Google, Facebook, and our privacy: We're all in denial

"Give us our privacy!"

Two years ago, after Facebook established a service called Beacon that shared users' behavioral data with partners, a multitude of Facebook users started an uproar, in their own way. One of the countless groups that sprang in Beacon's wake was called, "Petition to tell Facebook, give us our privacy!" Its founder wrote, "The second goal of this group is to tell Facebook that we do not want them watching what we do online. What are we all, terrorist suspects; and what is Facebook? The CIA? We deserve to have our privacy. It's a right given to us in the US Constitution."

Actually...no, it's not. The Fourth Amendment grants citizens the right to be protected from unwarranted search and seizure; and the Ninth Amendment states there are other rights too numerous to mention in the Constitution. Judges have interpreted the Fourth and Ninth Amendments as coalescing into something they call the expectation of privacy. That is to say, there are situations where a reasonable citizen should expect to be reasonably private. But as judges interpret it, that expectation rarely arises, or is at least diminished, in public places.

If we think of the Internet as a database, then there's the technical feasibility of policies put in place to restrict information access. But the more we characterize the Internet as a public place -- as a community of 350 million users, like Facebook -- the less likely it will be perceived as a source from which all privacy flows.

Facebook's privacy policy changes were rolled out yesterday. And if users follow Facebook's gentle and friendly instructions as to how to go about implementing those changes -- as the ACLU and the EFF correctly pointed out this week -- those users will merrily flip their privacy controls off. Because "Off" -- or as Facebook calls it, "Everyone" -- is now not only the default setting, but the "Recommended" one.

The ACLU's campaign to compel services including Facebook to improve and observe their own privacy policies, is called Demand Your dotRights - Privacy 2.0. Here's how the ACLU explains the portion of the campaign that deals with social networking: "Social networking sites are an amazing way to connect with friends and family. But the information that these sites collect about you -- not just what's on your profile but also the records of everything you do on the site -- says a lot about your interests, habits, beliefs, and concerns. And outdated privacy laws, written before the Internet even existed, mean that even when you think your profile is 'private,' it isn't private to the government. Don't pay for social networking by giving up control of your personal information. Demand a privacy upgrade. Demand your dotRights."

The ACLU's concern is very reasonable: It's not that Facebook or Google could potentially share your photo or address or phone number with someone on your "Do Not Share" list. It's that aggregators and data miners (the real subject of Facebook's latest policy changes, made more prominent by their absence of reference) are actually encouraged, as part of the business model, to make use of that data collectively, to determine how we live, how we eat, and maybe when it is we use the bathroom.

The most poignantly ironic element of the ACLU's paragraph above is the phrase, "Don't pay for social networking." Because we already don't.

"Privacy is a basic human need"

In response to Schmidt's comment to CNBC, security technologist Bruce Schneier cited an essay he wrote in 2006. In it, he wrote, "Privacy protects us from abuses by those in power, even if we're doing nothing wrong at the time of surveillance. We do nothing wrong when we make love or go to the bathroom. We are not deliberately hiding anything when we seek out private places for reflection or conversation. We keep private journals, sing in the privacy of the shower, and write letters to secret lovers and then burn them. Privacy is a basic human need."

Quite arguable, especially if we phrase it like Schneier -- as a need rather than a right. But in that light, Twitter also tapped into another primal human need: to announce the events of our lives. As Twitter described itself from the very beginning, it's "a global community of friends and strangers answering one simple question: What are you doing?"

And we know that the guy in the Verizon ad who's sitting on his back patio and Twittering, "I'm...sitting...on...the patio..." is not at all exactly unique.

The right to privacy is in contest with the "basic human need," to borrow Schneier's phrase, to broadcast one's events to the world. And as long as the latter wins out, the ability and the inclination will be there for companies to make use of the data we're spilling out in buckets, in aggregate form. For as long as we tell the world what we're watching on TV or eating for lunch or where we're seated, but we refrain from telling when we're in the bathroom or making love, simple deduction will lead some algorithm somewhere to the inevitable conclusions inferred from the information we refrain from providing. It's what legal scholars would call the "fruit of the tree."

Privacy is not something that Facebook or Twitter or the ACLU will give us. It is something we have to nurture, cultivate, and build for ourselves. We as Internet users seriously need to revisit the idea of globally relevant identification -- digital certificates that identify us to Google and Facebook and Betanews and our mother-in-law's blog. Such tools would cost us a bit of our cherished right to anonymity (something else not guaranteed by the Constitution), but it would enable us to start guaranteeing our own privacy, building policies for databases that state up front what data belongs to us and what data does not, and disabling the ability for any service we designate to maintain copies of our data.

If we really want privacy, just like every other right, we're the ones who need to build it and to use it. Otherwise -- especially out here on the Internet -- it will die.

The opinions expressed here are those of Scott M. Fulton, III, who is solely responsible for his content.