Geeks Bearing Gifts
by Albert Fox Cahn
May 14, 2020
This interview with Albert Fox Cahn, the Surveillance Technology Oversight Project’s [S.T.O.P.] founder and executive director, fellow at the Engelberg Center on Innovation Law & Policy at N.Y.U. School of Law, was conducted and condensed by franknews.
frank | Tell us a bit about your work.
Albert Fox Cahn | I'm a lawyer, a technologist, and an activist. I founded S.T.O.P. in January of last year and launched it in March. It came out of the work I had been doing as the legal director of the Muslim civil rights group here in New York. I saw that while we had had many of these same privacy debates at the federal level for more than a decade without much movement, there were huge changes happening at the state and local level. The transformation of the surveillance capacity of local and state governments had been met without much local pushback, especially here in New York. So S.T.O.P. came together with an intersectional model to use litigation, education, advocacy, media engagement, and legislative work to turn New York from one of the most invasive surveillance states in the country to one of the most privacy protected.
We've only been around for a short time, but we've started to make a real impact by drafting legislation, class action lawsuits, research papers, open records requests and a variety of other matters. We are constantly highlighting the unique and the disproportionate impact of surveillance on historically over-policed communities, communities of color, and immigrant communities. This is not simply a problem that impacts us all equally. While surveillance may touch all of our lives, the impact it has on those historically marginalized communities is quite different.
How have we seen that play out historically?
We have repeatedly seen government agencies requesting deeply invasive information about the public in order to deal with the threat of the day.
In the eighties and nineties, surveillance was expanded mostly through undercover officers and human informants, to deal with the rise in crime. In the 2000s after 9/11, we had the shift to surveillance overwhelmingly targeting terrorism threats. And now, we see the focus shift to health data, as fighting the pandemic becomes the primary claim for necessity.
One of the lessons we have learned throughout history is that though only the high profile risks are cited when agencies ask for this data, it ends up being used in all sorts of other ways. A classic example is that a lot of the data collection that came from the reaction to 9/11 is now being weaponized to target undocumented communities and to help ICE deport Americans.
It definitely feels like the conversation around data privacy has shifted focus to health data. Do you feel like there’s ever a necessary trade off between public health and the public's privacy?
Well, I think part of the question is whose health and whose privacy. I am quite worried that we are going to see dramatically expanded surveillance of communities of color or low income communities in order to promote, disproportionately, the health of more privileged communities.
Much of the surveillance that's being described, such as cell site location information, GPS data aggregation, other forms of location-based tracking, has not been proved to reduce the spread of COVID-19, or help promote social distancing. What we do know is that these same technologies have been used successfully for years as part of law enforcement and immigration enforcement.
The benefits are ambiguous, but the harms are quite concrete.
Of course, the risks and benefits vary based off of the specifics of the surveillance technology that we are talking about.
You mentioned a lack of evidence in New York about the benefits of expanded surveillance. But South Korea has a more proven concept. South Korea is sending out really granular alerts that include individuals name, sex, age, and records of movement. What do you take away from that?
I am really disturbed by the amount of information that gets shared in South Korea. In addition to the things you mentioned, they will also share the nationality and ethnicity of the individual. They will say it was a Polish individual. If you are in a community with only one Polish person or only two Polish people, then suddenly you have taken that data and made it quite identifiable. Location data in general is very difficult to anonymize, but in South Korea they have made it quite easy to go and use this to basically recreate someone's movement over an extended period of time.
What has made the South Korean model so effective, is something that we haven't been able to replicate here in the U.S., and that is access to quick, reliable testing. Unless people who are alerted to potential coronavirus exposure can get a test, the information is largely useless for fighting the disease. The data is not going to actually help reduce the spread of COVID-19 when people are getting information that they might have been exposed, but never have the ability to follow up on and get a test. That is the current reality for countless of us here in New York where we actively have to presume that we have been exposed to COVID-19 simply because of the number of people who have it and the inability to get tested.
Governor Cuomo has become very popular and has new legislative power to issue directives and make quick decisions to fight COVID. A lot of the people we’re speaking to return to this thought about how deprived of competent leadership we are. How quick we are to label action as heroic. If people are already excited about Cuomo, already praising him, does his newfound public acceptance make this law more powerful?
Oh, it makes it incredibly dangerous. It makes it harder to stop the governor if he seeks to extend the emergency powers after the initial expiration date. I think because of the infuriating incompetence we have seen from the Whitehouse throughout this crisis, the bar for adequacy has been set quite low for state and local officials. Governor Cuomo can be better than the president in responding to this crisis, while still, by many measures, falling short of what we need at this moment.
The Governor and Mayor of New York continue to have lengthy political squabbles that only distract and detract from our response to COVID-19. We continue to see the Governor use these powers to promote issues outside the scope of the emergency response. We see the Governor strong-arm legislators to get through the budget and extend executive authority even further. We see the President claiming his power is absolute and claiming constitutional mandates outside of any reading of the U.S. Constitution.
As someone who has spent a good portion of my life studying the history of civil rights movements and governmental misconduct, I have to say that it's troubling that we are using such an anti-democratic response to this crisis.
Why do you think our response is anti-democratic?
I think in a crisis there is always a rally around the flag effect that gives broader support to executive leadership. The practical difficulties of meeting as a legislative body in a time of social distancing has given executives even more ground to frame the need to make these decisions as unilateral.
I also think it reflects in many ways the personalities of the leaders in charge. There are many governors across the country who have done an exemplary job responding to this crisis by working hand in hand with the legislature, not seeking additional emergency powers, using the tools they already had and using a decision making model that's inclusive of dissenting voices. Right now we see Governor Cuomo going down this path of really shutting out dissent, and I don't think that history shows there's a good track record for leaders who pursue unilateral decision making without contrasting views.
What role should technology play in the response to COVID?
I think there are a variety of technologies that have been indispensable in responding to this crisis. The same technologies that allow millions of us to work remotely, allow remote healthcare appointments for non COVID patients and those with mild symptoms. Those sorts of tele-health technologies have been hugely helpful.
I think there is potentially a space for computerized triage tools that use patient data to determine if someone should be prioritized for testing. But there have been a lot of privacy issues with the existing models. We should make clear that the companies offering these services and partnering with government agencies shouldn't be allowed to profit from a public service at times of crisis. If they want to provide triage tools to the public, then they shouldn't be able to sell that data to advertisers or sell it to third parties to monetize our data in all the other ways that our information is monetized.
“Americans should be wary of geeks bearing gifts”, as you say.
Oh yeah. I was way too happy with myself over that one.
Apple and Google have a new app which allows for voluntary embedding of the app for contact tracing. France is calling for Apple and Google to actually ease their restrictions to allow them to make a sovereign app with the technology. How do you feel about it?
I am deeply alarmed by the proposed Apple Google partnership on a bluetooth API for contact tracing. I think this has the capacity to be a highly invasive system and I think that while the cryptographic approach they had outlined would have some privacy preserving features, it will be quite easy for institutional actors to effectively de-anonymize the Bluetooth beacon data so that when someone identifies a positive COVID-19 result, it will be easy to identify who that is.
I also think that there are huge issues with digital equity in such a system, given the fact that you simply don't have smartphone adoption rates among the highest risk communities, older adults in lower income brackets, that would allow the apps to actually be effective and to reach enough market share. I'm also really worried about these so-called “opt-in” features becoming compulsory if employers or schools or churches or other public spaces make use of these systems as a prerequisite to taking part in public life. I don't want a situation where you lose your job potentially as a janitor at a hospital or as a teacher because you refuse to run this on your phone.
You can see the prerequisite argument playing out. Is it inevitable for us to reopen?
I think it's a structural weakness for the system that's been described by Apple and Google. It is far from inevitable that their system will be deployed, but I think it is a real danger and I don't think there's anything in most states that would prevent companies from doing just that. With the idea of an antibody passport, I'm quite concerned as well because a lot of the antibody testing that's on the market doesn't have a high level of accuracy. Many of them have not been FDA approved.
Even if antibody testing were shown to be accurate and reliable, there's a lot of dangers about creating a system where we are incentivising low income Americans to get sick so they can get antibodies and they can get back to work.
I am quite concerned that we will roll out some sort of antibody passport tracking technology at the expense of continuing to provide the emergency relief that so many families need to get by.
You wrote we face the risk of surveillance turning state borders into “21st century iron curtains”. Is that what you think will happen?
We have been down this road before to a degree in the 1930s. During the height of the great depression, states tried to block people from entering from neighboring states. The Supreme Court struck down that sort of barrier, and said the several states must sink or swim together, and that, in the long run, prosperity and salvation are in union, and not division. We cannot create internal borders against interstate movement. It's a right that they traced the original Constitution itself before even the Bill of Rights.
There is a lot of expertise in this field already. How do you put it to work?
I think part of it is passing these state laws to prevent abuse of this crisis. We were proud to partner with assembly member Dan Quart to introduce a new ban on geolocation data tracking for law enforcement purposes here in New York. The law makes sure that if New York goes down the path of getting public health officials via geolocation data, that it can't be used to put people in jail for unrelated criminal cases.
We need more state laws. We need more restrictions.
We need to fight back against the expansion of emergency powers and we need to come up with threats of litigation against anyone who exploits this moment towards their own act.
I think that may take the form of cease and desist notices against companies that are marketing COVID-19 detection apps that are really just ways to suck in and monetize our data.