The expanding reach of surveillance.

Dave Bittner: Hello, everyone, and welcome to "Caveat" N2K CyberWire's privacy, surveillance, law, and policy podcast. I'm Dave Bittner, and joining me is my co-host, Ben Yelin from the University of Maryland Center for Cyber, Health, and Hazard Strategies. Hey there, Ben.

 

Ben Yelin: Hello, Dave.

 

Dave Bittner: On today's show, Ben has the story of the Supreme Court agreeing to take up a high-profile case on geofence warrants. I look at the global question of digital sovereignty. And later in the show, Brian McGinnis, partner at Barnes & Thornburg LLP, discusses youth protection and data privacy and the Federal Trade Commission. While this show covers legal topics and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney. [ Music ] All right, Ben, let's jump right in. We got big news from the Supreme Court. What's going on here, my friend?

 

Ben Yelin: It's happening. So it's been really eight years since the Supreme Court has taken on a high-profile Fourth Amendment case, and that is about to change because, last week, they granted certiorari, which is a fancy way of saying they agreed to hear a case on geofence warrants. We've actually been discussing this case over the years as it's -- as it's made its way through the lower federal courts. So it is called Chatrie v. United States. It was about an individual who was arrested and prosecuted based on evidence gleaned through the use of these geofence warrants. So a bank, or I guess it was a credit union, if we're going to be precise, was robbed in Virginia.

 

Dave Bittner: Right.

 

Ben Yelin: And law enforcement basically didn't have any leads on it, so they went to Google, who, at the time, kept the relevant data to do these geofence warrants. So it's basically, what are all of the devices that use Google applications that were in this particular area at this particular time? And then you got a smaller universe. So here are all the devices, and then you do more investigative work. You can figure out who the person is. So Chatrie is convicted. He appeals up to the Fourth Circuit Court of Appeals, which upholds the conviction and said that this does not count as a Fourth Amendment search. This contrasts with a Fifth Circuit case, which is a case called Smith v. the United States, and they came to the opposite conclusion in that case, that a geofence warrant is incompatible with the Fourth Amendment because there is no way to structure a warrant that meets the Fourth Amendment's particularity requirement. So the particularity requirement means that you have to describe the persons to be searched or the things to be seized. And almost by definition, with a geofence warrant, you don't have a suspect, and you're not really describing necessarily a place to be searched, although I think that's really the open question about this case.

 

Dave Bittner: Right. How small an area can you put the fence around might be a player.

 

Ben Yelin: Right, so, you know, on the one hand, you have what our founding fathers found extremely offensive and kind of the impetus behind our Fourth Amendment drafting is the so-called general warrants, where it's go into this house and see whatever, you know, see what you can find, and we're going to arrest this person.

 

Dave Bittner: Right, we're going to look around.

 

Ben Yelin: Yeah.

 

Dave Bittner: Go through your drawers to see.

 

Ben Yelin: So this certainly, in some ways, feels a lot like that, but in other areas of the law, we allow law enforcement to look through extremely large databases, even without having identified a suspect and use whatever data we glean, at least to start a criminal investigation. And so that's basically what the Fourth Circuit was arguing. And I think a lot of legal scholars, is if you are searching X number of communications, if you're trying to find that needle in the haystack, you necessarily have to search the whole haystack. So as -- is that type of search any more broad or fundamentally different than what we're doing with a geofence warrant, where we're starting with a large universe, and for investigatory purposes, we're trying to narrow that down to a small subset, which is people who are in a particular area at a particular time?

 

Dave Bittner: Yeah.

 

Ben Yelin: So this is exciting for us Fourth Amendment nerds. It has certainly been a minute. And my guess since I know you're going to ask this question, I'm preempting you.

 

Dave Bittner: Yes, okay.

 

Ben Yelin: My guess is that we'll have oral arguments by end of March, early April.

 

Dave Bittner: Oh, that quick.

 

Ben Yelin: Yeah, and then a decision by the end of June.

 

Dave Bittner: Wow.

 

Ben Yelin: So we got action, Dave.

 

Dave Bittner: So is it because that the Fourth and Fifth Circuits disagree on this that the -- that spikes the Supreme Court's interest?

 

Ben Yelin: Definitely. So when you have a clear circuit split like this, those are the types of cases that are high-profile enough that the Supreme Court will want to take them on. That's really how they see their role most clearly. Sure, there are going to be some cases where there might be consensus within the circuits, but the Supreme Court says all of you are wrong. That happens, especially if circuits are trying to interpret previous Supreme Court precedent and the makeup of the court changes, and the court says that's not precedent anymore. So obviously your most famous example is the Dobbs case overturning Roe v. Wade.

 

Dave Bittner: Right.

 

Ben Yelin: But really, what they try and do in most circumstances is identify these areas where there's an inconsistency between circuits. It's not great to have a legal system in this country where in an arbitrary group of states, depending on their geography and depending on the makeup of their circuit courts, there is one rule for conducting geofence warrants, and in other states that are randomly in a different place, just because they have a different set of judges, there are completely different rules. Having that level of uniformity so that people know what to expect, that there's kind of a clear statement of the law, those are the kind of disputes the Supreme Court really does try to solve.

 

Dave Bittner: Any tea-leaf reading here, knowing the players on the -- in this -- on the Supreme Court, what do you suppose their -- where might their interests lie in this, in terms of coming up with a final decision?

 

Ben Yelin: So it doesn't really fall neatly along ideological lines, frequently, when we talk about Fourth Amendment cases. Carpenter kind of did. It was Roberts joining with the four liberal justices at the time. But interestingly, in that case, Justice Gorsuch wrote what was a dissenting opinion, but was, in many effects, saying like I can't really get there on this case to say that we need a warrant for historical cell site location information. But the Fourth Amendment in the age of modern technology needs to be changed and reformed, and we have to have some better lens of understanding it than the one that we do now. So I'm very curious about the questions that he asks in oral arguments. He's a guy who believes pretty strongly in civil liberties. He's a very conservative justice, but on like a few issues, he can go kind of rogue, and I think this is one of them. He cited in a two-person dissent with Justice Sonia Sotomayor on a case that we discussed on the state secrets provision. So we had that dissent by the two of them. I could see kind of a cross-ideological makeup of both a majority and a dissent here. If you look at the makeup of the Fourth Circuit and the Fifth Circuit, the Fifth Circuit is far more of a conservative circuit, and they're the ones who ruled that these geofence warrants were unconstitutional. There are some political considerations here. One of them is that the most famous geofence warrant ever was the one done by federal law enforcement to apprehend January 6 suspects.

 

Dave Bittner: Oh

 

Ben Yelin: Now, we could have seen appellate cases resulting from those searches because a lot of those people were convicted and went to jail, but they've all been pardoned now.

 

Dave Bittner: Right.

 

Ben Yelin: So that question is moot, but that is the most high-profile example of the federal government using geofence warrants, and there were concerns about it. I mean, especially when you have a crime that depends so succinctly on whether a person was in the Capitol, like whether they actually breached the doors or whether they weren't, you know, geofence warrants, at least at the time, and probably still now, weren't exacting enough to separate people who were just there peacefully protesting versus people who were actually in the Capitol.

 

Dave Bittner: Right.

 

Ben Yelin: The technology keeps getting better and better, but it certainly presents causes for concern. I think one of those January 6 cases would have made a compelling case to the Supreme Court, but that is moot now. So I think the fact that geofence warrants are associated with that investigation, that investigation being one that conservatives think was completely overzealous and rife with abuse from the Biden Justice Department, I think that's going to be a factor in the consideration of this case of the Supreme Court.

 

Dave Bittner: Now, you mentioned that it's been a long time since there's been a Fourth Amendment case before the Supreme Court. Would it be expected that the court would use this as an opportunity to address, as you were saying, the need to update things when it comes to the digital world in which we live? In other words, is this an opportunity for them, in their ruling, to express broader opinions than those that are specific to this case?

 

Ben Yelin: Yeah, it all --

 

Dave Bittner: That make any sense?

 

Ben Yelin: Yep, there is always that chance. I mean, to an extent, we saw that in Carpenter, and we saw that to a degree in Riley v. California, where the court says you need a warrant to search a cell phone, incident to arrest, with the justification being that was 2014. Like cell phones are basically part of our anatomy now, and it contains such a wealth of information that we need to have this new understanding of how those work. I think it's going to be a little harder to get to that kind of broad we're changing our entire jurisprudence type of thing in a case about geofence warrants because I think this is a unique circumstance. It's a unique type of -- the warrant itself is what's unique here, not necessarily the technology, if that makes sense. It's the fact that you don't have any individualized suspicion, but that you are leveraging the fact that private companies, at least for a time, had records of which devices were and which locations at which time.

 

Dave Bittner: Yeah.

 

Ben Yelin: So I think this case is more about the structure of these particular warrants than it is about a broad critique of the use of the Fourth Amendment in the digital age and kind of our outdated Fourth Amendment frameworks. But I would not be surprised at all, especially like in a concurrence, if one of the justices chooses to opine on that question. Justice Sotomayor did in the 2012 case, United States v. Jones, where she talked about how we needed to reconsider the third-party doctrine that information we voluntarily give to telecommunications companies does not merit Fourth Amendment protection. And she used that case, which didn't really have to do with third-party records that much, to just be like this is my time. I'm going to opine about the third-party doctrine. I think we could see something like that here as well.

 

Dave Bittner: Okay, all right. Well, get your popcorn ready.

 

Ben Yelin: Yeah, I mean, some of us will be -- will be sitting there for oral arguments, glued to our --

 

Dave Bittner: Yeah.

 

Ben Yelin: -- C-SPAN images where because it's not videotaped. You hear the audio, and they show you the face of the person that's talking.

 

Dave Bittner: Right, right.

 

Ben Yelin: So I'm looking forward to that. I mean, the one other interesting element here that I hadn't mentioned is that Google changed its policies in 2023.

 

Dave Bittner: Yeah.

 

Ben Yelin: And they do not collect the type of data they used to that allowed prosecutors, governments to obtain geofence warrants. The reason this is still a live case is even though Google has a pretty big market share in terms of location data, there are a lot of other companies that still collect that data, and prosecutors might seek data from different companies that are not Google in the future. So this is still going to be a live case, even though Google has changed its policy. But that could be a factor in the case as well, that there might be an element of remanding the case down to the lower courts and say, please reconsider your previous decisions in light of the fact that Google has changed its practices. I don't see that as a super likely outcome, but it's something that I could definitely see happening.

 

Dave Bittner: What about the sort of warrantless end-around that we've seen, you know, claims that law enforcement are using, basically just going right to a data broker, not, you know, not having a warrant, but just buying something that is freely for sale out there, which is, in some cases, our location data.

 

Ben Yelin: Yep, that's a whole other question.

 

Dave Bittner: Yeah. Okay.

 

Ben Yelin: And there's not much that a criminal defendant can do about that at this point.

 

Dave Bittner: Okay.

 

Ben Yelin: And I think we're going to have to have statutes from Congress that protect people's personal information from data brokers in order for that to merit any type of Fourth Amendment protection.

 

Dave Bittner: I see.

 

Ben Yelin: Because the understanding as of now is that the Fourth Amendment applies against government action.

 

Dave Bittner: Ah.

 

Ben Yelin: So if the government is going to the private sector, and there's like a voluntary transaction where they're purchasing this data, I think that's a very different question --

 

Dave Bittner: Yeah.

 

Ben Yelin: -- than most traditional Fourth Amendment cases, where they're obtaining a subpoena to obtain third-party records from a company, or they're getting a warrant to do so.

 

Dave Bittner: All right, interesting times. Interesting times.

 

Ben Yelin: Indeed. I'm excited.

 

Dave Bittner: Good for you.

 

Ben Yelin: That makes one of us.

 

Dave Bittner: I look well, no, no. I mean, you know, I can nerd out on this stuff to a lesser degree than you. So what I look forward to is your summary and explanation.

 

Ben Yelin: Yeah. I mean, I feel like we got a long way to go.

 

Dave Bittner: Yeah.

 

Ben Yelin: And, you know, we're gonna have oral arguments to cover and the actual decision.

 

Dave Bittner: Right, yeah.

 

Ben Yelin: So we got -- we got some content ahead of us --

 

Dave Bittner: Yeah, all right, very good, very good.

 

Ben Yelin: -- coming from this case.

 

Dave Bittner: Well, I'm happy for you, Ben.

 

Ben Yelin: Yes.

 

Dave Bittner: All right, let's jump in and talk about my story this week. So I'm using this particular story kind of as a framework for what I hope is an interesting discussion. This is actually -- I guess you'd call it an editorial piece. This is out of the Canadian Center for Policy Alternatives, which is a progressive think tank out of Canada. This is an article written by Paris Marx, and its provocative title caught my eye. It's titled: Every Data Center is a US Military Base, right?

 

Ben Yelin: Yeah, my ears perked up a little bit.

 

Dave Bittner: Yeah, yeah. And it's, I think, capturing the moment that we find ourselves, right now, where a lot of nations around the world, including our traditional allies, are finding themselves wondering to what degree is the United States of America a good-faith partner anymore? And when it comes to this notion of digital sovereignty, it's a big deal because --

 

Ben Yelin: I'm confused, Dave. Aren't they our 51st state, so?

 

Dave Bittner: Who, Canada?

 

Ben Yelin: Yep.

 

Dave Bittner: Oh my goodness.

 

Ben Yelin: I digress [inaudible 00:16:10] terrible times.

 

Dave Bittner: Yeah. But that's so -- the point here is that the US, for so long, has had leadership when it comes to technology. The big-tech companies are US companies, right, going back to IBM, Hewlett-Packard, Apple, now Facebook, Microsoft, all -- and so they have a huge amount of influence all over the world. And so both nation states and individuals worldwide have a lot of their data, and a lot of their day-to-day operations are wrapped up in US companies. And so the question is, is that a good thing long-term, and should these countries be looking to have their data local?

 

Ben Yelin: I mean, this is a very live question. They have a really interesting hook in this article about what happened when the US issued sanctions against the International Criminal Court. So those sanctions were because of the ICC's finding on Israel and its Prime Minister Benjamin Netanyahu.

 

Dave Bittner: Right.

 

Ben Yelin: But people who work for the International Criminal Court lost access to everyday digital services, and that included one of the prosecutors who works for ICC not being able to access his email because it was hosted by a US cloud service.

 

Dave Bittner: Yeah.

 

Ben Yelin: So they can't perform their jobs because they've been sanctioned by the US government. Lest you think this is a one-off, I think the context is very important here. We're having a more adversarial relationship, not just with Canada, which is the source of the story here, but with much of Europe. Europe depends on our cloud-based services and email platforms. They depend on us economically. They've have depended on us for -- on national security matters and cybersecurity matters, and we've had a very cooperative relationship. But a lot of that has been thrown into flux. A lot of things have happened over the past year, not just the fact that like we might invade Greenland --

 

Dave Bittner: Right.

 

Ben Yelin: -- and blow up the NATO Charter, which would be very bad, and that would probably permanently sour our diplomatic relationship with most NATO countries. But even if that doesn't happen, I mean, there have been other things that we've done, like pulling out of the Five Eyes Intelligence Agreement, these sanctions against the International Criminal Court. All of our bizarre hostility against Canada and Europe when it comes to tariffs and continuing threats of tariffs if these countries don't take particular actions. In Canada's case, referring to it as our 51st state and being kind of adversarial. So I think this is a really important question for these other countries, Canada and countries in Europe is, should they reconsider their relationship with the US and these companies, or should they turn toward having more digital sovereignty? And I think this is a live debate that's just going to go stronger as we move through Trump 2.0.

 

Dave Bittner: Yeah. They talk about concerns over the US having a kill switch over their technical infrastructure. You know, basically the President of the United States could -- just could change his mind on something or get a bee in his bonnet about something and insist that US tech companies no longer do business with former ally guys --

 

Ben Yelin: Right, right.

 

Dave Bittner: -- dare to call them former allies, traditional allies --

 

Ben Yelin: Yeah.

 

Dave Bittner: -- with whom we are having a spat with, you know, long-term, short-term, whatever, and now they can't do business. And now is potential huge economic concerns. And just imagine any nation if they were suddenly to be cut off from Microsoft and --

 

Ben Yelin: Yeah.

 

Dave Bittner: -- Amazon Web Services and down to the operating systems.

 

Ben Yelin: Denmark doesn't know we've invaded Greenland because their Chrome doesn't work because we activated the Google kill switch.

 

Dave Bittner: Right. Which sounds funny until --

 

Ben Yelin: It's not, yeah.

 

Dave Bittner: Right, right. I mean, and it is -- it's funny because it's so absurd that we find ourselves in this -- that we have to talk about this at all.

 

Ben Yelin: Yeah, I mean, you'd never think that we'd end up here because it's a relationship that's beneficial for us as the country full of innovators who started all these big companies. And you know, we've been able to sell our services and products and countries all over the world, and that's made us richer, and these countries have been able to purchase these products, or they're able to have these awesome services. Like it's a cool symbiotic relationship. And if you would ask me, you know, even during the first Trump term, if I could foresee something like this happening, where our relationship with European allies and Canada would become increasingly hostile, like it's just not something that was under consideration.

 

Dave Bittner: Right.

 

Ben Yelin: And I think it is a wake-up call. I think we've talked more about this in the context of national security and NATO, where these countries have been relying on our defense capabilities for all of these years, and now that they have to consider the fact that they might not be able to rely on them in the future, like they have to reconsider everything. So we've seen Germany, for example, spending far more money on defense than they ever have because of this kind of implicit threat. And I think the same thing applies here. Like for the first time, these companies have to think of their digital sovereignty --

 

Dave Bittner: Yeah.

 

Ben Yelin: -- and in a way that they just were not expecting.

 

Dave Bittner: Yeah. And you wonder, you know, could we see European countries regulating and saying that we cannot rely on US infrastructure or products for critical functions, right?

 

Ben Yelin: They could say that, and that would be a big hit. I mean, Canada is a smaller-ish market, but if you see that replicated in other countries around the world, you know, it would be a big hit to US companies. You know, our hostile relationship with Canada, what was the news story item this week about it? They have a new deal with China on -- was it chips?

 

Dave Bittner: No, cars, electric cars.

 

Ben Yelin: Electric cars, yeah.

 

Dave Bittner: Which is huge. Yeah, because China is so far ahead of the rest of the world when it comes to affordable, high-quality electric cars, and currently you can't sell them in North America because both Canada and the US have 100% tariff on them. Canada has struck a deal with China that took to remove that 100% tariff, which means China is going to hit the Canadian market, and the US currently doesn't have anything to compete with them, and they're good cars.

 

Ben Yelin: Yeah.

 

Dave Bittner: Right?

 

Ben Yelin: Much better than our electric cars. And we've removed a lot of incentives for both the manufacturing and the purchase of electric vehicles in our country.

 

Dave Bittner: Right.

 

Ben Yelin: So yeah, I mean, that seems pretty bad.

 

Dave Bittner: It does.

 

Ben Yelin: So I think it is -- like even though this was about electric cars, I think there's a broader lesson here that if they can't rely on the US, do they turn toward our geopolitical adversaries? And that seems like something that we would not want, but from the perspective of these countries, do they have any other choice? Yeah, I mean, who else can offer the same type of services that they've come to rely on from these US companies.

 

Dave Bittner: Right, which I think also speaks to the broader issue of like to what degree do you shift to other nations around the world? As you say, shift from the US to China for supplying some things like electric cars -- pretty fundamental product -- versus working on spinning up your own local version of that. In other words, you know, Canada saying, well, we need to -- we can't rely on anybody. The lesson we've learned from this is that we have to be self-reliant.

 

Ben Yelin: Right.

 

Dave Bittner: And when it comes to digital things. So we need to spin up our own companies or support our own companies or, you know, whatever, but we got to -- we have to be prepared for the real possibility to go it alone.

 

Ben Yelin: Yeah, and maybe that's a better silver lining, if that's the ultimate result, like companies try and become -- or countries try and become more self-reliant. But my fear is like Canada just doesn't have the capability to spin up cloud-based computing services that don't rely on US companies in a short period of time. And so the alternative is going to be that they're going to buy products from China and other adversarial countries.

 

Dave Bittner: Right.

 

Ben Yelin: So, you know, and that, to me, is not a good result for us, the United States. Like it's just -- it seems like an own goal, in my opinion.

 

Dave Bittner: Right, right, yeah.

 

Ben Yelin: But again, I know a lot of people feel differently, and I think there's a widespread view that these countries have taken advantage of us. Certainly, that's what President Trump has said in a bunch of different contexts. But yeah, I mean, I think we're going to start to see the consequences of that.

 

Dave Bittner: Yeah, to what degree do you think it matters, like the actual geographic proximity of Canada being our neighbor to the north, versus Europe with an ocean between us?

 

Ben Yelin: You know, it matters less than it used to just because, you know, we can -- we can fly planes to Europe pretty quickly. We can communicate electronically with Europe. I think it's more that Canada has been our most stalwart ally. I mean, there used to be a presidential tradition, going up until Trump's first term, that a president's first diplomatic visit would always be to Canada.

 

Dave Bittner: Oh, is that right? I didn't know that.

 

Ben Yelin: Yeah, I mean, we've cooperated with them on everything, going back decades. On 9/11 when international flights had to be diverted, these small towns in Canada took in planes full of US persons and took care of them before the embargo on flights ended. So, you know, I think we do have a special, unique relationship with them, whether it's because of proximity -- you know, I think historically, it probably is because of that proximity -- but yeah, I mean, it's certainly something that's being put in jeopardy now.

 

Dave Bittner: Yeah. All right, well, we will have a link to that story in the show notes, and of course, we would love to hear from you. If there's something you'd like us to consider for the show, please email us. It's caveat@n2k.com. [ Music ] All right, Ben, our guest this week is Brian McGinnis, a partner at Barnes & Thornburg LLP, and the conversation centers on youth protection and data privacy and the Federal Trade Commission. [ Music ]

 

Brian McGinnis: AI, I would say, has been a pretty fundamental change for any kind of collection and use of data, and certainly has moved the needle for, you know, legal considerations. And within that, you've got AI laws, privacy laws, children's protection law, general personal information laws, consumer laws, etc., that we can dig into further. But the advent of AI is, in particular, I think, going to have a huge and already has started to have a huge impact on children and the collection of data. I mean, so in the US, as you know, we've generally lag behind the rest of the world when it comes to laws regarding the collection and use and sharing of people's information. We've started to catch up here in the last, you know, 10 years or so or less, and continue to do so with a whole host of new laws that are aimed at giving people more notice, providing further transparency about the collection and use of their data. But children's data and other sensitive data types like, you know, healthcare under HIPAA and financial regulations around financial data, etc., have been considered historically more sensitive information. They get a higher level of protection. So COPPA, for a while, we've been under that law protecting children's information, but that thing is getting as gray as I am these days. It's about 27 years old, I think, and so you're dealing with a law that was passed, honestly, in a different age, in a different era, trying to account for and keep up with technology as it continues to evolve, and, you know, presumably still protect children. Now, you know, obviously that's the primary goal of this law, but it's a little bit outdated, and certainly was passed in a time where we didn't have as many technological considerations as we have now. So you've got AI coming along, and that, I think, is further accelerating the changes, further accelerating the difficulties in trying to continue to apply this old law to these new technologies. And it's become pretty clear that we need a new path. We need some new laws. So you've got updates to that law. You've got state laws coming in that are trying to protect that, but one of the big things it's doing is really moving away from a world where we are relying entirely on sort of people saying what they're going to collect, and getting consent to collect these things, and moving much more towards an era where, in the background, the technology is able to do a lot more things that it just wasn't capable of doing previously, right? So you're talking about inferences from activity that users are doing, whether it's a, you know, an online game or software or something like that. You can now infer a lot of things about the user that you simply couldn't before that result in, ultimately, the collection of additional data about children that we just never had to worry about before. So really, a fundamental shift and a whole new world that we're entering.

 

Ben Yelin: So just to hone in on COPPA a little bit, the issue is it's built as a structure where people report the data that they are collecting, and now we're in an era where AI is collecting the data, and there's really nothing for actual human beings or organizations to report. Is that kind of the general issue with COPPA?

 

Brian McGinnis: Yeah, I think the laws are trying to shine a light on and challenge the idea that there is nothing to report. The idea is there are things that are being collected that are using in ways that people probably don't understand. And the old model of basically disclose, you know, here's the sort of the primary pieces of data that we're going to collect about an individual -- a name, an email address, a birth date, an address -- to mail them something, and getting parental consent to do that to a world where you've got all these technologies operating in the background to collect information that can be used to identify that this person, this user, is a child, or particular characteristics about that individual in ways that, certainly, you know, parents and most of the children using these platforms don't really understand. So you've really moved away from that direct sort of one-to-one I get what you're collecting, to a world where we've got technology collecting all sorts of things being used in ways that we probably don't really understand fully yet where that value is, and that'll continue only to spin out, unless we've got some laws that provide some additional protections to require more disclosure of that and put more of an onus on the companies or individuals that are collecting that data to do more to assess what kind of data they are truly collecting beyond the sort of Xs and Os of things that you would put into a form box or something like that.

 

Ben Yelin: Before we get into what the private sector can do, obviously, we've been waiting decades for a federal data privacy law. I think I'll go fully gray and even bolder by the time that happens.

 

Brian McGinnis: It's coming soon. I've been assured of that for, you know, 10 plus years at this point.

 

Ben Yelin: Absolutely. Can you talk a little bit about what states have done in this space and if any states have taken the lead on protecting this type of data? And then if that can work in a world in which companies have to comply with this kind of patchwork of state laws?

 

Brian McGinnis: Yeah, I think it can. So you know, what it does is essentially create a vacuum in the absence of a federal law, privacy law, you know, AI laws now, children's protection laws, that are outdated, that states want to fill, right? And when you're talking about more sensitive data points like children's data, I don't think it's hard to find much support to say, yeah, we probably should be doing a better job of protecting our children against, you know, misuses of their information. At the same time, you've got, again, this increase in technology. You know, when we were growing up, the technological landscape looked a little bit different than it does now, the number of apps that are out there, the number of services. Now you've got, you know, teens spending some pretty serious time talking with like chat bots, for example, disclosing some pretty sensitive information about themselves that they wouldn't want disclosed otherwise in some real-world impacts coming as a result of, you know, unauthorized disclosure of those kinds of things. So the states are stepping up and saying, well, you know, if you're not going to give us a federal law, we're going to pass our own law. In principle, that's great. It gives protections, at least in that state that are at a much higher level than individuals would otherwise have. The problem is for platform developers, software developers, app developers, game developers, etc., it becomes really, really complex to be able to comply with that. So a lot of my practice is really helping companies who want to do the right thing try and figure out, okay, you know, there's this patchwork of state laws out here, in addition to federal stuff that touches on this, in addition to international considerations. How do we do the right thing here? How do we navigate through this? How do we show that we care about protecting these people? But just, you know, even if you want to, and even if you've got an unlimited budget, it can be really difficult to really navigate that successfully. So you've got a number of states, you know, New York, Maryland, California, have all passed some laws that are specifically targeted to the protection of children's information. There's a handful of other states as well doing things along the lines of, you know, AI protections and age verifications, data broker registration, things like this. And then one of the other things that we're really seeing that I think is really a best practice and a trend is bumping the age up historically in this country. Because of COPPA, we've really considered the children to really be those who are under the age of 13. What that misses, of course, is that age, or those ages between 13 and, really, 18 of a whole group of teens who are, you know, heavily on their phones, heavily user -- heavy users of technology these days, and there historically in this country hasn't been protections for them. And so that's another gap that both state and federal laws are looking to fill, which is how do we account for these age groups? And, you know, I've got kids of my own, and it's really disparate when you're talking about, you know, a 13-year-old versus a 17-year-old. They go through a lot of changes in those years, right, too. So we're seeing these laws even further break that down, you know, age 13 to 15 being treated differently than 16- and 17-year-olds, for example. Apple, Google, other app stores, are being required to revamp their age ratings so that it's has more teeth in it, in terms of making -- putting the responsibility on the app developers to really categorize their apps appropriately according to the data that they're going to collect based on age and then putting restrictions on the uses of those ages. Those kinds of things are really filling the gap here in a lack of a privacy law.

 

Ben Yelin: So let's get kind of dig down and get a little bit more granular when we get into the private sector. So start big-picture with the big tech companies. What kind of data minimization do you think they could do to help alleviate this problem a little bit, to prevent the mass collection of data and the use of artificial intelligence?

 

Brian McGinnis: Yeah, I mean, I would start with data collection is a choice almost always, and people are putting tools in place that collect the data that they collect. For the longest time we have operated under the we need to collect more. What more can we collect? If I collect this additional dataset, then I can get, you know, more information about this person. That makes me basically a more effective advertiser. Makes my dataset more valuable. I can sell it for more money, and therefore I can make more money as a company. When you're talking about sensitive data, though, when you're talking about children's data, you really need a whole other set of considerations, I would say, for that. And it's really not what can we collect, but what should we collect? And I think starting from a blank piece of paper and only collecting those data points that you have to collect in order to provide the service or the platform is really the strategy that should be employed here. Now, you know, that's a completely different set of considerations if you're, you know, building an app who's generally targeting adults or older folks, and happen to collect some information about a couple, you know, teenagers who might be interested in using your product than it is for those companies that are specifically being built for children. Obviously, they're going to collect a lot more, but then, you know, by nature of that company, they're going to, hopefully, take more steps to make sure that they're doing that in a compliant way, in a way that respects the sensitivity of that data of those individuals, but really keeping a close eye on it, understanding what data you're collecting. I can't tell you how many clients I work with who, you know, whether it's the marketing tools or the companies that they're working with or the partners or the business teams, there's so many opportunities out there. There's so many people selling into the data collection sort of world and business to choose from, to get them to pause and stop and say, okay, maybe we could get more. But in this case, we're going to choose not to collect additional information. We're going to limit the data that we collect maybe because that's sensitive information about a child, and really put in place a set of principles within our business that says we're only going to collect information about children under these circumstances. We're going to minimize the data we collect to the bare minimum to protect the individual, protect the child, and make sure that that data doesn't get into the wrong hands one day that can negatively affect them, make sure it's not being used to make decisions about them, etc. So there's a lot of protections you can put in place, but it really starts with making sure you're only collecting the minimum amount of data that you need in order to accomplish the goal.

 

Ben Yelin: Is that scalable organization to organization? Like does the advice differ for your larger clients versus smaller organizations that might not have the same type of resources? Or is that not something you've really seen so far?

 

Brian McGinnis: I mean, it can. I wouldn't say that's the biggest divider. I mean, the bigger divider is what are we trying to do here? What type of business is this? Is this an online-only company that's collecting a bunch of consumer information? Or is this, you know, a traditional manufacturer, B2B company, etc.? But the size does matter in the sense that the compliance efforts as you collect more data, get heavier, get more involved, and require more, and therefore require more cost. So if you are a small company, I don't think the answer is we don't have the money to comply with these laws. It's how do we collect the minimum amount of data necessary so we don't have to deal with compliance with a lot of these laws because we've gotten out of it through things like privacy by design and data minimization? So there's certainly strategies smaller companies, as they grow, can put into place that alleviate a lot of these legal hassles that the bigger companies get into by nature of the fact that they're serving so many more people.

 

Ben Yelin: We've seen states propose laws, and they've run into some constitutional issues around age verification. Can you talk a little bit about that and if that's something you would try to avoid? Like if we can get to a place where we're protecting data, especially youth data, without requiring the type of arduous age verification process that involves uploading your driver's license, can you just discuss that a little bit?

 

Brian McGinnis: Yeah. I mean, one of our core principles when you're thinking about things like responding to data subject requests under privacy laws, where they're reaching out to request deletion of their data or copy of what data you've collected about them under the various privacy laws is don't collect new information from an individual in order to provide that verification. So when you've got laws that are really, like you said, collecting driver's licenses, passports, those kinds of things, addition, you know, requiring additional information, like parental information. You know, we can think of a scenario where it would be to the child's disadvantage to have to tell their parent about something that they're doing online or want to do, etc. It becomes tricky, right? So those are -- those are issues, you know, I think that we need to have those conversations, but have them in a way that's keeping the ultimate goal in mind, which is how do we provide more protection for these individuals? I think the answer is really putting more responsibility onto the platforms and taking it off of the individual as much as we can. So much of the online world has been set up such that it's like, you know, if I -- the old days, anyway, if I put some kind of a notice in my, you know, two-point font privacy policy and tuck it away in a corner of my website somewhere, I can effectively collect and do whatever I want to do because I've provided notice. That puts all the responsibility onto the individual to read every single one of those privacy policies. And despite the fact that I spend a lot of time writing those, I imagine maybe not everybody reads them as much as I do, right?

 

Ben Yelin: Let's be real, yeah, yeah.

 

Brian McGinnis: Right. Yeah, exactly. Let's be real. So, you know, that -- that's kind of the old way of doing things, but putting more responsibility on the apps and the people who want to collect this data to put in place, you know, certain precautions and procedures to make it less likely that they're not collecting a bunch of data that they really don't have any need for and aren't really capable of ensuring that it gets protected and secured is important. So there's a balance in there somewhere. You know, collecting official government documents is a bit tricky. So maybe we can find some ways and design some ways around that. But then, you know, again, if that is -- if that process is controlled not by the individual but by the much smaller number of, let's say, vendors or operators or developers, and for example, you can handle verification via one app store for all of the apps that you download. Now you're only giving your driver's license to or parental consent, or whatever sensitive data point to that app store who then controls it for all the other apps. That's better than a bunch of, you know, startup apps who now all have that same information and most of whom aren't probably prepared to protect it at the same level as the bigger companies. I think that's probably the solution.

 

Ben Yelin: And then, just to kind of close things out here, how do you effectuate that culture change in organizations? I think a lot of companies are bottom-line driven, and they'll say, yeah, what you're saying is great, but I don't want to compromise functionality. And it's hard to do the type of work that you're advocating. So have you kind of changed that culture? What are your key messages?

 

Brian McGinnis: Yeah. I mean, you've really hit on something. That is a very real problem within the companies that I work with, right? Their goal is to build the brand, build the company, build up, ultimately, revenue, and a lot of these privacy restrictions can go against that. One of the things that we work a lot with companies on is, you know, we're not -- we're not going away from this. I think the restrictions or regulations are only going to continue to tighten, whether that's privacy, AI, children's data, etc. We're in the early stages, still, in this country of really regulating that data. So that's the future. That's where things are heading. If we're going to have to get there ultimately, why not start now, and why not do it in a way where we kind of get credit for the compliance that we're doing? So instead of, you know, treating privacy compliance or children's data compliance as the eating your vegetable situation, get out there; do it. Do a good job of it, and then use it as a marketing tactic or part of your marketing strategy. Obviously, you have to be good at it. You have to be authentic in that. But if you're a company that really does care about this, if you're a company that has really taken this into account and wants to protect users, especially some of the more vulnerable users, you can, you know, really carve out a market position by doing that. So I think getting the buy-in from the top of we are a company that wants to do right. We are the kind of company who does things in this way. I think it really ultimately serves to enforce the company's brand and reputation and standing and can really drive business, as opposed to just being a cost center. So getting that ultimate buy-in is just really critical, and helping drive the company in that direction, and then doing a good job of all these protection things as they come along, and then looking down into the -- down the road to see where the future is heading with the increase in laws that we're going to have here. And then, of course, that's, I guess, more of the carrot approach. The stick is another area that I see increasing, and that's on enforcement. So we're still in early days, I would say, of all of these laws coming about. There's been a bit of a period of allowing companies some time to get compliant and to account for these things within their business practices, but we are already seeing an increase in the enforcement of these laws. I think we've got a lot of the tools that we need, really, to ensure that the market is, you know, taking account of the sensitivity of people's information, giving them more choices in the use of their information. So that continuation of enforcement, the more the number of fines, the more somebody else in your industry, one of your competitors, gets hit with one of these things, the more I have conversations with clients about I don't want that to happen to us. What do we need to do now to make sure that it doesn't? So if that's the way we need to get there, that's fine, too, I think, so long as we get to the ultimate goal, which is making sure people have more control over the use of their information.

 

Ben Yelin: Well, thank you so much, Brian, for joining us, and for this --

 

Brian McGinnis: Yeah.

 

Ben Yelin: -- I think, really insightful conversation.

 

Brian McGinnis: Yeah, it was a lot of fun. Appreciate having me. Thanks, guys.

 

Dave Bittner: And again, our thanks to Brian McGuinness from Barnes & Thornburg for joining us. We do appreciate him sharing his expertise. [ Music ] And that is our show brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly-changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to caveat@n2k.com. This episode is produced by Liz Stokes. Our executive producer is Jennifer Eiben. The show is mixed by Tre Hester. Peter Kilpie is our publisher. I'm Dave Bittner.

 

Ben Yelin: And I'm Ben Yelin.

 

Dave Bittner: Thanks for listening. [ Music ]