The Privacy Project: Why we need a Department of the Attention Economy

View in BrowserAdd nytdirect@nytimes.com to your address book

Tuesday, July 23, 2019

The Privacy Project »

By Charlie Warzel
@cwarzel

Alex Brandon/Associated Press

In just the last month the Federal Trade Commission has brokered settlements with Facebook, Google and Equifax over data breaches and mishandling of consumer information.

If you squint, it looks a bit like justice served. For its data management sins Equifax must pay $300 million to a fund for affected consumers with the potential for the fund to grow to cover payments up to $425 million. Google will reportedly pay a multimillion-dollar fine for collecting data and targeting children under the age of 13 in violation of the Children's Online Privacy Protection Act. And the F.T.C. has approved a $5 billion dollar fine for Facebook for mishandling user data in the Cambridge Analytica scandal.

In an alternate universe, such settlements in such quick succession would be a clear sign that the regulatory might of the federal government is firmly focused on Silicon Valley and consumer data protection. But unfortunately, here in 2019 on Earth-One, this month's fines aren't shows of strength but telling admissions of weakness. When it comes to funding, influence and size, the government is simply outmatched by the internet's largest data guzzlers.

Nowhere is this more true than with Facebook. As Tony Romm reported in The Washington Post this week, the F.T.C. had originally conceived of significantly tougher punishments for Facebook, including fines exceeding tens of billions of dollars as well as direct liability for the company's c.e.o., Mark Zuckerberg. The report lays out the nuance of the settlement negotiation process, and what I found striking was how it seemed as if — despite being the party in violation of the rules — Facebook appeared to have the upper hand:

Internally, the agency knew that it wasn't guaranteed to get a multibillion dollar fine and other new commitments from a federal judge. Adding to the trouble, the agency, armed with a relatively small $306 million budget in 2018 that supported roughly 1,100 employees, had to confront the possibility that it might be outmatched in such litigation … A loss also could have immensely damaged the agency, perhaps setting a legal standard that curtailed the commission's authority to police other tech giants for their privacy and security practices.

Facebook, in other words, is too big to fight. And so it received a fine that is roughly equivalent to a month of the company's yearly revenue. When news of the fine broke, Facebook's stock price surged close to a yearly high. Google's settlement could change the way the company's algorithms serve advertisements on children's videos but its fine, too, is paltry. And Equifax's total payments, arguably the most onerous of all three, represent roughly 17 percent of Equifax's 2018 revenue. (A substantial portion of the consumer reimbursement is likely to come from Equifax providing free credit monitoring.)

Together, these weak enforcements reveal a structural asymmetry between data brokers and the government. The old enforcement mechanisms of regulatory agencies (fines, public shaming) are no match for the size of these companies and the unprecedented amount of lucrative personal information they possess. In this way, the feds seem only to partially grasp the business models of the companies they seek to regulate. Facebook, Google and Equifax all derive their profit and power from collecting data and controlling its supply in an economy where demand for data is insatiable. Any effort then to check that power — or curb those profits — can come only from changing the ways these companies amass our personal information.

Some people in Washington are — gradually — seeing the light. Representatives Zoe Lofgren and Anna Eshoo, both California Democrats, are reportedly circulating a proposal for a 1,600-person data protection agency. And on Sunday, after news of the Facebook settlement, the presidential candidate Andrew Yang tweeted a suggestion to create a new "Department of the Attention Economy" to deal with tech issues.

That he chose the words "attention economy" is meaningful. Facebook and the data brokers are not too big to fight, provided we have agencies that understand how our attention and information are currency to big technology companies. That means staffing, resources, a clear mandate to protect privacy and actual laws that move more invasive forms of data collection from an industry standard to something that's illegal. It also means reorienting punishments around the resource we're trying to protect: data. If we want to reform the data brokers, then we must build agencies that force them to change the way they collect our information.

From the Archives: Another Privacy Newsletter!

NYT archive

Today's trip to the archives focuses on a 1991 profile of Robert Ellis Smith, who wrote an analog monthly newsletter on privacy, titled "The Privacy Journal." Some gems include:

"Mr. Smith's timing, however, was good. In the early 1970s, computers became widespread. As data tapes whirled, Mr. Smith saw images of an Orwellian society where Government and businesses could know too much about an individual's life and likes. That information quickly became a commodity for marketers. And it was used to decide whether someone should be hired for a job or extended credit. "What I soon discovered was that there was often not any need for the information that was being collected, or respect for its accuracy," Mr. Smith said."

Smith's work shows how our privacy conversation, though much more complex, isn't all that different in tenor from decades ago. Mentions of "The Privacy Journal" go back decades in The Times's archives, including in this now quaint 1977 piece by Cokie Roberts, titled "Privacy: Battles With the Computer," which is still quite relatable!

Mr. Smith sprinkles his newsletter with such horrible examples, to inform readers of the need to combat invasions of privacy. Currently about 2,000 people subscribe to the journal at $45 a year. Mr. Smith believes half of them are professionals in the computer field who think they should "know the enemy" — him — while the other half are interested citizens or civil libertarians.

Smith died last August so I'm dedicating this week's edition to his trailblazing legacy.

Tip of the Week: Don't Install Sketchy Software

Last week's viral privacy scare centered around FaceApp, an AI-powered way to make yourself look old. Users uploaded pictures of their faces, privacy advocates freaked out and conspiracy theorists and even some politicos worried that maybe it was all a Russian intelligence operation. As I wrote last week, there's an upside to the whole fiasco, which is that it got people thinking critically about the random apps they download.

You should get in the habit of interrogating every new app before downloading, regardless of where the company is based. Figure out what permissions it asks for, what it does with your information and ask: Is this sketchy? But don't take it from me, my Wirecutter colleague Thorin Klosowski created some great instructions as part of our Privacy Project guide that might help you practice safe app downloading. Here's a relevant excerpt:

DON'T INSTALL SKETCHY SOFTWARE

Why: Every weird app you install on your phone and every browser extension or piece of software you download from a sketchy website represents another potential privacy and security hole. Countless mobile apps track your location everywhere you go and harvest your data without asking consent, even in children's apps.

How: Stop downloading garbage software, and stick to downloading programs and browser extensions directly from their makers and official app stores. You don't need half the apps on your phone, and getting rid of what you don't need can make your phone feel faster. Once you clear out the apps you don't use, audit the privacy permissions of what's left. If you have an iPhone, open Settings and tap the Privacy option. On Android, head to Settings > Apps, and then tap the gear icon and select App Permissions. Here, you can see which apps have access to your location, contacts, microphone, and other data. Disable permissions where they don't make sense — for example, Google Maps needs your location to function, but your notes app doesn't. In the future, think about app permissions as you install new software; if an app is free, it's possibly collecting and selling your data.

The same rules go for your computer. If you're not sure what to delete from your Windows computer, Should I Remove It? can help you choose. (Yes, it's more software, but you should delete it after you're done using it.) Mac users don't have an equivalent, but all software resides in the Applications folder, so it's easy to sift through. If you find an app you don't remember installing, search for it on Google, and then drag it to the trash to delete it if you don't need it.

Additionally: Connecticut's Attorney General created a nice infographic that's similar to this that you can see here.

I want to hear from you

Send me your pressing questions about tech and privacy. Each week, I'll select one to answer here. And if you're enjoying what you're reading, please consider recommending it to friends. They can sign up here.