What counts as surveillance today

00:00:00Legal Cyber Academy would like to welcome you to today's program, Behind the Lens, Ethics of Surveillance and FTC Proposed Regulation. Today's speakers are Daniel B. Garrie, founder of Law and Forensics, Neutral at Jams, and an adjunct faculty at Harvard. Wayne Matus, co-founder and Executive Vice President, General Counsel of Safeguard Privacy. Aaron Tantleff, a partner at FTC, and Cory Simpson.

00:00:28Aaron Tantleff, a partner at Foley and Lardner LLP. Cory Simpson, CEO and founder of Gray Space Strategies. The program materials can be found under the Supplements tab. Thank you for joining us, and I will now turn things over to today's moderator, Daniel Garrie, for further introductions and to start the program.

00:00:47Thank you for the introduction. Thank you to our panelists. Today's topic is rapidly changing, but surveillance and FTC, who knows where it will be after the Supreme Court's next session, but we will certainly all have a lot of fun in today's conversation.

00:01:06We have a bunch of experts with us and thought leaders in the space, so I'm going to let everybody introduce themselves, but I'm first going to read the disclaimer out. This is not legal advice, nor should it be considered legal advice. This presentation and the comments contained therein represent only the personal views of the participants as spoken. Do not reflect those of their employers or clients. This presentation is offered for educational and informational uses only.

00:01:31Listening speakers is indeed strictly prohibited. Our full contact details can indeed be found at the back of the presentation, as well as I would encourage everybody to follow along, even though we are showing the slides as well, but feel free to follow along with the slides as we go through them. With that said, please also refer to the supplemental materials, and as we finish that, we'll jump to slide three here.

00:01:55We have Corey, Wayne, and Aaron's photos. I will let them introduce themselves because I don't want to successfully slaughter their backgrounds. My relevant here is I mediate very large privacy disputes.

00:02:11I run a global legal engineering firm where we often deal with surveillance and privacy issues, more often or not relating to internal investigations and surveilling and surveillance strategies or technologies or deployment of systems.

00:02:27So, we often interact with legal counsel, and as a mediator or arbitrator, I certainly have heard my fair share of disputes in this area. With that said, I'm going to let Corey, Wayne, and Aaron introduce themselves in that order. Corey, the floor is yours.

00:02:42Daniel, thank you. It's great to be with you. Great to join these esteemed colleagues here. In terms of background, CEO of Grayspace, as well as CEO of the Institute of Critical Infrastructure Technology, a nonprofit focused on the security and resilience of critical infrastructure.

00:02:59I come to you today as an attorney with about 25 years, mostly in the law enforcement and special operations community, largely doing a lot of targeting of organized crime networks and terrorist networks. So, looking forward to the discussion today.

00:03:19Okay, I guess I'm up. Wayne Mattis, I am the general counsel of Safeguard Privacy. We are a SaaS software company that hosts software that's currently used, for example, by the Institute for the Internet Advertising Bureau, the Better Business Bureau, national programs, and others.

00:03:48I am currently one of the two drafting team leaders for the Sedona Conference and working Group 11 on online tracking, and I'm on the advisory board of the Institute for Advertising Ethics. I have been in the privacy space since the 1990s.

00:04:08All right, and I will round it out. So, I'm Aaron Tantleff. I'm a partner over at Foley & Lardner. I'm in our technology, transaction, cybersecurity, and privacy practice group. I do proactive and reactive incident response and deal with a lot of emerging technologies. And the rest of, if anything else is needed, you can find that on my bio, so I'll keep it short and simple.

00:04:33Well, now that we've covered everybody's bio and background, we'll jump right in here. The agenda was Fundamentals of Surveillance. Then we're going to look at Ethics of Surveillance, and then we're going to look at how the FTC is sort of starting to put their foot, or hand, or pinky, or whatever you want to call it, how the FTC is becoming more involved in the definition and defining what is and is not surveillance, whether it's ads or surveillance.

00:05:03Whether it's ad tech, or videos, or cars, or the vacuum, or the fridge. So, we'll look at that and some of the data security and PR issue that the FTC is currently in the midst of.

00:05:15So, that said, the Fundamentals of Surveillance. So, I guess I'm going to combine what is surveillance and electronic surveillance here, and maybe, Wayne, you can walk us through the basic level, what is surveillance, and then drive into what is electronic surveillance.

00:05:31And then maybe, Corey and then Aaron, you can follow on, on slides six and seven. Wayne?

00:05:39My phraseology would be slightly different from the slide, although I agree with the content of the slide.

00:05:47I think that the collection of personal information, it's said it's surreptitious, but it doesn't necessarily have to be stealth.

00:05:57It's just something that a consumer or an individual doesn't know that they're being watched.

00:06:02And it's the associated activities that include monitoring as well as collection.

00:06:09And it does, and it says here, absence of informed consent, not necessarily true in all of the states, and certainly not necessarily true under the GDPR, but consent is certainly an element of what surveillance is.

00:06:24It's the fact that an individual does not know the extent and has not given permission to being looked at.

00:06:31And it does carry on a lot of different activities.

00:06:35There's surveillance by corporations.

00:06:37There's surveillance by the government.

00:06:39And there is a blurring, and I'm sure, Daniel, you'll go into it, as to corporate and governmental surveillance and the sharing of information between the entities.

00:06:50I also know this slide says where information is collected is sent to receive by an American who's in the United States.

00:06:58I quibble with that because I do believe that Section 702 of the Foreign Intelligence Surveillance Act includes an American who is outside of the United States who is being surveilled.

00:07:13It does.

00:07:16And as far as reasonable expectations of privacy, I do think that that's a key concept.

00:07:22Yes, for an American citizen, it is frequently a warrant, although there are exceptions to that.

00:07:28And it's not just when an individual hasn't been informed because there's always a question of how adequate providing that information is.

00:07:37They are not knowingly aware of the fact that they are being watched to the full extent that they're being watched.

00:07:44Well, there's always the ostrich problem.

00:07:46But, Aaron and Corey, love to hear your thoughts here.

00:07:51Well, I was going to say there's also the perceived idea of surveillance, you know, when you let everybody know they're under watch, even if they're not.

00:08:02But that said, I think that's a pretty good summary.

00:08:05I mean, I think there are, you know, we start combining technologies and we start talking about what information can be collected, how it's collected.

00:08:13But it's also how it's analyzed as well.

00:08:15So there's I think we're going to talk about a little bit later anyway.

00:08:18But just the idea of using technology to do, you know, AI, et cetera, to further analyze the information and to gain additional insights.

00:08:27And so that has different types of surveillance that will.

00:08:31So, you know, and I think the traditional surveillance that people sort of think about, which is there's a camera, there's somebody watching me, whatever it may be, and sort of collecting that information.

00:08:41But then when you talk about, you know, that, you know, how you analyze it and what you can do today, you know, in creating correlations and parsing out information and taking information of different data sets, combining it to create relations and and other analytics, I think adds to what is surveillance.

00:09:03Daniel, Aaron, I really I really like that piece where the way that we have traditionally thought about surveillance is evolving because the capability to collect more and more data on individuals, companies, entities, it's evolving and it's growing.

00:09:21And as the Internet of Things evolve and grow, you know, we wear tracking devices on our arms.

00:09:26We carry them in our pockets like we can learn a lot more.

00:09:29We can surveil differently today than we could even two years ago, one year ago.

00:09:36And so I think that's an important part. I look forward to the discussion here, because as we can gain greater insights into, you know, traditional and nontraditional methods, I think that's an important point of about the data that we're getting back.

00:09:52Yeah, and it is an evolving technology stack, right?

00:09:56And what's being collected is also changing, right?

00:10:00So and what is real and it's not real, I think it becomes much more complicated as as technology is emerging and evolving.

00:10:08But there are lots of types of surveillance, right?

00:10:11There's your your vacuum.

00:10:14Literally, I had a hacking situation where someone hacked, couldn't figure out how the person got into this senior executive's home network.

00:10:22Turns out they hacked the Roomba Roomba that had a Wi-Fi signal that was broadcasting that was not secure using an old TLS level.

00:10:34And to secure the SSL security level was also very low because they hadn't upgraded the hardware and that's how they got in.

00:10:42But you have covert, which is stuff that freak people out when they go stay at hotels or Airbnbs that people worry about or the more government level, level of covert.

00:10:55Then you have asymmetric and they have participatory and the differential and that detection from a distance, which is actually become much more prevalent with drones and the police and surveillance there.

00:11:06It's actually a fascinating set of technologies that are deployed today by police departments.

00:11:12And it's not only visual, it's also audio, right?

00:11:15Gun detection and audio signals and these other things.

00:11:18So and then there's the obtrusive detection.

00:11:21I don't know.

00:11:22Maybe Aaron, Corey or Wayne, anything you want to add to that?

00:11:26I mean, we'll talk about some of these in more detail.

00:11:29Yeah, I'll add a couple of things.

00:11:33I'm not sure in terms of the audience, if they know exactly where all things fit in.

00:11:37But one of them is a basic one, which probably just because of consumer behavior and how it relates to the average individual.

00:11:45You know, there is always and there still is, you know, the whole hacking of, you know, things like baby monitors and other things that are simple devices in homes that people use.

00:11:53And we should be beyond that.

00:11:55But, I mean, it goes back to surveillance doesn't have to be complex.

00:11:59It could be, you know, it could be a very basic technology, you know, in a very bit, you know, in a sort of for a basic function to all, you know, to to some of the technologies that you've described, which are fairly sophisticated.

00:12:10But then it's also, you know, depending on the audience, if they're reading between the lines, I guess I'm not sure if that's the right way of doing it.

00:12:18But surveillance on things like looking at the social media posts and sort of understanding people's whereabouts.

00:12:25Right. And figuring out their, you know, you know, what their daily activity may look like.

00:12:32So on the social media posts where, you know, somebody posting, I mean, as simple as, you know, there are, you know, the vacation photos where they are or things they're doing in or out of the house.

00:12:41So, you know, there are I've been involved in, you know, in cyber stalking cases where, you know, sort of the information, you know, it didn't take much effort to deal with, you know, stalking, you know, somebody, you know, because the information was out there.

00:12:56Right. It was, you know, every, you know, from, you know, notifying when they were home, when they weren't, it was the technology in their home.

00:13:03You know, the the, you know, lights that, you know, the lights, you know, or the home automation systems.

00:13:10Right. They had systems that would alert them to do different things that, you know, change the the air conditioning for heat, for example, in their home or not.

00:13:18So, I mean, there's lots of things. And then you get all sophisticated things of, you know, we were talking about putting in technology or man in the middle attacks or utilizing, you know, micro cameras or, you know, you know, sniffers or, you know, or gray towers.

00:13:36I mean, there's lots of you know, it could it could vary. And I think that it's that collection of things that make it sort of from my perspective, interesting, but also, you know, make it concerning for people.

00:13:47Well, for consumer, I don't think the consumer has gotten to the point of understanding how much data they're generating and how much of it is being captured and analyzed.

00:14:02They don't recognize that the television manufacturers are watching their viewing habits.

00:14:11A recent acquisition by a major retailer of a television company was for the purpose of taking the television viewing data and the retail purchasing data and creating a consumer profile.

00:14:24And ninety nine percent of the individuals with that type of television who shop at that very large big box store have absolutely no idea that that is being aggregated and marketed.

00:14:36This this yesterday morning, I mentioned to my wife that I wanted to go to Dunkin' Donuts and get some coffee.

00:14:44And my Amazon device asked me whether or not I thought of getting a particular type of pumpkin latte at right on the screen.

00:14:54And I've never seen a Dunkin' ad on my Amazon devices before.

00:14:58And boom, there it was. I have a business partner with me today who came in to visit me from out of town.

00:15:05We have security gates and they asked for his driver's license. Do they need his driver's license?

00:15:11They don't need his driver's license. But that goes into a database.

00:15:15And then the company that's doing security in this particular neighborhood, no doubt, sells in bulk that information.

00:15:23And to take it to the next step, the next step is the U.S. government buys the parking data.

00:15:28They buy the information from the retail companies and they use that to actually track people that they have a more likely than not very legitimate interest in following.

00:15:41But nevertheless, those people don't know that that data is coming from the most innocuous sources.

00:15:48Every time you buy a new refrigerator now, you hook it up to the Internet and people know when you're home.

00:15:53Because if you're not home, your refrigerator isn't being opened and closed.

00:16:00And let's not talk about cars.

00:16:03Well, I was going to say that I had a colleague call me the other day, send me screenshots that they had bought.

00:16:10You know, let's say said TV. And they said, I can't go through the screen.

00:16:14You know, keeps asking me, you know, they wouldn't let me update the TV or use the TV unless I consented.

00:16:19And they said the only option is that if I don't consent to return the TV.

00:16:24So what do you want me to do?

00:16:28So. Yeah, I mean, there's a lot going on.

00:16:32So, Corey, what are your thoughts here? I mean, I've a we're all prisoner experiences.

00:16:38I've seen this a lot from, you know, a federal prosecutor perspective and then, you know, an international lawyer.

00:16:45And I kind of look at surveillance a little bit differently when I think of types, you know, physical, electronic, computer, social media, financial, biometric.

00:16:55And then when you kind of put the type in there, you got to then the tools, the judicial or legal approvals needed.

00:17:04And that kind of equals the types of evidence collected. That's, you know, arguably your right to privacy is from government surveillance.

00:17:13You know, it's a TBD, at least in America, your right to privacy from commercial surveillance.

00:17:18And that's a lot of what we're talking about right now on the commercial side.

00:17:22You know, after coming out of, I will just say, a law enforcement background and then getting into the commercial sector and seeing the amount of data collected on you.

00:17:33It's terror. It's terrifying, concerning.

00:17:38I don't know the right word somewhere in between there, but I'm glad that we do things like this to talk about the commercial surveillance side of things.

00:17:48Yes. I mean, go ahead. I would say the question is for you, Corey, is that, you know,

00:17:53would it be easier for the government to obtain the data from the commercial side as opposed to continuing to try to find legal legal means to collect it from from surveillance?

00:18:05I mean, I think these are the questions that we're being asked right now.

00:18:11Yeah, sorry. Sorry.

00:18:14Interesting discussion, right? Collecting versus buying. Right.

00:18:17But we'll talk about that in a few slides. Right. Because I think the Federal Trade Commission and I think, Wayne, your point is sort of people don't even understand what they're giving.

00:18:27My argument is, is that I don't think most people understand that percent of what's going on.

00:18:32So I think, you know, there's a gray line there of how much how how much education and how valuable education actually be.

00:18:42There's some more basic blocking and tackling, arguably, that needs to happen, maybe.

00:18:49But I think people eventually should be engaged and provided that information. But technology, right, there's a has both commercial and military uses.

00:18:58Right. And so authoritarian governments outside of the United States make vast use of surveillance technologies.

00:19:07And ways that are probably permissible in the United States. Right.

00:19:11So I think it's important to differentiate just because something can do something doesn't mean it should be doing something.

00:19:18And I think there are export control regimes and there's the West and their agreement. Right.

00:19:24That dual use technologies and all of these things that sort of all play into this monitoring things. Right.

00:19:30But there's still an ethical principle that underlies all of surveillance. Right.

00:19:34Which is a function of society. Right.

00:19:39There are libertarians, there are people on the other side of that, and everything in

00:19:43between.