely on the fixed cost we we assumed marginal cost So a lot of the equipment is actually purchased through grants through the federal grants And the assumption is what is the barrier for? One more basically tracking one more person right so the assumption is they had to buy cars They had to buy uniforms they do buy this equipment and they have this equipment And so what is the legal barrier to track one more person and that's the number? We were looking at but absolutely fixed cost is a number that can be a can be a barrier The assumption is a lot of law enforcement has some pretty sophisticated equipment or has access to I'm gonna agree with you on a few points surprise I Agree with and and think it's important to conceive of the of going to the judge and getting a warrant as One of the costs we're talking about and I think that that highlights the need for when the literal cost does drop in order to maintain equilibrium you need to introduce new costs and Routing routing that surveillance through a judge is definitely one of the ways you could do that And I also just want to second the point that you're making about how we are seeing Arise in varieties of surveillance that enable the government to directly surveil rather than having to go through an intermediary Whether it's imzi catchers or drones or tapping into undersea cables or the like and And again, you know people may have differing views on how good the companies have done at protecting our privacy But like I've worked with mark on a variety of issues where they did push back. He represented yahoo in in the case The Jennifer mentioned also a case in 2008 around Government trying to get warrantless access to email You know in many cases the companies have have provided really important pushback that have helped us establish and defend Rules for the road that protect us right now including right now the in the law enforcement context the rule that They have to get a warrant if they want our email But we're quickly moving to a realm of new technologies where Where that check isn't available, but I think that again sort of highlights our point that well Then we need to make clear that there are other checks that they have to get checked like the approval of the judge Even though the phone companies are involved in the domestic metadata surveillance program that the NSA is doing When the phone companies hand over the data in bulk when they hand over everything their role as the mediator of surveillance requests vanishes They they don't they're not in the loop every time the NSA queries the data and even if As the president seems to be suggesting that the program may move either to the phone companies or to some third party the The scale with which the NSA is engaging in querying of that database suggests that that there really won't be any practical barrier I'm the phone companies are not going to be able to To actually analyze the number of queries that are being done and say okay. We're okay with we're okay with these ones But not these ones Whether the surveillance happens at the NSA whether the surveillance happens With AT&T's systems directly what's gonna there'll be a technological interface to the phone companies and the NSA analysts We'll just be submitting the queries without any phone company lawyer approving on an individual basis requests for analysis I'll just add to that if we're talking about the falling costs of new type of new surveillance modes and the new Capacities that were practically impossible before Basically having a government controlled time machine in which to go back and examine Transactions that otherwise would not have been available to the government like that is a new and very worrisome capacity So yeah, I thought those are some good points I wanted to your conversation made me think of something that I think would be good to mention and it's the complexity is I think you were all alluding to that It's really unclear whether companies are going to push back or not So even when you don't have bulk surveillance there have been instances sort of With exigent letters for example sooner several years ago Not too long after 9-11 and which agents were in fact You know embedded with the phone company or vice versa and there's not always that barrier there So I think it's a really complicated question just to throw another wrench into your conversation so now we'll move on from the economic and technical argument to It's more legalistic thoughts. Do you want to go next mark sure in a nice little order here? I'll do it in the reverse order Chris. I'll praise you first That's a good move by the five observations Which may or may not be in the category of criticisms or just observations, but the first is I think you're onto something right? I think you're to try to quantify the when cost Reductions amounts to a right shift, you know as a useful exercise And I think people will seize on it and use your work to try to make that argument But when thinking about it I think sometimes the right shift that we feel aren't about the acquisition of the information But maybe the processing so for example We all expose our face every day to people when we walk down the street doesn't feel that intrusive But when the people who are looking at us are wearing Google glass and instantly doing facial recognition and comparing us to pictures on Facebook That may feel much more intrusive in the cost of acquiring the information didn't change. We've got on ATM We know we're all being recorded the cost of somebody sitting there to try to figure out who we are would be Astronomically high the cost of facial recognition technology very low. Is that a right shift maybe but we're not we're talking about processing and not acquisition Second observation is sometimes cost changes don't represent a right shift at all For example, I've been representing providers as you know for 14 years in 2005 or 2006 The OIG did a study and that most providers at least in the telecom world were charging the government about $2,200 $2,000 for a wiretap and now based on the responses to market letters Most providers are charging the government $200 or less even for a wiretap So there's been a major change in cost, but the information the government's getting is no different So cost just change without a right shift The number of wiretaps has has gone up although according to the reports, you know The federal government isn't asking for that many internet wiretaps But the point is I'm making is that there's a cost shift that's significant without a right shift whatsoever similarly, I'd say When you're talking about pen registers in Smith v. Maryland There was a cost there installing a device and recording the numbers dialed and now our networks just past the numbers dialed along with every phone Call in terms of caller ID So the costs are dramatically lower, but it hasn't affected a right shift So I don't know a rule of thumb that says 10 times or 100 times makes a right shift really works all the time It may vary depending on how much the technology changed in of itself The other thought I had is you know, it really depends on what you compared against you went to the tiny constable And we went back to you know, the 1800 1700 1800 and comparing costs of something now versus then We make marginal efficiency gains all the time law enforcement does as well And the consequence of this theory would be might be okay to erode our constitutional rights slowly As long as you don't do it quickly like if you compare the ten dollars that sprint was charging to the hundred dollars In your analogy. Well, that's not significant enough. Maybe to have a right shift But it might be it might be we've just gone yearly We've dropped the cost and that ten dollars is somewhat controlled by the provider That is we're looking at what sprint charges law enforcement So for a while providers were criticized for being in bed with law enforcement by collecting funds from them for doing Surveillance tasks and now I think the pendulum has shifted where we see through your theories in fact that the providers Charges to law enforcement actually are a check That is to the extent the providers go back to charging $2,200 for wiretap and you'd multiplied that out for you know A thousand wiretaps you would have a very significant cost so the providers control a little bit what law enforcement costs are and They are by seeking to recover their own costs checking law enforcement that way as well If those are the the major observations I had except I guess one more which is that sometimes the costs go down But it doesn't feel that intrusive like in the Jones case Everything you said is correct. The cost is very low, but it's very low for a three-day Surveillance as well, and I don't know that the court would have said a three-day surveillance was too intrusive in Jones yet Multiplying the three days of the GPS Monitoring compared to three days of a tiny constable or three days of a floating box You would have the same cost variance, but I don't know that it would have been enough the duration was Independent of the cost I think to some extent so Again, I think you're on to something But I worry that it starts to prove too much when we come up with a rule of thumb on the car on a right shift The variance Was assumed for one day so that the numbers that Kevin was using were actually what mostly one-day numbers the cost for Say a cell phone tracking for 28 days was something like four cents an hour, right versus 250 So the math we were doing and I agree with you as to whether If it was a three-day search us v. Jones would have come out the same I think that's an interesting question, but I will say that the The caught the cost we use were conservative And then second to your point of processing cost You're absolutely right that process not it's not just the cost of acquiring the information But the cost of processing but I in a lot of technical realms. They're one and the same I'll give you an example I worked on a story with the Washington Post on the NSA collecting somewhere on the order of five billion records for location on a daily basis and the reason for this technology was to be able to at scale Identify whether one device was traveling with another device, right? And that's the ability to locate and identify all devices that they their network had access to and then compare the tracking or the kind of Traveling behaviors of two devices at the same time, right? So the the capacity from both collection and scale has changed and I think that's think about if there was Think about how to do that in a prior to the the technological capability I don't think that kept capacity exists And I think that's what we're trying to wrestle with is how do you quantify that and then how do you kind of adjust for that? I'll start with your last comment. I mean all these are well-taken points And I'll admit that we were certainly hoping it would have been very elegant if the math had worked out that It's less than an order of magnitude of cost difference for the first week or so But then it crosses the line because then we could have said this is perfectly consistent with USB Jones it would have been great The math didn't work out that way although he as Ash says the numbers are pretty conservative But I do think what the numbers show is that the over time the cost does steadily drop such that the government's capacity to do broader scale stuff like There is a change in the cost such that one could imagine a legal rule tracking that like so it didn't exactly work out That the line that we came up with as a rule of thumb, you know rough line Dropped where we would want it to on the USB Jones But I do think there's there's support for the general idea that as the price goes down We need the legal protection to ramp up Processing point there's also simply the practical like how how to write that paper how to write it in a timely way What's the methodology for that? Which technologies do we look at? You know, I would love to see more research on that I'm probably not going to do it but But I do think that overall the the Because one of the criticisms that we sometimes would hear when we were workshopping the paper was well when you have all that data all that Hey, isn't it going to cost a lot to sort through all that? Hey, but you know that's ignoring the fact that the prop, you know The technologies for processing are also getting better and faster and cheaper such that you can do things like Search every email that crosses the border for particular phrases or data mine on Felstone records to see who's talking to who you know like that And for not a whole lot of money certainly for not a whole lot of money compared to what it would have cost to have a human Do it so I think all in all the the processing issue supports our general thesis With the what to compare against problem is another Question that's come up a few times it came up in criticism of Orrin's theory as as well And so I basically cribbed what he had said in response and put it in a footnote in our paper but basically You know Orrin and again, he will describe it better than I but in his equilibrium equilibrium theory to give a reference point He talked about a notional year zero where basically things were in equal equilibrium and this was criticized as being originalist thinking and his reply was well Year zero isn't necessarily and doesn't necessarily need to be you know 1776 It's just representative of what the last status quo was and for me the last status quo in terms of the Supreme Court's Legal interpretations of the Fourth Amendment in regard to location tracking were caro and knots And so it seemed like the natural comparison point for this was caro and knots and before that was Tracking without a beeper We do get to a problem where there is continuous Technological technological change such that what you can do this week is different from what you could do last week but to the extent it is continuous and not like Catastrophically huge changes that would represent a rights shift. I think there's a argument to be made that expectations can keep up with that and that norms and expectations Around the technology Adapt it's when the technology shifts so fast that our norms and expectations can't keep up and That where we expect privacy, but don't actually have it because we weren't anticipating that shift in the technology That we actually have a problem that we need to address so I think that covers many of your points maybe not all of them to say without one sense that's an interesting point which is if we had one set of privacy protections ten years ago and we have Gradually erodes every year government can get more intrusive when we get to now We said no right shift has occurred because it took place over a course of ten years But if it all happens in one year, then a right shift has occurred I'm not on that sense I'm more with the normative theory that either the right shift occurred based on the technology intrusion in year one or it didn't It's not all relative to what happened the year before we might email should be protected whether email should be protected because Marginally in the year before the government was able to get more of our communications or not. I don't think matters I think email should be protected empirically based on a normative Expectation of privacy in it not based on a diminishing cost of government surveillance in it Whereas if you just compare to the year before the you know the status quo erodes then you don't end up with protection for so one quick point which is email didn't exist right I think trying to focus on Specificity of the technology is actually kind of misleading here I think we should look at for example the type of information conveyed in these Techniques and the in these technologies and the types of information that law enforcement seeks to gain and do those Comparisons on an apples to apples Tracking your location tracking the content of your communication focusing instead of the technology specifically on what it would cost the Government to get that type of information which existed in you know year zero which existed and then try to do an analysis on An expectation of privacy for that type of information But rather than try to focus on a technical and then to kind of just to echo Kevin's point The the expectation can kind of hinge on So so let's just I always come back to parking parking meters, right? So technology of parking meters, right? So we would not expect the government could very well put a meter made at every single parking meter in the city Or the country right and enforce parking From the minute we go past, you know our meter expiring they could enforce But we don't expect that and it's not something the government would expect the government to invest resources into or to do but technology enables them to do that to exactly do invest in and Achieve perfect perfect enforcement of parking and that's not necessarily something. I think we want right I think we've designed parking meters as a way to curb parking in red zones and traffic zones and to get people moving but we allow some kind of Some slop there because in fact the purpose of it is to promote this public good not to Tax everyone for for parking for over a meter. That's my theory, right? And so in the same way Technology for afford this has gotten so cheap that you could in fact surveil every single individual with With with whatever with whatever reasonable suspicion or standard of suspicion you have such that you can enforce almost every law perfectly Right, and I think the question is would we expect the government to do that? Would we expect the government to? To go after us if the technology does not exist. Would our expectation of privacy? You know say the government would come come after me for for a parking meter. No, right? They would not actually go after me for these purposes, and I think that's what we're trying to adjust to Can I ask a quick question of mark as well? So you said that just over ten years ago a wiretap was too grand and today they're about 200 bucks And I think that number that that shift is really a fascinating. It's just I don't want to let that go So my phone bill hasn't dropped an order of magnitude in the last ten years But but I and in theory we have a highly competitive market for cell phone service in the United States There's not a competitive market for wiretaps, right? If Aron is being investigated by the FBI and not that he ever would be But if our ends an AT&T customer, it's not like sprint can come in and offer a wiretap of Aron's phone for half price AT&T is the only company that can offer a wiretap of Aron and so you would expect that To the extent that there exists competition there that the competition wouldn't in fact be driving down the cost of surveillance Now I know that as a legal matter the phone companies can only charge a reasonable fee that a fee They can charge what the actual cost is but their labor costs are going up over time What why are surveillance cost dropping in this massive way when everything else in the in the industry is getting more expensive? Well, I would I would think and I don't represent a lot of phone companies, right? So I'm going by what's been reported in the OIG Study and the market letters But I would think the technology that enables the calls to be routed and captured and given to law enforcement has significantly been improved and there's less troubleshooting required in order to deliver that content and It's easier to find the subscriber across different networks and it was when they were roaming on different carriers networks in the past Because the nature of the network has changed So I think those things have reduced the technology the same way that technology has reduced the cost of surveillance for law enforcement to use It's reduced the cost of survey the marginal cost of surveillance for the phone companies Thank you. I don't think it's a competition. I just want to stick to this issue For the moment because I find it fascinating the issue of What and how much the companies charge and also how we talk about it because I Expect they feel like they sort of can't win because if they charge a lot, they're gonna, you know, they will help, you know chill Some of the surveillance which from a privacy perspective as a privacy advocate I think is overall a good thing at the same time though they might get a lot of Flack for like profiting off of surveillance or whatever and so there are a number of different and interesting incentives, but I'm wondering Although it would hurt my argument in the you know our argument in the paper, you know, I would love to know why Sprint charges so little Compared to the other providers and like maybe we could convince them that that's that's not reasonable Maybe you need to like you should up your up your charges Just a little bit to be more on a par with what the others are charging because if what the others are charging is reasonable like let's charge the reasonable charge and Not have it be 30 bucks all you can eat for a month I mean, but just because the law allows them to charge doesn't mean they actually charge So Microsoft just started charging a couple years ago And that was because I and others were begging and pleading with them to finally start charging Facebook. It's my understanding still doesn't charge Facebook said there would be to it that the work of getting the government to pay the bills was too much I mean that the FBI has had wiretaps cut off in the past for not paying their bills Now Facebook actually has the at the advantage of every 7-eleven in the country You can buy prepaid Facebook credit for Farmville and the police could in fact, you know prepay for their surveillance That's what you do when you your customers don't pay their bills on time you move from postpaid to prepaid but These companies should be charging. I think the solution to your your problem of what do you do? You don't want to be charging too much and profiting you don't want to be charging nothing and then not Disincentivizing surveillance the solution to that problem is to charge lots of money and donate the money to charity Right, there's no there's nothing requiring them to keep the money I think the government would have a problem with the lots of money point because the government's view is they can only charge a People don't really know and I'm sort of in the weeds and I don't think people really care Which is why they don't know but in it for stored records the Providers can charge the government a fee and if the government doesn't agree to that fee Then you have to file a petition in the case in the court where the case is pending So in every single case all around the country you'd have to say, you know Here's my fee petition. So there's incentive to sort of arrive with the government of what a reasonable fee is that they'll reimburse in Surveillance it's not like that. That is your Kalia rule say what you can and can't charge for there's no provision to go in court In every single case and it's unclear what happens if the government doesn't pay or the government thinks you're charging too much So it's a very Interesting area the Department of Justice was supposed to issue some regulations on what providers could charge they never did that And so it's out there for every provider to do its own cost study to arrive at what the marginal cost of surveillance is To then build a government and then find out if the government's gonna pay I just know just note one last thing on this point, which is really important The sketchiest and most invasive form of cell phone tracking is our tower dumps where the government goes to the phone company and says Tell us everyone who was near this place at the time and the cost of tower dumps doesn't scale with the number of people Who's in whose data is in that dump right and so one? Key attribute up if you want the cost of surveillance to actually disincentivize over collection Is that there should be a marginal cost associated with each additional person? It should cost more money to get two in boxes than one in box and five in boxes than four in boxes And the problem is right now the government goes to sprint and they say we want a tower dump for this hour of time And it doesn't matter if there were five people or a million people making calls through that tower It's the same price and so because the setting of the cost is based on the effort of the people at the company to set and Deliver the content and it has nothing to do with how many people are involved because it doesn't go up more And so the phone companies need to find a way to engineer their systems Such that the cost actually scales with the number of people. Sorry press the button for every single person in this tower dump So on that note, I think Orin has been waiting patiently To offer his comments one thing before Kevin gets mad at me. I was supposed to mention the hashtag For this program is surveillance costs plural So if you're tweeting yeah If you're tweeting out there, then that is the hashtag to use and so Orin will wrap up with you, which is I think fitting because your work is This paper was partly based on your earlier work. So thanks. Well, thanks for the invitation to be here I I think there are really two questions raised by this paper one is Should cost matter to privacy law and then if costs do matter Do we take a quantitative approach or we take a qualitative approach? So I'm going to offer a couple thoughts suggesting the cost should matter But that it's better to take a qualitative approach than a quantitative approach So on the issue of whether cost should matter here's here's the basic case for why I think costs are relevant inquiries Why this is sort of the right type of question to be thinking about The basic idea is that we have the police investigate criminal activity And we want them to investigate criminal activity when the benefits of an investigation outweigh the costs of the investigation So the benefits of a criminal investigation would be collecting evidence of a crime that allows a successful prosecution and we want that because there are all the aims of the criminal justice system in terms of deterrence and Justice and retribution those can only be achieved if there is a successful prosecution That requires evidence and that requires investigation. So we want So we want crimes to be solved in order to achieve the ends of criminal law That's the benefit of criminal investigations, and then there are two kinds of costs of criminal investigations There's the internal cost the cost of to the police of investigating the case, and then there's the external cost of investigations Now external cost of investigations is what we think of as privacy harms, right? It's the civil liberties costs of investigations. It could be The police breaking down somebody's door. It could be the fear of surveillance It could be any of the chilling effect of surveillance all of those effects of criminal investigations All the bad things that are associated with them are the externalities that are imposed by the investigation and here I draw an analogy that you know in economics is common to talk about you know the classic example of a Coal producing or coal burning plant Where the company that's burning the coal only has the cost of the coal to worry about and there's all the pollution That's created by the plant and that's an externality that's borne by the public and so from the coal company's perspective From the company's perspective They have an incentive to overproduce Because all of the social costs of their activity are borne on the public not by them and so they're going to Over create more than they than they should and you can draw a similar analogy in the investigative standpoint if the Internal costs are low and the external cost of investigations are high The police will have an incentive to over investigate. They'll use investigative techniques too much And that's really where I think the insight about law enforcement cost matters To the extent that costs are dropping that means the internal costs on law enforcement are dropping those External costs per use of the technology are the same and so we end up with the police having thinking okay Well, it's very cheap for me to do the surveillance I'll do this much more often than I would if it were expensive and that means that the police are going to do it when There's actually very little expected payoff in terms of law enforcement benefit They're not going to reserve investigative techniques for cases where they really need it It's an important case. They've got a lot of reason to think it's going to help solve the case instead they might use the investigative technique just out of basis of a hunch or some sort of Just just in case it happens to reveal some sort of information And that's more likely as the cost decrease because then there's the incentives on law enforcement are going to change So I think it's sensible in that context to consider the internal costs and the dropping internal costs and figuring out Whether the law is is going to step in because the law effectively Imposes that additional cost that accounts for the externality by saying whenever the government wants to use this investigative technique They need some sort of a reason to think it's going to work What is the effect of a warrant requirement? For example, it's saying the government has to show that it's likely to work They need to show there's probable cause that is give me some reason to think this is actually going to help solve a case And then there's the particularity requirement that is show me that this is going to be a narrow search instead of a broad search That is lower externalities rather than you would occur with a broad search So the effect of the law stepping in is effectively to raise the cost add it act a sort of attacks on law Enforcement to make sure that law enforcement is not overusing certain techniques in ways that are ultimately a Social net negative even though just based on internal costs. It seems like a hunky-dory great deal for law enforcement So I think there's a thinking in terms of cost is really helpful here And I would I think that methodology is a useful methodology Let me then then turn to whether it's better as a quantitative issue or a qualitative issue I think it's a more effective approach when it's quantitative qualitative than quantitative Because I think trying to put numbers on these issues is just too malleable for courts to actually try to grapple with I mean Imagine you're a district judge and you get a law enforcement technique and their argument maids Arguments made about cost and the cost have shifted and therefore something that wasn't a search should be a search Or alternatively something that was a search shouldn't be a search now. Maybe costs have gone up You know the union stepped in the police Department salaries are higher now and so the government argues we should really make this conduct that used to be a search now a non-search Because our internal costs are higher it would presumably be a two-way street not a one-way street in terms of changing What is a search and would a court have to consider that in each case and adopt a rule as to when they should say something Is a search or not a search? Yeah, if it's a quantitative approach then you have to start saying okay Let's introduce some rules here as to when something has to become Search or a non-search and I think that's just too hard to do these cases are just coming up in such different contexts And it's so malleable as to what the costs actually count as it's so easy to come in with different calculations We would not want a case-by-case approach by which any Prosecutor could argue that something that used to be a search is no longer a search or any defense attorney could come in and say Well, something is now a search and you know try to re-litigate all of these questions of Fourth Amendment law in each case In the paper, they sort of back off. I think that the quantitative approach by saying, you know, it's not that it's a rule It's that it's you know, maybe it's a rule of thumb. It's the canary in the coal mine It's something to think about this is when it should raise a red flag You know, I think if it's only a question of here's when there should be a red flag Well, we get red flags from intuitions and we it sort of reflects a sense of wait a minute something has changed I don't know if we need to go through mathematical calculations, which themselves would be hotly disputed in order to then say Okay, we've done the math and there's been factual findings by the district judge about the exact changing shifting costs of surveillance Now we can hereby declare a red flag shall be raised Or the canary is now died and we should think of this issue. We now enter the thinking phase I think it's much better to just say listen at the appellate stage or at the level of the Supreme Court where the Supreme Court allowed to rethink the direction of the doctrine to say we've just entered a different world in which this type of investigative technique is being used much more often than before And therefore, you know, we need to think about the role of cost and think about maybe the Constitution stepping in when it wouldn't have based on an earlier technological era So so one argument is is this really quantitative or ultimately are you sort of going back to So is it really quantitative or really is it a qualitative judgment once the the the red flag has been raised? Another issue I wanted to ask you guys about is so so what's the role of statutory privacy regulation here? This is very much focused on constitutional regulation So one argument would be that if a statute is passed that that effectively raises the cost of Investigations for law enforcement. Does that mean how does that get factored into the constitutional inquiry? Or would you just sort of have like a some branch should step in and you use the cost methodology? ignore law Just focus on cost assuming that there's no regulation and then then say somebody has to step in because it seems to be one argument that you Could make using your methodology is alright if Congress steps in and regulates this that Clearly raises the effective costs of the police and maybe then the Constitution doesn't need to step in so you could have sort of a Deference idea where if the legislature has acted the Constitution doesn't need to act anymore And and more broadly, how would you deal with the question of statutory regulation and and turning that into quantitative costs? Sure I'll just take this middle point and then you take the last one you want Just don't just quickly on the on whether it needs to be quantitative. I actually agree with you I think the the idea was back of the envelope and we kind of spitballed this rule of thumb as a way to kind of articulate this argument and the real goal wasn't necessarily to Find hard math or use an exact dollar figure, but it was a way to help Kind of people that may not understand technology or or try to concretely represent in a salient way What these changes look like what the technology enables and how that's just and use maybe you know some sort of metric to Demonstrate what we all understand intuitively as a trend some people more than others some people with a better sense of Technology than others and one of the thinking was well everyone understands money. Let's talk about money, right? Those just just on the quantitative I'll start it with your last question, which was about the role of Congress I Speaking generally I think that this is an argument for policy changes from Congress as well and you know Harry Certains original article was focused on trying to explain this idea of structural constraints for policy makers We expanded that to judges as policy makers But but you know we would hope that like this kind of evidence would be helpful in convincing a Legislature to do something if we had legislatures that did things right now You know, but particularly on privacy. We're in a really frustrating position You guys know this as well as anyone like the issue of we were talking about earlier warrants for email We now have really strong precedent saying that the fourth amendment protects our email and requires a warrant We have all the major companies Requiring warrants and the government refusing to push them too hard for fear of going into litigation and getting another ruling Saying that they have to get a warrant from the courts. We have Unlike many other issues. We have privacy advocates for square You know lined up with the entire internet industry putting out a lot of resources to Congress to try and pass a law To make our current statute constitutional because under you know under the way we view the fourth amendment in the way The courts are viewing it the law is unconstitutional right now and even with all those things lined up behind us We still have yet not been able to get that to completion I'm still hopeful of that and we have some real champions like Senator Leahy helping us out But I speaking generally don't you know at this point I'm actually more hopeful of the courts moving faster than Congress, which is is worrisome Let me push you on a little bit So so it seems that the problem is that the privacy side has already won without a Supreme Court ruling or a statute in other words the practice is that warrants are required Practice is that the big boys? Yeah Required right and we just don't know what happens with the smaller companies certainly the government will ask for everything they think they should be able to get and Then we don't know you know that they can keep What they have and there's no suppression remedy under act by right Right, but there is under the Constitution. So if a challenge is brought that's one of the cases that could go to the courts Right, so the challenge has to be brought first and but I mean that at a practical level there's the law as People who have really expensive lawyers follow it and then there's the law as small companies without export outside counsel follow it and The fact is that there are plenty of small companies out there that are probably not following the same rules Google and yahoo are following but but at least when when the issue is raised The result is that a warrant is obtained And so so this strikes me as one of these situations where you could argue Well, what the cost of getting access to emails then effectively high because the practice is that a warrant is required And so the warrant is already providing that and maybe you does that mean you you don't need the constitutional rule because the practice is already existing or What to what extent does the practice are we focused on sort of? Just abstract cost ignoring law. Are we focused on sort of what actually happens? Which which is it that matters? You know our paper is focused on monetary costs like your overall Your overall question of how do we factor in the existing legal costs in the analysis is actually when I don't have a great answer for it Like that's something I want to think about. He's really helpful at bringing up things that are you know, you need to chew on but But that brings us back to your initial Question which is like quantitative versus qualitative and I guess I take issue with why do we need to choose like can't we Try and address both and can't one help explicate the other You know our our modest hope with this paper It was that someone moving to suppress location information would actually articulate a cost based Perhaps and most likely and frankly hopefully in conjunction with other arguments Our last modest hope was that that motion might get granted and then our you know, insanely You know optimistic hope is that that would be upheld You know as it goes up off the chain And we get cited yes, that'd be fabulous, too Yes, and then yeah, but uh, you know you say you say that quantitative is too malleable But like quantitative judgments about reasonable expectation of privacy I mean like that's one of the biggest problems in Fourth Amendment law is just like how unmoored that analysis so often is I mean you look at Smith and particularly in the case of technology where you often have judges Who they're thinking on the issue only evolves when they start using the technology themselves? I mean one of the key determiners in Smith v. Maryland the the pen register case was all the Justices when they grew up you connected a phone call by telling that number to an operator and So their natural inclination was well, that's not private the fact that they automated it didn't make a difference I was you know, and so I Another key fact was a notice in the phone book About how the phone company combats fraud from which someone of course would assume that they have the ability to record numbers I mean, they're just drawing on kind of random stuff to support their conclusion that there isn't an expectation of privacy So if if there's any way to inject some quantitative rigor into that I think that's worthwhile and that that was certainly the the overall gist Of what we're suggesting even if and you know, you're right to say this We weren't saying like this is the hard rule and this is the way it should be done We it is more of a thought experiment in a way of demonstrating that it could be done Rather than a we absolutely think that courts really should follow a strict Order of magnitude cost rule following these rules And I do think at the end and the end when we touch on the 3000 number right that the fact that the FBI is able to simultaneously track 3000 people For you know that the FBI has the capability to concurrently track 3000 people That quantitative number I think is a difference not just an amount but in kind right? That's beyond what they would ever have capability to do without the technology Right and I think that that that that informs I think qualitative informs the quality of this is a different thing Right if you could not ask even for a manhunt to ask the 13,000 agents to not sleep Not you know go to eat and whatever else and to try to track 3000 people Simultaneously would not actually be physically possible. You would either have to get a bigger budget or take take resources off You know other agencies whatever else to do this And whereas the technology is like you can essentially by sending an order to a company or a set of companies can't they can do this Although I just just one point I've heard you speak on this before even before you wrote this paper And one of the things you used to say is metadata for one user is different than metadata at scale And you didn't need a cost analysis to come up with that answer or Chris's point, right? Whether a particular user connected to a tower is a different question Then give me all the users who connect into the tower and we don't need the the quantitative math to feel that That's different, but it supports that point It's another arrow in the quiver It's another arrow in the clothes But I think the point is that you can get to that same conclusion by looking at the externalities and the number innocent users affected or the widespread nature of the surveillance that's going on as opposed to the targeted nature without a strict cost analysis I mean I'd be more sanguine about that if we actually had that answer from a court at this point from a higher court Like until we actually get that answer I feel like providing all the ammunition we can would be would be worthwhile There's just one thing I did want to say I noticed there's some press here and being recorded One is all my comments are on behalf of myself and not any of my clients in second I may have misstated the cost of wiretap now I think I 200 was the low number in the marquee responses and it may have been between 200 and 500 not Fundamentally different to my point, but I don't want people to leave here thinking the cost of wiretap the cell Company was 200 on an average. I don't think it was. I think that was a low end as opposed to still too cheap Okay, so I think do we want to make time for a couple of Sure unless you have You know, I I think I would like to open it up to the audience to see if you guys have questions If not, I certainly have some but Do you want to use the mic for people at home? You were you were talking earlier on Twitter about companies that weren't using it you like the Guardian Al Jazeera and their Certificates that have expired frankly from the outside that seems like half-assed measures And why is it that they just don't seem like they're carrying that that much about that $30 to to renew their their certificate? So let me try and answer your question in a way that that brings it into what we've been discussing on stage so what Ashka and and Kevin really have been focusing on is the cost of the government spying on you and There are technologies that you can use to raise that cost as well, right? So in the case of your cell phone There's nothing that you can really do to make it more expensive for spin to track you in that case is binary Either the phone company can locate you or the phone company cannot locate you And what the things you have at your disposal are basically turning off your phone so that it no longer functions as a phone You don't really have a lot of control there, but for other forms of surveillance for surveillance of your Financial transactions you can you know maybe use an anonymous or pseudo anonymous currency for your internet activities you can use encryption technologies and Anonymity technologies to make it more difficult for the government to track you now I personally believe that if you are the target of government surveillance The games over they're gonna get what they want one way or another particularly for the national security agency and the FBI and agencies that have a lot of resources maybe the you know the local cops don't have Quite those resources yet, and maybe they never will but I think what you can do Particularly for internet based surveillance if you are not a target you can raise the cost such that Wholesale dragnet surveillance will no longer affect you in in as significant a way as before But I want to make it clear that there is this like gigantic asterisk, which is that cell phone This doesn't apply to cell phones the everything sucks with cell phones and privacy I mean that's just simply because of the laws of physics like there's no way to hide from the cell phone towers But I do think that we can meaningfully raise the cost of dragnet internet surveillance I don't think that the NSA should be able to get everyone's emails I don't think they should be able to Look and see everyone that's visiting a news organization, which we learned they were doing this week to we're here So yeah, if as the as their costs are going down. We need to do everything we can to raise them back up again But as somebody who works for a news organization and tries feebly to Raise the cost of surveillance It's it also there's there's a cost then that you're paying yourself And so I think that that is important to consider as well. I don't think we want to necessarily Make it difficult for everyone to use the internet which so there's there are some privacy Protecting technologies that are so unpleasant to use that even if they were financially free. They no one would actually use them and But many of them are many of them many of them are and you know The only journalists who have started to use email encryption in the last year or so have done so because The threat was finally clear and the writing was on the wall and some of them had to have how-to videos made for them But you know the legal profession isn't quite there yet Even though the writing has been on the wall for some time for them I think that encryption of web traffic is a no-brainer that isn't end-to-end You know it's and it's you to Google. It's not you to your your friends that you're communicating with through Gmail But it is easy right now for every organization to deploy HTPS encryption such that your university your employer your internet company the government won't know which articles you're reading on that site I think that's like a very modest goal and generally what I try and focus on are Things that are within reach and that's totally within reach now and just quickly to bring it back to phones there So Chris is a kind of very adamant about this topic and I worked on a story on this topic There are encryption technologies for your cellular communication as well So the carrier has the since essentially the equivalent of say HTPS for your phone You know a 5 1 a 5 3 or some of these technologies But and what they do is they make it more difficult for the law for law enforcement using off-the-shelf equipment Like the ones we talked about earlier to record the contents of your conversation without the help of the without the help of the So so there they can get your communication by either going to the phone company and requesting the contents of your communication And the phone company then has to divert resources or divert your calls and record them Or they can sit outside your your house with a van and one of these systems and record your conversations And there are encryption technologies that can be placed that the phone company can use to To prevent the ladder the sitting outside of the van But we've since seeing slow adoption for example in the US at least of these these encryption Technologies at least the ones that would thwart this type of free surveillance So I wanted to touch on one one thing that I thought was particularly interesting about your paper and It was that you were focusing on location and I can understand why you did that But that resulted in this very nice neat chart and so forth But there are so many other technologies that are being surveilled now and I'm curious to hear about what thoughts you guys have on how this might apply to email other types of surveillance that might not be quite as Neat as location Yeah, I mean so although it's not in our paper. We did look at drones Because there's everyone loves everyone loves runs are awesome. I mean scary awesome, but I Kind of want one don't yell But and looking at the cost of that and then you know actually funnily enough You know right now when we have drones that require a human operator to do most things the difference in cost Actually, wasn't that different from say someone following a bumper beeper? That's right operating an MC one agent versus two But we are gonna get to a point where You could have a cloud of autonomous drones covering an entire city And I think that you know the court that thought that 28 days of tracking a car was problematic would probably also have a concern with You know a ubiquitous Perpetual surveillance platform that could track everybody over all time in public which is actually I think where the technology is going and in fact It's where the technology is right now in certain parts of the globe where we are deployed You know there are there are these there these drones with like multiple Massive cameras that are pointed everywhere and that can cover miles of time and So I think that you know as we hint as I hinted in my comments And as we hint at the end of our paper I think that that kind of surveillance which would basically Reduce the ability, you know reduce the cost of tracking people through a city not only to pennies a day, but like Infantesimal fractions of pennies, you know a year Would likely with I mean would certainly trigger our red flag and and just killed that crap out of that canary pardon my French You know as I as I mentioned in my comments also the the the the example of Mass pen pen registers. I think would also do that basically anything that implicates the privacy of millions of people is probably going to Raise our red flag although so I would I would pivot just slightly and I and we touched on this a little bit Before about busting down the door and going into someone's house. I think Chris was talking about it I would focus less on the people and cost of acquiring the type of information Right, so we have different technologies that cheapen the cost of Acquiring say the location of someone but for example acquire the contents of the communication We thought about you know one one thing that I did in an early kind of Back of the envelope was looking at cameras, right? So like the UK has a pretty extensive grid of cameras and that actually changes the cost of identifying or Or surveilling people from the visual surveillance perspective I could always hire a team of people to follow or an around in a van But having a grid of cameras that are kind of perpetually present and able to record his His activities whether he robs the store. I've heard you do this a lot You know like what whatever whatever you may be I've up to that changes the cost of serve You know the cameras themselves Email surveillance allows you to rather than go to the post office or go and break into your house to get your letters to go and You know capture your communications off the wire off the provider Cloud storage is a great one right so cloud storage Obviously changes the cost from again going into your house going through your affects Like going to a black job a black bag job of going and trying to get your stuff to just like going to Google And either hacking your account or getting that information with a legal requirement from Google So there's definitely a number of avenues you can look at but essentially the the general trend is that Technology changes our ability to access information both at scale as well as the the ease with which we can get that information the convenience both from us as individuals as well as for say law enforcement So do we want to have snacks now? Yeah, okay, yes Institute and this question is not related to be instituted off just my own you all talked about norms and The phrase rights shift was thrown around and I just want to poke the bear a little bit more and get your opinions on Do you think Do you think that a norm cascade is possible for laws and policy related to privacy and surveillance or do you believe that? Technology grows so rapidly and changes at such a pace that it can never truly happen I'm sorry. Do you repeat the question one more time? Sorry, it's kind of a mouthful We talked about norms and a right shift And so I was wondering if the panel what your thoughts are on do you think a norm cascade is ever Possible for laws related to privacy and surveillance or does technology change at such a rate? That it that this cascade could never really happen So I'm not I'm not sure what you mean by a norm cascade norm cascade to me is It's just a time when everything kind of goes across the board and everyone jumps on board and says Yes, this is an issue From right now. I would think that the NSA leaks are kind of jolting people into wondering what we should do But my brain tells me everything changes so quickly with technology that I just don't know if it can happen I mean maybe that we have a norm cascade that addresses what we found out about While there's also other things that are happening that we haven't found out about that we'll find out about in ten years And we won't have been able to keep up. I mean I think your comment highlights I mean the problem that this paper and countless others is trying to address which is policymaking turns on us both Recognizing and understanding and reacting to changes Therefore the response necessarily lags to some extent and I think that with technology both because of its complexity And because of how fast it changes policy processes are that much slower in terms of keeping up that is If anything that may be the fundamental crisis of the you know 21st century or you know This millennium which is how do we figure out what the structures are that will keep up with the problems that technology creates? While also taking advantage of the benefits that technology brings I am not the philosopher King who can who can Who can answer that question? Certainly, I think finding ways to quantify that change and demonstrate it to policymakers who may not be familiar with the technology is a critical part of that You know I and I want to optimistically say that I think we can keep up in a way that keeps us from driving off of an existential cliff But I'm not yet convinced of that But like if I didn't believe overall in that project. I probably wouldn't do the job that I do Which is all about trying to keep ahead of the head of that game There are other questions I'm gonna ask one just because I have this esteem panel here and Kind of thinking out loud kind of something back to what or and you had said which is this Internal math of cost-benefit analysis that you do the law enforcement does whether and We want law enforcement to do of whether a particular line of inquiry investigation is likely to yield a outcome that is kind of beneficial and worth the cost and Kind of thinking out loud and this is more less in the law enforcement context with more in the kind of surveillance that Kevin's been speaking of of the NSA Surveillance, how do you model or think about a cost-benefit analysis when the kind of your tasked with Kind of at all costs right and so the the mandate is not Prevent terrorist attacks or the mandate is not try to keep them down The the mandate is essentially you can have zero We should have zero terrorist attacks at all costs You should prevent any other attacks on US soil no like in terms of you know from a computer science Perspective you have this thing of like like uptime and service level agreements. You have to have ninety nine point nine nine nine percent not, you know events like you have to have zero events of Terrorist attacks and so for people that are like the NSA for people operating in the IC intelligence community Trying to decide whether something's worth investigating. How do you kind of do that cost-benefit? Analysis in a way where you've been tasked to do everything at all costs So so how do you come up with a framework? I'll try and throw something in there. I don't have the answer here and Mark may know the answer, but he probably can't tell us the answer You know the NSA for a period of years was engaging in bulk surveillance of internet metadata, too It wasn't just the telephone meta metadata that they're still doing to this day And you know, we don't have the full story of what happened there and what led to them Stopping that program but under questioning they they have said that The they've said the reason that they no longer do it is because it wasn't really giving them bang for buck You know the NSA has this pool of money. It's a very large pool of money I think what ten billion dollars a year or something Sorry For the IC so the IC has a very large budget and they have to figure out how they're gonna spend that budget and Certainly surveillance is cheap means that they can do Lots of it and then spend the remaining money on things like spy satellites that are really really expensive But you know, I think there is some kind of like bang for buck Decision and this is making process that takes place and if we take them at their word, which we probably shouldn't because they keep lying to us Maybe they decide to abandon programs when they're no longer worth their costs the problem is the cost goes down over time and Many of the forms of surveillance they can do involve initial collection at a certain fixed cost And then they get to data mine it after the fact for many different forms of information So, you know, the NSA decides to collect cell phone location data or is to collect cell phone records And then from that they can mine call records. They can mine location records They can mine location records to see where the targets are they can mine location records to see who's co-traveling and and you know my concern about the way that We know the NSA is doing stuff is once they have the data in their database Many of the really sketchy things come from the searches They say they acquire for this limited purpose and then this like mission creep comes in where oh, we've got this data The UK government, you know has data on every web query coming to the United Kingdom. Let's see who's looking at WikiLeaks's site Let's see, you know in real time, which videos are getting the most likes on Facebook because they just have this data there I just make one opposition. I don't really think it can be an at all cost mentality If it was an at all cost mentality, they wouldn't observe the rule at all law at all, right? They just say well We don't need to worry about that and we there's no risk to us that the cost that they consider the cost of you know They do consider the cost of public approbation when it comes out of individual liability if somebody exceeds, you know What they believe to be the legal mandate there are costs and when providers push back and they have to decide that you know They're gonna fight or not fight when the provider push back You know you've heard about a particular fight that may not be all of them. They may have decided to let some go So there are costs. It's just they have a lot of money So it's not the financial cost maybe that's the full cost-benefit analysis But there are a lot of externalities as Ornn was talking about that. I think figure into their analysis And just to clarify before you respond to Chris's point I don't think it's this like I have fire insurance, right? I've never needed to use it, right? But it's still cost-effective for me to have it because You know it's such a catastrophic event and I want to avoid it's that I'm gonna keep it And I'm gonna probably hopefully never need it But I'm gonna cover the space and I've under this mandate under this kind of rubric where you like That the public will not tolerate and we you know for the administration will not tolerate any other attacks How can you have this this this kind of this analysis? Sorry? Yeah, I mean it's an interesting question of Sort of you said this is the mandate and I guess I push back a little bit and say well Who says that that's the mandate are we saying sort of that's what is believed within the executive branch? Is that what the president says is that what the policy makers are actually thinking is that with the public? Thanks, and and I'm you know I think I think absolutely it's true within the executive branch the mindset is I we will we should do anything within the law and within our budget within our powers to Eliminate the chance or minimize the chance of a catastrophic terrorist attack absolutely right That I don't think when the public decisions are being made or even when the decisions are being made You know what's what should the classified budget? You know the black budget in the United States be I don't think that thought is Costs is no object that we should make it as high as is possible Because you know I think there's always more that could be done and that's reflecting some sort of judgment that's being going on Okay, they're diminishing returns at some point So so I guess I guess I wonder if in in reality that is you the extent the mandate means like a commonly Agreed upon view that we all share I guess I wonder if that's actually the case or whether there aren't I tend to agree with Mark there's their cost judgments being made and values and trade-offs being being made by decision-makers all the time Oh, and I'll just add that speaking of the trade-offs and the cost-benefit analysis That applies to the NSA programs and what their benefit is and what their costs are for more on that tune in next Tuesday At 4 p.m. We'll be having an event right here on the costs of the NSA programs to the internet industry to the taxpayer To internet security and to our foreign relations Look at that set up All right, well, thank you so much guys and I think we have some refreshments in the back And this was enlightening and I really appreciate you're inviting me to to moderate And thank you guys so much for coming. Thank you so much Jennifer