You are your clicks

View full image

I received an e-mail a while back from a man who said he had been hired to kill me. He told me he was watching me and knew what I was up to. To prove it, he dropped a number of accurate details about me: the job I had just left; the fact that I was about to fly to Chicago; the name of a friend I was to meet there.

It was a disconcerting message to receive, right up to the moment, a few hours later, when an investigator traced it to an overseas computer and declared it to be a con: the “hit man bribe scam.” Had I responded, I would have been offered a chance to get the hit called off in exchange for a cash payment. The scammers had likely captured my e-mail password by putting keylogging software on a hotel computer I had used in Turkey. They then used it to read all of my stored e-mail.

This experience was a dramatic reminder of how vulnerable we are when we use the Internet. I do not wish threats of murder on anyone, but it would do us all good to focus on what’s going on. Americans are looking on torpidly as their privacy is being quietly but efficiently stripped away, one Facebook or Google privacy-policy update at a time.

Given the clear need for greater vigilance, Lori Andrews ’75, ’78JD, a law professor at the Illinois Institute of Technology’s Chicago-Kent College of Law, has done a public service by writing I Know Who You Are and I Saw What You Did—a brisk and troubling survey of the ways in which the Internet is eroding our privacy.

The tour begins with Facebook, a company she returns to repeatedly. As Andrews sees it, Facebook is more like a nation than a mere website. “With more than 750 million members, Facebook’s population would make it the third largest nation in the world,” she notes. “It has citizens, an economy, its own currency, systems for resolving disputes, and relations with other nations and institutions.”

Andrews credits Facebook and sites like it for the ways in which they allow for self-expression and the building of community. But her concern is the darker side: that “both inadvertently and through conscious decisions, Facebook and other social networks have put private information, including medical test results, credit card numbers, and sensitive photos, into the wrong hands.”

Some of the most interesting stops on Andrews’s tour are lesser-known Internet locales like Spokeo, an online directory that touts itself as “not your grandma’s phone book.” Indeed it is not: Grandma’s phone book did not gather data from real estate listings and social networking sites to compile creepily detailed online profiles—with personal information ranging from religion to home values to political party.

Andrews also writes about data practices that go beyond a single company and are becoming endemic on the Internet, such as data mining and behavioral advertising. Internet companies furiously mine data about all of us—what websites we visit, what terms we search for, what ads we click on—and then create detailed dossiers. The collected information is used to deploy behavioral advertising targeted at Internet users based on who they are and what they do.

Some of this targeting is mainly just annoying, as in the case of “retargeted advertising,” the ads that follow you across the Internet: click on an ad for a pair of shoes and you are likely to see it wherever you go. Other behavioral advertising raises more serious concerns: what if young people in wealthy zip codes are being bombarded with ads for selective colleges while those in poorer zip codes are shown ads for technical schools?

Data mining of this sort ultimately points in a dystopian direction. As we learned during the National Security Agency warrantless wiretapping scandal of 2005, the government has an enormous capacity to collect information on all of us—the e-mails we send, the websites we visit—and to sift through it for things it does not like.

The concern is that these information practices are leading us down the road to becoming a total information state. Before long, the government and private companies (which increasingly work in tandem) will know close to everything there is to know about us.

What’s to be done? Technology companies are unlikely to do much; collecting people’s private information—and using it for marketing purposes—is just too lucrative for them to voluntarily renounce. Government has also been anemic. We lack a strong general privacy law at the federal level, and in case after case, courts have ignored or minimized invasions of privacy.

Andrews offers an outside-the-box solution: a social-network constitution that would establish broad principles governing Facebook and other social networking sites. Her proposals include the right not to be discriminated against based on one’s online profile. It would be fine to live within the guidelines Andrews draws up. The problem is that her proposal smacks of utopianism; one can almost imagine it being drafted in Esperanto.

Must we really wait for a web constitution to be adopted and enforced to reclaim our privacy? There is an alternative. People can and should press Congress and the state legislatures to pass strong privacy laws and to push courts and administrative agencies to interpret the laws that are on the books in more privacy-sensitive ways.

None of this will be easy, but there are reasons to believe it can happen. The Federal Trade Commission recently said that if industry does not do better, it will urge Congress to enact “do not track” legislation that would allow Internet users to opt out of having their online movements recorded.

Andrews’s loftier vision may be idealistic and difficult to achieve, but that is not an entirely bad thing. By laying out a boldly aspirational conception of the rights we should, in a perfect world, have online, Andrews provides the grittier realists with a sense of where they should be heading—and gives the pendulum a forceful push in the right direction.