Amazon announced two big new products this week: Amazon One, a palm-scanning biometric payments system, and the Ring Always Home Cam, a surveillance drone that flies around your house. This is in addition to the recent Amazon Halo announcement, a fitness wearable that judges your body fat percentage by taking very personal pictures of you.[1]
This is not a shitpost dunking on Amazon. In interviews and press releases, it sounds like the company is, at the very least, proactively thinking about privacy issues from these technologies.[2] However, well, Dieter Bohn at The Verge can say it better than I can:
Amazon is building a track record of products that make people do a double-take when they think about how it might affect their privacy.[3]
I wanted to use these product announcements to talk about one of the principles to understanding privacy I try to highlight here at Dumb Privacy Guy – how differently we treat government versus corporate surveillance.
I’ve defined the difference as this: “government” surveillance consists of government entities (or private entities acting as government agents)[4] investigating people’s private affairs, an action that usually triggers the Fourth Amendment’s “reasonable search and seizure” standard. “Corporate” surveillance is usually perpetrated by private business entities, often by providing a service that consumers explicitly or implicitly sign up for. For example, the FBI tapping your phone lines, or using a stingray to track your cellphone would be public surveillance. Google reading your Gmail[5] is an example of corporate surveillance, one that Gmail users theoretically consent to. Our legal system is set up in totally different ways to deal with these two types of surveillance. We have a robust (though sometimes flawed) legal system that is used to discussing the limits of acceptable government surveillance in private persons lives – but these challenges are done through the criminal justice system, when criminal defendants contest the constitutionality of government practices. There is no overarching privacy law in the United States governing business conduct. Corporate surveillance is governed by a melting pot of legal authorities, from the FTC, to HHS, to state attorneys general, and by a mishmash of situation specific laws. Lawmaking in this area has been described as “lawmaking by anecdote” which, you guessed it, does not make for comprehensive policy.[6]
There are different tradeoffs to each mode of surveillance. Government surveillance comes with a security promise. First, the government promises that the exchange will be valuable because it will help the government exercise its monopoly of force to keep you safe. Second, in exchange for our collective permission to intrude on people’s private lives, the government promises to commit to oversight (by submitting warrants that require agents to show probable cause, to be reviewed by a judge) and be judicious in its use of power.[7] The promise with private companies is… a little less obvious? Unlike with the government, we don’t have any collective promise with corporations. If I were to try and describe the tradeoff of corporate surveillance it would be roughly “You agreed to it by buying/using it, hopefully you get something cool out of it.” Unless Congress or the FTC has specifically limited a particular practice,[8] the concept of “privacy rights” in data is just that, a concept.
***
As part of my summer reading, I read Brad Stone’s The Everything Store, a comprehensive history of Amazon from its inception until roughly 2013. As the title suggests, a guiding principle of early Amazon was creating the “everything store” on the internet, a place where you could find anything, get it shipped to you fast, often at the expense of short-term profit. One of the company’s famous principles is obsession with the customer, the driving force behind rapid expansion of the third-party marketplace and into seemingly every corner of our online lives.[9] Or in Bezos’ words, “Even when they don’t yet know it, customers want something better, and your desire to delight customers will drive you to invent on their behalf.”[10]
Reading the press releases for the Halo, One, and Always Home Cam I wondered if “consumer obsession” no longer means providing something better for the customer. I am not alone in feeling that while Amazon has become a lifeline and the go-to retailer of the pandemic, its services are not as satisfying as a “customer obsessed” company would like them to be.[11] What if “customer obsession” means obsession with the customer or obsession to know everything about the customer? I, for one, don’t feel like I want any of the things Amazon is promising with these products – for my biometrics to be linked to my bank account (and possible accusations of property damage or shoplifting); to have a drone know the layout of my apartment; to be listened and observed by an algorithm that judges my body fat and whether I’m sufficiently happy.[12] But I can see why Amazon might want that information.
A book I started recently, Shoshana Zuboff’s The Age of Surveillance Capitalism, proposes that we have entered a new age of capitalism, one hell bent on commodifying and nudging the human experience. In her words:
“Surveillance capitalism unilaterally claims human experience as free raw material for translation into behavioral data. Although some of these data are applied to product or service improvement, the rest are declared as a proprietary behavioral surplus, fed into an advanced manufacturing process… and fabricated into prediction products… the competitive dynamics of these new markets drive surveillance capitalists to acquire ever-more-predictive sources of behavioral surplus: our voices, personalities, and emotions.”
This is not an endorsement of Zuboff’s book.[13] But if, like me, you get the sense Amazon is no longer innovating for the customer, she provides a plausible explanation for the aggressive push into the previously private untapped data spheres around our bodies and our homes. I look at our methods for dealing with privacy, the limitations we place on government surveillance and corporate surveillance, and think that we’re unprepared to deal with corporations that have sweeping, multidimensional access to very personal information.
***
“Privacy” is a really difficult concept to pin down. It’s easy to define: “the state or condition of being free from being observed or disturbed by other people.”[14] It’s harder to define when and where we deserve privacy and how explicitly we have to voluntarily give it up. It’s usually a very fact-specific question. Was the person alone? In a public place? Were there other people around? Was it at work? In their car? Did they own the car? Should sharing with a few, or any, people mean privacy has been given up? What if the information is sensitive but necessarily requires sharing with another party (financial records are kept by the bank, health records by the doctor)? Did they consent? Did they implicitly consent? It’s a lot of fun.
In Fourth Amendment law, the courts have at least attempted to formulate tests, whether it’s simple (property law & ownership) or more complicated (the Katz test asks if there was a “reasonable expectation of privacy” in the situation both societally and subjectively by the complainant). One thing both these approaches can roughly agree on is that home is a private space. And it is not just because “intimate” things happen in the home – to use the words from Justice Scalia’s pen, “for example, at what hour each night the lady of the house takes her daily sauna and bath” – but any intrusion into the home via technology is presumptively unreasonable.[15]
Of course, the rules change when the surveiller is invited into the home. Surely, they’re changed even more when we pay for the privilege of inviting them in? Because of the commercial relationship between consumers and Amazon, analysis often focuses on whether the consumer consented to the data gathering. I hope our conversations on consent expand beyond the specific (understanding Amazon has data on the layout of my home after purchasing a flying surveillance camera) to the systemic (Amazon has data on my purchase history, viewing history, groceries, biometric data, conversations, etc). Even beyond consent, we should consider the limitations of individuals to make decisions in a world where the default mode of shopping, working, and socializing is online, with previously diffuse and private information gathered in the databases of a few large corporations.
I will not conclude by pretending to have solutions. Hopefully as this blog continues my understanding of the tools and systems in place will lead to some of those conclusions. In the meantime, we should push for security and transparency. Security in the management of data, to ensure it does not fall into the hands of bad actors, and transparency in the reasons data is collected and the ways it is used, so we can continue to analyze the extent of these practices in our lives and our collective comfort with them.
Thanks for reading.
***
Finally, this good tweet of the week:
[1] Halo also promises to listen to the emotion in your voice and give you feedback on your emotional state during the day.
[2] Some of the promised safeguards: two factor authentication and end-to-end encryption for Ring video; immediately deleting Halo body photos from Amazon servers after producing a personal body scan; requiring opt-in for the Halo microphone feature, and Halo recordings are not sent to Amazon servers but analyzed on your phone and deleted, only leaving analyzed data.
[3] https://www.theverge.com/2020/9/25/21455197/amazon-ring-drone-home-security-surveillance-sidewalk-halo-privacy
[4] This is veering into an area of Fourth Amendment law, who qualifies as a “government agent.” I’m not going to sweepingly define a whole area of jurisprudence in a footnote but roughly if the government asks you to do something for them then you’re a government actor.
[5] Yes, I know it’s a Quora link but it’s a succinct explanation of the TOS and distinctions between algorithmic scanning vs human employee reading.
[6] The quintessential example is the Video Privacy Protection Act, which was passed because a newspaper published Robert Bork’s video rental history during his Supreme Court nomination hearings.
[7] I know the cynic’s reaction to this sentence is LOL. There are innumerable examples of government discarding their half of the bargain in the course of normal policing (see Radley Balko’s Rise of the Warrior Cop). This says nothing of military surveillance of US citizens, where government promises the first half (security) but refuses the second (oversight in the public eye or judicious use of power) – see Being Watched: Legal Challenges to Government Surveillance, by Jeffery Vagle.
[8] Like Netflix sharing your video rental history, prohibited by the VPPA (see footnote 6).
[9] I am obliged to mention that this has brought antitrust scrutiny on the company. https://www.theverge.com/21349440/amazon-marketplace-third-party-sellers-antitrust-hearing-jeff-bezos
[10] https://blog.aboutamazon.com/company-news/2016-letter-to-shareholders
[11] See this essay: https://debugger.medium.com/amazon-isnt-even-that-convenient-anymore-99811b59b885
[12] Spoiler: I’m not!
[13] I’ve only finished chapter one and am decidedly mixed on how I feel about the book. I’ve read some interesting critiques online and suggest you do the same.
[14] This is the definition on Google.
[15] Kyllo v. United States (S.Ct 2001)
Dumb Privacy Guy 