Thursday, June 6, 2013

Oops. Maybe Verizon should have revised their privacy policies. [UPDATED]

Another week, another invasion of privacy and violation of rights for regular citizens. It's becoming quite an alarming routine from the Obama administration, isn't it? 

The latest "Are You Kidding Me?!" story is how the NSA has been collecting records from tens of millions of Verizon wireless customers in the U.S. under a top-secret court order, including "the numbers of both parties on a call are handed over, as is location data, call duration, unique identifiers, and the time and duration of all calls." 

Image by Ben Howe

We have established legal procedures wherein the government can go to a judge, explain why they believe some type of unlawful conduct is happening, and get a warrant to get your phone records, tap your phone, search your home, etc. 

However, in this case, there was no underlying conduct or suspicion thereof that would give a judge cause to grant such a warrant. There were no allegations that specific Verizon customers were communicating with terrorist organizations or conspiring with criminals; the government just wanted a database with all of these records from tens of millions of private citizens. Accordingly, I believe very strongly that this was an egregious violation of the due process rights of the Verizon customers. 

Based on the reactions I'm seeing online, a lot of Verizon customers are not happy about this widespread invasion of their privacy. Many are making jokes along the lines of "now the government knows exactly how often my mother calls," but there is an underlying discomfort and anger because for the average American citizen, if you have done nothing wrong, there is simply no reason that the government should know how often your mother calls. 

I found some interesting language in Verizon's privacy policies as posted online. From their "Code of Conduct," as distributed to Verizon employees:
Section 4.1.1. Customer Privacy and Communications
Verizon Wireless' privacy policies inform customers about what information is collected about them and how it is used. Customers are also given the ability to limit certain uses of their information. You must respect these choices...
Except as otherwise required by the duties of your position, you must not - and must not permit others to - access, listen to, monitor, record, tamper with, disclose or intrude upon any customer conversation or communication, except to comply with a valid service or installation order, a valid legal order or applicable law, or for the limited purposes of quality monitoring and training, as approved by the Legal Department.
Note that they mention "comply[ing]...with a valid legal order or applicable law," but don't clarify what the customer should be told about such compliance.

Verizon's privacy policies are posted two places online, as a summary and as the full privacy policy. From the summary:
Verizon is Committed to Protecting Your Privacy 
Protecting our customers' privacy is an important priority at Verizon and we are committed to maintaining strong and meaningful privacy protections for customers. Our privacy policy is designed to inform you about the information we collect, how we use it, and your options with regard to that collection and use. Key elements of our full privacy policy are summarized below.
From the full privacy policy:
Information Collected When You Use Verizon Products and Services: 
We collect information about your use of our products, services and sites. Information such as call records, websites visited, wireless location, application and feature usage, network traffic data, product and device-specific information, service options you choose, mobile and device numbers, video streaming and video packages and usage, movie rental and purchase data, and other similar information may be used for billing purposes, to deliver and maintain products and services, or to help you with service-related issues or questions. In addition, subject to any legal restrictions that may apply, this information may be used for other purposes such as providing you with information about product or service enhancements, determining your eligibility for new products and services, and marketing to you based on your use of your products and services. This information may also be used to: (1) manage and protect our networks, services and users from fraudulent, abusive, or unlawful uses; and (2) subject to consent practices described in this policy, help us improve our services, research and develop new products, and offer promotions and other services. This type of information may be aggregated or anonymized for business and marketing uses by us or by third parties...
Information Shared Outside the Verizon Family of Companies:
...We may disclose information that individually identifies our customers or identifies customer devices in certain circumstances, such as:

  • to comply with valid legal process including subpoenas, court orders or search warrants, and as otherwise authorized by law;
  • in cases involving danger of death or serious physical injury to any person or other emergencies;
  • to protect our rights or property, or the safety of our customers or employees;
  • to protect against fraudulent, malicious, abusive, unauthorized or unlawful use of or subscription to our products and services and to protect our network, services, devices and users from such use;
  • to advance or defend against complaints or legal claims in court, administrative proceedings and elsewhere;
  • to credit bureaus or collection agencies for reporting purposes or to obtain payment for Verizon-billed products and services;
  • to a third-party that you have authorized to verify your account information;
  • to outside auditors and regulators; or
  • with your consent.
Again, note that they list the information they are gathering from their customers, and  expressly states that they will "inform you about the information we collect, how we use it, and your options with regard to that collection and use," but somehow Verizon's "we will inform you" promise doesn't cover turning over data on all your communications to the government.

This story just broke within the past 24 hours, and I'm sure there's more ugly details yet to come. What I do know for sure is that I do not envy Verizon's legal and public relations departments this week. Hopefully the blowback is harsh enough that it serves as a lesson for other companies that capitulating to government demands to violate the privacy rights of their own customers is a bad business plan.

It will be interesting to see if any of the other major wireless carriers were also handing over databases of customer communications to the government under similar secret orders. 

For more information on this story, read Glenn Greenwald's original exclusive report here, Mary Katherine Ham has a thorough summary of the latest breaking news here, Conor Friedersdorf has an excellent analysis at The Atlantic on praising the whistleblower who exposed this story here, and Seton Motley has an excellent post at RedState on why big government is the problem here.

UPDATE I: I've been having some excellent debates with people on Facebook and Twitter, and wanted to clarify a few points. First, yes, I get that these were orders from a secret court. But holy heck, if a government order violates a constitutional right, issuing it from a secret court doesn't make the constitutional violation go away. In fact, in some cases that makes it all the more crucial to challenge.

As an illustration, go look up the many news stories about the attorneys who have filed various motions on behalf of terrorist detainees. Many of the orders affecting those detainees arose from military tribunals and other courts with varying degrees of secrecy, and somehow those lawyers still figured out a way to get in the courthouse doors. (Note: I'm not saying there aren't times when secrecy isn't legitimate. I'm saying that the government defining an order as secret isn't necessarily the final word on whether that order is lawful and constitutional.)

Also, going to court isn't Verizon's only option. The company spends major funds on lobbyists and if this issue was a priority for them, they could lobby to change the law or the procedure for how it is implemented. Bottom line, it is absolutely inaccurate to say that Verizon didn't have any options but to fully and immediately comply with the government's demands for their customers' information.

It’s as we suspected that it isn't just Verizon that’s the target of the NSA, but AT&T and Bellsouth as well. But also note that people with knowledge of the program told USA Today that the goal is to create a database of every call ever made within the nations borders. Now if that doesn't completely outrage people, as it should, then I don’t know what will. After all, Bush’s program only targeted phone calls going overseas to terrorist-ish countries and the left went bonkers over it. Obama’s program targets EVERYTHING...
UPDATE III: Apparently that's a story from 2006. Or something. Whatever. The government is creepy and invading our privacy, and they're doing it a lot and in a lot of different ways. Ugh.

Follow me on Twitter at @rumpfshaker

No comments:

Post a Comment

Creative Commons License

Creative Commons License
Permissions beyond the scope of this license are available here.