Pigeonholed

Privacy policies threaten advances in technology

By Jim Hodges • Summer 2012

I magine a three-legged stool. Geospatial technology and the business cases that support and benefit from it represent the first two legs. But the stool's third leg—spatial law and privacy policy—is short, and so the stool wobbles.

It probably always will. Technology is progressive; the law is conservative and generally reactive—and sometimes tedious. However, unless the geospatial industry becomes more involved in issues such as privacy, it probably won't like the steps policymakers, judges, and regulators take to balance the stool.

In March,the Federal Trade Commission (FTC) released its privacy report that advised Congress to "consider enacting baseline privacy legislation" and described industry's "privacy by design" attempts as falling short. The report was released almost 16 months after it was drafted and submitted for public comment.

The average life of a computer technology generation ranges from 16 to 24 months.

"I think there's a danger, a risk that the technology won't be fully utilized if the legal and policy framework doesn't catch up," said Kevin Pomfret, director of the Centre for Spatial Law and Policy, an organization that advocates for the geospatial community.

Perhaps then one could make the analogy that geospatial technology without guiding law and policy is similar to driving a car without a map, navigation, street signs, or any sense of direction.

WHO'S IN CHARGE?

For now, regulatory guidance is the province of the White House, primarily through the FTC and Commerce Department, as well as Congress and the courts. It may prove futile for the FTC to recommend that Congress "consider enacting baseline privacy legislation" during an election year, one in which the economy has top billing.

The courts have already weighed in with rulings that may set precedents that are detrimental to the industry. In the January 2012 decision for U.S. v. Jones, Washington, D.C., nightclub owner Antoine Jones was set free after he had been sentenced to life in prison for drug trafficking. The case was built on seizing 97 kilograms of cocaine and $850,000 in cash after the FBI placed a GPS-enabled tracking device on his car for 28 days.

The court ruled that the FBI should have obtained a warrant for the device, prompting the FBI to turn off 3,000 tracking devices attached to other suspects' property.

But the decision was of little assistance to a multifaceted geospatial industry that seeks answers to help further innovation. Even the justices' written opinions in the Jones case acknowledged the shortcomings of the ruling.

"I think that ruling says that there is a lot more to come," said Joanne Gabrynowicz, who is the director of the National Center for Remote Sensing, Air and Space Law at the University of Mississippi School of Law. "That case said that a person has an expectation of privacy in his or her public movement."

The narrow ruling did not address other tracking means, such as using a cellphone's global positioning system technology. Stay tuned, Gabrynowicz predicted; that case will likely be coming soon.

While court decisions are usually narrow, FTC guidelines indicate an attempt at broader regulation. This may appeal to industry, but there's difficulty in assessing geospatial data that can be used for commercial means.

"It's defining the problem and asking the right questions," Harlan Onsrud, a professor with the Department of Spatial Information Science and Engineering at the University of Maine, told one of his classes.

The industry could help, but it would have to go beyond the scope of most business cases, perhaps to include an education element.

"It's a dynamic landscape," Gabrynowicz said. "People are becoming aware. I think we've come through a period of time in which people have been oblivious to how much they can be followed or tracked. They are less naïve, and if you are a company, I think you should understand that the citizenry is becoming more well-informed, and you need to be more aware than you were five or six years ago."

unspoken benefits

Determining where a particular person is at any time is the most controversial aspect of geospatial capabilities, given the attention it draws from advocacy groups. Is "Big Brother" watching, or could location be used to protect and serve? The true question is whether privacy protection is more important than being able to locate someone in the case of an emergency.

Supreme Court Justice Samuel A. Alito Jr. wrote in U.S. v. Jones: "New technology may provide increased convenience or security at the expense of privacy, and many people may find the tradeoff worthwhile."

But the privacy issue had already flared less than a year before U.S. v. Jones, when British researchers found an unencrypted file in the mobile operating systems of the Apple iPhone and iPad, which kept location data entries for nearly a year. After media reports went worldwide and a lawsuit was filed, Apple acknowledged a "bug" but said it was used to find cell tower and Wi-Fi network locations and not to track users. The company then vowed to fix the "bug."

There were no arguments heard for using location as a benefit, save for the claim that it helped in making phone calls.

Social Security information, medical records, and even religious affiliation are relatively easy to define when it comes to privacy. But location parameters can be as narrow or as broad as desired, and even more importantly, temporal information can be here and now—or span the course of several months.

Gabrynowicz offered an example.

"A person went to a psychiatrist's office, then picked up his kid at school, and then he went to a liquor store," she said. "Any one of those things by itself doesn't tell you a whole lot about him, but put together, it can say, 'This is a guy who has a kid, who drinks, and goes to a shrink, and has a problem.' You can put that together and infer things that are very hard to do with just a single data point."

The military is connecting such data points through the Army's Human Terrain System, a relatively new sociocultural program that adapts to technological evolution to gather information on people in war zones. The concept is a similar to human geography and predictive analytics: If you know someone went here and here, then you might infer where they are likely to go next. While this strategy fares well for military applications, it still makes civilians skeptical.

Another topic for debate is how location information is gathered, whether by mobile devices, security cameras, satellite imagery, or aerial imagery.

"I think there's a bunch of different risks that are being pigeonholed into one or two legal constructs without a lot of thoughtful discussion about what privacy or risk really are," Pomfret said. "That's because it's all so new."

LARGELY UNPRECEDENTED

"All," in this case, means the coupling of technology and law. Though satellite imagery dates back to the Cold War—Pomfret was an imagery analyst with the CIA before turning to the law—precedents covering its commercial use are minimal.

What case law does exist tends to be outdated, and adapting it to new technology requires both an understanding of that technology and how it relates to elements of the legal precedent. Some experts suggest that while the geospatial community has become more proactive, it should do more, and not leave law and policy creation solely to the advocacy groups. The industry should seek to drive the discussion when it can, rather than merely answer questions in courts, congressional hearings, and governmental regulatory discussions.

That proactivity could be made along the lines of "this is what a location-enabled society could look for," Pomfret said. "You could always know where you are, always know where your loved ones are. If someone needs to get to you in an emergency, someone could find you. There's power in location."

From such education, favorable policies can be developed through the understanding that the technology can be harnessed for the public good.