Imagine there's no Heaven
It's easy if you try
No hell below us
Above us only sky
Imagine all the people
Living for today
The movie Expelled takes emphatic exception to this view, and used a bit of Imagine (15-20 seconds) to illustrate that point of view. The film directly challenges Lennon's
view expressed here. There was some controversy about whether that
could be considered Fair Use or not. Copyright holder Yoko Ono sued;
the judge however did lift his preliminary injunction on the grounds
that the defenndant was likely to prevail. The suit is still ongoing,
but the judge wrote, "... on the basis of the current record,
defendants are likely to prevail on their affermative defense of fair
use. That doctrine provides that fair use of a copyrighted work for purposes of criticism and commentary is not an infringement of copyright." [italics added]
More from the ruling, at http://online.wsj.com/public/resources/documents/expelledsdny.pdf. This is a good outline of the meaning of "transformative" (starting at p. 11)
The link http://cyberlaw.stanford.edu/node/5876 has an interesting take on Fair Use insurance.
Bottom line, there is "no reasonable expectation of privacy for work email" and they can read it even if they promise not to.
That last part fits in with longstanding law regarding employment-at-will.
The main issue is really the "no reasonable expectation" part, since that blocks civil tort suits. Even if "reasonable expectation" is highly subjective.
Who is reading all your gmail? Does it matter if it is not a person?
What could they do with what they discover??
Privacy on University electronic mail systems [1997-1998] http://www.luc.edu/its/policy_email_general.shtml
In the section subtitled "Privacy on University electronic mail systems", seven reasons are given why someone else might read your email:
The University community must recognize that electronic communications
are hardly secure and the University cannot guarantee privacy.
The University will not monitor electronic mail messages as a routine matter.
But the University reserves the right to inspect, access, view,
read and/or disclose an individual's computer files and e-mail
that may be stored or archived on University computing networks
or systems, for purposes it deems appropriate. There may arise
situations in which an individual's computer files and e-mail
may be inspected, accessed, viewed, read and/or the contents
may be revealed or disclosed. These situations include but are
not limited to:
Some possible protections (not actually implemented):
Protection against items 5,7: If your email is examined because we believe your account has been compromised, any contents implicating you on other matters and associated with your legitimate use of your account will NOT be held against you (except in cases of ????)
Protection against 1: If your email is examined accidentally or as part of routine system maintenance, any contents implicating you on any matters will not be held against you (exceptions???)
[While these would not be enforceable for staff, they WOULD be for
Legit: 2, 3 [maybe], 4 [but what grounds for suspicion?]
Item 6 could be clearer that outside investigations must be part of law enforcement;
Generally, most employer monitoring falls under one of these.
Phone surveillance in the workplace
Keystroke monitoring
Location monitoring
Side question: do computers empower workers, or shackle them? Does it matter?
Warshak: spammer promoting "Enzyte" for "natural male enhancement" He was a suspect in a fraud case. The gov't got an order from a US Magistrate asking for his email records. The emails were turned over to him.
Eventually Warshak found out about this:
Warshak: get a search warrant!
US: all we need is subpoena (much weaker)
Are subpoena rules for email overly broad?
US argument: users of ISPs don't have a reasonable expectation of privacy.
This is clear for employer-provided email, though there's no reason to suppose loss of privacy extends to the government.
But what about commercial email? Here's an imaginary Yahoo Terms-of-service by Mark Rasch, from securityfocus.com/columnists/456/3 :
Because a customer acknowledges that Yahoo! has unlimited access to her e-mail, and because she consents to Yahoo! disclosing her e-mail in response to legal process, compelled disclosure of e-mail from a Yahoo! account does not violate the Fourth Amendment.
The point here is that because Yahoo has access to your email, the gov't thinks that all your email should be treated just like any other commercial records.
Govt' argued that this case was like the 1976 US v Miller case, where bank records were found NOT to be protected
Stored Communications Act, part of ECPA
email stored 180 days or less: gov't needs a warrant
more than 180 days: warrant, subpoena, or court order
See http://www.usdoj.gov/criminal/cybercrime/ECPA2701_2712.htm
§2703 (a): less than 180 days (b): more than 180 days
Warshak was arguing that the gov't should need a warrant for ANY of his email.
District court:
Warshak won. (Quote from full 6th circuit decision)
3-judge panel of 6th circuit appellate court: Warshak won, June 2007. The decision was far-reaching, not specific to
the facts at hand. The decision was by a 3-judge panel. From the ruling:
October 2007: 6th circuit agrees to en banc review (whole court)
July 2008: full court ruled that the case was not "ripe": broad question was not ready to be addressed.
The ripeness doctrine serves to "avoid[] . . . premature adjudication" of legal questions and to prevent courts from "entangling themselves in abstract" debates that may turn out differently in different settings.
Conventional wisdom as to why the supreme court is not likely to hear the case: they would have to find that the case was "ripe", and they are much more likely to wait for a case where "ripeness" is more evident. (See Eugene Volokh, volokh.com/posts/1176832897.shtml) Traditionally, the courts consider 4th-amendment cases "after the fact".
Back to gmail issue. Google reads all of everyone's gmail. It's just not necessarily read by people.
And is there a special concern if this kind of information became
available directly? For example, if employers could look up your
magazine subscriptions?
Original reading: Simson Garfinkel, Adopting Fair Information Practices to Low Cost RFID Systems.
Overall survey of active v passive rfid tags.
Why they might remain attached to purchased items.
RFID tags in identification cards
Differences between RFID and bar codes. In one sense, both types
work by being "illuminated" by a source of electromagnetic radiation.
In practice, most ordinary materials are not opaque to RFID
frequencies, and more information can be stored.
creeping incursions: when do we take notice? Is there a feeling that this "only applies to stores"? Are there any immediate social consequences? Is there a technological solution?
How do we respond to real threats to our privacy? People care about SSNs now; why is that?
Are RFID tags a huge invasion of privacy, touching on our "real personal space", or are they the next PC/cellphone/voip/calculator that will revolutionize daily life for the better by allowing computers to interact with our physical world?
Imagine if all your clothing displays where you bought it: "Hello. My underwear comes from Wal*Mart"
(Well, actually, no; RFID tags don't take well to laundering.)
RFID tags on expensive goods, signaling that I have them: iPods, cameras, electronics
Loyola RFID cards
RFID v barcodes: unique id for each item, not each type readable remotely without your consent
"Kill" function
Active and passive tags
Are there ways to make us feel better about RFID??
Garfinkel's proposed RFID Bill of Rights:
Users of RFID systems and purchasers of products containing RFID tags have:
What about #3 and I-Pass?
Serious applications:
Technological elite: those with access to simple RFID readers? Sort of like those with technical understanding of how networks work?
2003 boycott against Benetton over RFID-tagged clothing
boycottbenetton.com: "I'd rather go naked"
Some specific reasons for Benetton's actions:
Is the real issue a perception of control? See
Guenther & Spiekermann Sept 2005 CACM article, p 73 [not assigned as reading]. The authors developed two models for control of RFID information on tagged consumer goods:
Is there a "killer app" for RFID? Smart refrigerators don't seem to be it.
I-Pass is maybe a candidate, despite privacy issues
(police-related) Speedpass
(wave-and-go credit card) is another example. And cell phones do allow
us to be tracked and do function as RFID devices. But these are all
"high-power" RFID, not passive tags.
What about existing anti-theft tags? They are subject to some of the same misuses.
Papers: Bruce Eckfeldt: focuses on benefits RFID can bring. Airplane luggage, security [?], casinos, museum visitors
Does RFID really matter? When would rfid matter?
RFID:
tracking people within a fixed zone, eg
tracking within a store:
entry/exit tracking
profiling people
cell-phone tracking: when can this be done?
inducements to waive privacy? having to take products to "kill" counter , or losing warranty/return privileges
RFID shopping carts in stores: scan your card and you get targeted ads as you shop. From nocards.org:
"The other way it's useful is that if I have your shopping habits
and I know in a category, for instance, that you're a loyal customer
of Coca Cola, let's say, then basically, when I advertise Coca Cola
to you the discount's going to be different than if I know that you're
a ... somebody that's price sensitive." Fujitsu representative Vernon Slack
explaining how his company's "smart cart" operates.
RFID MTA hack? We'll come to this later, under "hacking". But see http://cs.luc.edu/pld/ethics/charlie_defcon.pdf (especially pages 41, 49, and 51) and (more mundane) http://cs.luc.edu/pld/ethics/mifare-classic.pdf.
See also http://getyouhome.gov
In the article at http://news.cnet.com/New-RFID-travel-cards-could-pose-privacy-threat/2100-1028_3-6062574.html, it is stated that
Homeland Security has said, in a government procurement notice posted in September [2005?], that "read ranges shall extend to a minimum of 25 feet" in RFID-equipped identification cards used for border crossings. For people crossing on a bus, the proposal says, "the solution must sense up to 55 tokens."
The notice, unearthed by an anti-RFID advocacy group, also
specifies: "The government requires that IDs be read under
circumstances that include the device being carried in a pocket, purse,
wallet, in traveler's clothes or elsewhere on the person of the
traveler....The traveler should not have to do anything to prepare the
device to be read, or to present the device for reading--i.e., passive
and automatic use."
The article also talks, though, about how passports (as opposed to
the PASS cards usable for returning from Canada or Mexico) now have
RFID-resistant "antiskimming material" in the front (and back?) cover,
making the chip difficult to read when the passport is closed.
Search engines: don't use search engine suggested by isp or by browser; google/gmail: avoid
see http://cpsr.org/issues/privacy/ssn-faq/
Privacy Act of 1974: govt entities can't require its use unless:
SSN and:
There had been a trend against
using the SSN for student records; some students complained that no
federal law authorized its collection for student records and therefore
state schools could not
require it. Alas, while this idea was gaining traction Congress
introduced the Hope education tax credits and now it is required that students give their SSN to colleges. Even if they don't intend to claim the credit.
What exactly is identity theft?
National Identity Card:
What are the real issues?
tracking?
matching between databases?
Identity "theft"?
Starting on page 85, there's a good section in Baase on stolen data;
see especially the table of incidents on page 87. What should be done
about this? Should we focus on:
Matching:
Should the government be able to do data mining on their databases?
In particular, should they be able to compare DBs for:
Government and e-privacy:
What if FACIAL RECOGNITION were to really take off? What would be the consequences? There are all those cameras already.
Most arguments today against facial recognition are based on the idea that there are too many false positives. What if that stopped being the case?
What about camera evidence of running lights or speeding?
E-bay privacy - Ebay has (or used to have) a policy of automatically opening up their records on any buyer/seller to any police department.
This one is quite remarkable. What do you think? Is this ethical?
HIPAA (Health Insurance Portability & Accountability Act)
basic supply/demand. You set price P, user X has threshold Px
But what you really want is to charge user X the price Px.
Example: Alice & Bob each want a report. Alice will pay €1100, bob will pay €600. You will only do it for €1500. If you charge Alice €1000 and Bob €500, both think they are getting a deal.
But is this FAIR to Alice?
In one sense, absolutely yes.
But what would Alice say when she finds out Bob paid half, for the same thing?
Possible ways to improve the perception of value:
What do computers have to do with this?
Airline pricing: horrendously complicated, to try to maximize revenue for each seat.
Online stores certainly could
present different pricing models to different consumers. Does this
happen? I have never seen any evidence of it. Perhaps it takes the form
of discounts for favorite customers, but that's a limited form of price
discrimination.
Dell: different prices to business versus education This is the same thing, though the education discount is not nearly as steep now.
Academic journal subscriptions and price discrimination: Libraries pay as much as 10 times for some journals as individuals!
two roundtrip tickets including weekends can be less than one
(this example is ~ 2005; all flights are round-trips)
| origin |
destination |
outbound |
return |
cost |
| Minneapolis |
Newark |
Wed |
Fri |
$772.50 |
| Minneapolis |
Newark |
Wed |
next week |
$226.50 |
| Newark |
Minneapolis |
Fri |
next week |
$246.50 |
If you buy the second and third tickets and throw out the returns, you save almost $300! Airlines have actually claimed that if you don't fly your return leg, they can charge you extra.
The issue isn't online shopping so much as store shopping, under the name"versioning": selling slightly different versions to different market segments, some at premium prices.
What about grocery stores?
CASPIAN: http://nocards.org
They're against grocery discount cards, also known as club cards or surveillance cards. A big part of Caspian's argument appears to be that the cards don't really save you money.
customer-specific pricing: http://nocards.org/overview
Latest strategy: scan your card at a kiosk to get special discounts.
nocards.org/news/index.shtml#seg3
Jewel "avenu" program is exactly this: http://www.jewelosco.com/eCommerceWeb/AvenuAction.do?action=dispLoginPage
One clear goal within the industry is to offer the deepest discounts to those who are less likely to try the product anyway. In many cases, this means offering discounts to shoppers who are known to be PRICE SENSITIVE.
Clearly, the cards let stores know who is brand-sensitive and who is price-sensitive.
Loyal Skippy peanutbutter customers would be unlikely to get Skippy discounts, unless as part of a rewards strategy. They might qualify for Jif discounts.
Classic price discrimination means charging MORE to your regular customers, to whom your product is WORTH more, and giving the coupons to those who are more price-sensitive.
"shopper surveillance cards": 1. Allow price discrimination: giving coupons etc to the price-sensitive only. There may be other ways to use this; cf Avenu at Jewel
The idea used to be that you, the consumer, could shop around, compare goods and prices, and make a smart choice. But now the reverse is also true: The vendor looks at its consumer base, gathers information, and decides whether you are worth pleasing, or whether it can profit from your loyalty and habits. -- Joseph Turow, Univ of Pennsylvania
2. segmentation (nocards.com/overview) What about arranging the store to cater to the products purchased by the top 30% of customers (in terms of profitability)? Caspian case: candy aisle was reduced, although it's a good seller, because top 30% preferred baby products.
Using a card anonymously doesn't help here, as long as you keep using the same card!
Using checkout data alone isn't enough, if "the groceries" are bought once a week but high-margin items are bought on smaller trips.