Transcriber: Katharina Bluemlein Reviewer: Ariana Bleau Lugo
Hi everybody. My name is Brad
and I'm here to talk to you about privacy.
So just a quick caveat
my views expressed are my own not either of my employers,
so impute the crazy only to me.
So I wanna talk to you a little about how
privacy is changing and how the ways
that we think about what is private
has started to morph and where I think it's going.
And so my premise to you is we've gone
from the society of privacy laws to privacy norms
and that we can encapsulate this
with a simple phrase of "Not cool bro" or
"bro act" or whatever the proper term is
as the case may be. So, now, you gonna ask,
What do I mean when I say
"Not cool bro"? So, when I say,
"Not cool bro", I'll give you an example:
You are on Facebook and
you have a bad break-up or fight with
one of your friends. And you block
that person and so they can no longer see your wall.
Someone else who still has access to your
Facebook wall, goes in, and either
copies and pastes the entire thing,
or takes a screenshot every day
and mails it to that person.
OK, so our initial response is:
That's not cool. Not cool bro! Not cool!
We get the visceral feeling
that that's somehow privacy violation.
We get the feeling that that something
unseemly is happening but we don't know
how to quite talk about it.
And that is what I am talking about by
"Not cool bro" privacy, because the law
doesn't recognize that as a real
privacy interest.
So it first makes a little sense
to talk about what the law does recognize.
And most of our privacy comes from
the criminal context.
All privacy was literally -- you had to sneak up to
someones house and eavesdrop.
So the eaves of the house where water falls.
So you would stand outside
and you would listen.
You would climb over their fence,
shimmy across their lawn,
nozzle up to the side of the house,
maybe like you know poke a hole
on a window and then you can eavesdrop.
That's what you had to do
to violate someone's privacy.
So privacy was really about access
to information.
And we didn't need special rules
regulating access to information because
you couldn't violate someone's privacy
in the 1700's, unless you showed up
at their front gate.
Right? There was no Facebook.
The only wall that happened in 1700
was literally the wall
outside the carriage house.
So we go from that to this modern era
or pre-modern era in which we have
ways of getting information
that don't necessarily involve
the traditional structures of space.
So there is a very famous case
involving a guy
who walks into the phone booth
and he closes the door behind him and then he does some illegal activity
and the police are listening and they don't have a warrant.
And by the way in the law you need to get a warrant
before you can listen to any of this stuff.
And for those of you who've seen
CSI or Law and Order -
Big judges who give out warrants are sometimes like Oprah:
You get a warrant and You get a warrant
and everybody gets a warrant.
(Laughter)
But at least we still have that
nominal process, that the privacy
is still being protected,
right, there is a reasonableness here.
Well, this guy and his name is Kats,
so you can have all sorts of phonetics -- it's spelled with a K.
He had a reasonable expectation
of privacy here. Two types:
It was subjected: meaning
he personally believed that it was private
because he closed the booth behind him.
And then two: objective.
Society as a whole is willing to say,
You know what, yeah, if you are going
into a telephone booth and close the door that should be private.
Now, what about if we apply this to Facebook?
Right? This is the "not cool bro" version of privacy.
You just take it one more step.
In the old version of privacy,
it's all about control over
the means of accessing information.
In the new version of privacy,
it's all about control over
who can get the information that you give it to?
So in the old version of privacy, if I tell someone,
"Hey I got an F on a test."
That person can tell anyone else
and it's not really considered
a violation of privacy.
I didn't keep it private,
because I allowed someone else access.
In the new version of privacy,
when you post something to your Facebook wall,
if you prevented the rest of the world from seeing it,
is there an implied understanding to anyone else you've given access to
that they shouldn't re-share it?
Or another example: If you are on Twitter
and you've got a protected Twitter stream
that no one can see
unless they expressly follow you and you allow them.
And someone just sort of re-tweeting
all of your protected tweets.
You would say the exact same thing.
But the understanding would've been:
Wait a minute, I only let you see
my Twitter stream, because
I thought you weren't going to re-tweet it.
You violated some sort of implied understanding we had.
So, now we have our modern eavesdropper,
who is in your Facebook wall
posting again. So this is
our modern eavesdropper overhearing
in conversation. So how do we get
to a place in which the law
can come up to where we are.
Because we think of this, new norm, this new idea
you won't re-share something
I only share with you.
How do we get there?
And there is actually an interesting way
and I'll take it back a little bit to give you an example.
When Facebook started out
you had to be a member of a network
to just look at someone's profile.
And I remember having a job,
where someone in HR knew that I went to Yale
and sent me an e-mail and said:
Brad, we know you went to Yale,
could you log into Facebook and print out a copy
of this applicant's Facebook page?
We'd like to see it.
So, by the way, for those of you
who thought that didn't happen, it was happening in 2004.
So you better believe it's happening now.
That said, I recoiled in like shock and horror.
I was like that would be a violation of that person's privacy.
It would be a betrayal of trust.
But the idea was back then, what happened in the Yale network,
stayed in the Yale network.
It's kind of like Vegas. (Laughter)
And so, there was a knowledge that was like,
Hey, not cool, bro!
You knew that you only had access to this.
There was a reciprocal understanding.
You won't tell other people what goes on in the Yale network,
and I won't tell other people what goes on in the Yale network.
And so, if you think about it
there is an implied commitment
when you join any of these social networks,
that if you are not supposed
to re-share information, you won't.
And there is another area of the law
that actually has really had this transformation,
where they went from a very formal -- you have to be explicit understandings --
to just anything goes.
And that's products liability.
As crazy as this may sound
there was a time where if you bought
a can of coca-cola and it blew up in your hand as you were drinking it.
The only person you could sue
was the bodega or bodegua,
as the case may be, that you bought it from.
And over time courts sort of didn't like this.
They said, Well, there is an implied contract
between the original manufacturer and each step in the chain
of distributions until to the ultimate consumer
does not need to be in contractual privity
with the original manufacturer.
Which is the fancy way of saying:
We are going to say that there is an implied contract
that runs all the way through all these steps in the middle.
And when you finally buy that can of coke,
you get an implied contract from Coke.
Finally a court in California said, Enough, is enough.
We are done pretending, we are done making up
these implied contracts.
We are just gonna say strict liability applies
if you make a product and you put it out in the universe.
You have a reasonable understanding
that if somebody gets hurt by that product
they are going to sue you.
We can do the exact same thing with privacy.
If you join a social network,
Facebook, Twitter, Google+
and you join that network knowing that there are privacy settings
and knowing that other people are sharing information with you,
but at the same time prohibiting other people
from accessing that information.
It's a violation of whatever you wanna phrase it as.
Wouldn't that person's expressed understanding
that they would only share the information with you
if you didn't re-share it.
Now, we can get there without waiting, for example,
Facebook could put a little lock or a hash icon on every post
on every element of Facebook that's been shared with you
that would let you know whether or not it was public,
whether or not it was OK to re-share.
Twitter already does this.
You can not one click re-tweet a protected tweet.
And Craigslist has code-matching that will actually look at posts
you've previously made and if you're re-posting
similar content it will stop you.
Facebook and Twitter could do the exact same thing
if they see you trying to use copy and paste
to get around these mechanisms.
The other thing they could do is,
we could amend our terms of service,
we could make an expressed term of service
to re-share information that is not supposed to be re-shared.
Like on Google+, where you can actually click
"Disable re-sharing" and then no one else can.
So there is a sense that we can get there.
We also can maybe get there in law.
It won't necessarily happen
right away, but in a recent case
the Supreme Court is starting to go there.
In the Jones case, which dealt with GPS.
Justice Sotomayor said maybe it's time
that we start to rethink this notion
that if you share something
with one person it is no longer private.
Because our societal expectations have changed.
We've moved from law to norms.
The norms of not-cool-bro-to-re-share are how we now think about privacy.
And as a result our law is lagging behind a little bit.
And although we are not there yet with our laws,
we have inter measures we can use from code.
So the interesting thing to see is where we head
now that we are a society of norms
and when we think about privacy as norm-based.
(Applause)