Thread by @NexusOfPrivacy

The Fourth Amendment Is Not For Sale Act finally has a hearing today!

The House Judiciary Committee hearing on "Digital Dragnets: Examining the Government's Access to Your Personal Data" will be starting in just a few minutes
judiciary.house.gov/calendar/event…

The Fourth Amendment Is Not For Sale Act prohibits data brokers from selling Americans’ personal information to law enforcement and intelligence agencies without a warrant.

It's sponsored by @RonWyden and @RandPaul.

wyden.senate.gov/news/press-rel…

In the House, the Fourth Amendment Is Not For Sale Act is lead by House Judiciary Chair @RepJerryNadler and @ZoeLofgren.

It was introduced over a year ago, so it's great to see it finally get a hearing.

Yesterday, the ACLU published a trove of info how CBP, ICE, and other parts of DHS sidestepping the Fourth Amendment by buying access to, and using, huge volumes of people’s cell phone location information quietly extracted from smartphone apps.

aclu.org/news/privacy-t…

@alfredwkng has an excellent story on Politico -- and a great thread with screenshots.

This is all perfectly legal today. The Fourth Amendment Is Not for Sale Act would prohibit it.

https://twitter.com/alfredwkng/status/1549003834604883969

You can watch the Fourth Amendment Is Not For Sale Act hearing on @HouseJudiciary's page -- which also has a link to witnesses' written testimony.
judiciary.house.gov/calendar/event…

@RepJerryNadler kicks it off talking about scale of the problem today.

Ranking Member @Jim_Jordan talks about the government's assault on our rights, focusing mostly on First and Second Amendment attacks as well as the Fourth Amendment.

Jordan talks about FISA's warrantless surveillance. Fourth Amendment Is Not For Sale Act would close a FISA loophole (although more is needed).

Up first, Bob Goodlatte, former House Judiciary chair of @savingprivacy. Notes that the extraction of data by the government is far more ominous than private companies.

The framers included a warrant requirement. Now government lawyers are saying "... unless we buy it."

Goodlatte talks about the Department of Defense collecting data from Muslim Mingle, a Muslim dating apps -- making a mockery of the First and Fourth Amendments all at once. @JosephCox reported on this back in 2020.

vice.com/en/article/jgq…

Up next @greenarchives1, talking about the shift to "voluntary" surveillance -- choices we have to make to trade our data for access to online life.

"Even when companies promise to anonymize our data, it can easily be reidentified."

@greenarchives1 looks at the surveillance ecosystem today, ticking off various kinds of companies including analytics companies and data brokers, who create huge data dossiers. They're "Big Brothers' little helpers".

"Data policing tools are dragnets"

"Even if you try to opt out of data collection, they create shadow profiles based on activities of your friends."

Some have suggested that governments are outsourcing their surveillance to these companies to get around oversight requirements.

Programs that collect data should be audited regularly. Programs should be transparent, people should be able to see and correct data. Government programs using the data should be monitored for accuracy and bias.

@RebeccaWexler makes an interesting point: when law enforcement purchases data, they don't get exculpatory evidence. They don't have to learn about inaccuacy, or bias, or whether the data was collected illegitamitely, etc etc.

Private companies often treat this info as a trade secret, and refuse to disclose it. But it's exculpatory! If they seize the data, or build the systems themselves, they're much more likely to know.

If law enforcement is ignorant of exculpatory evidence, defendents' Brady constitutional rights don't apply. Statutory rights don't apply. Cross-examination would be futile. And they can't subpoena for the information unless they already know it'll be exculpatory.

And vendors sometimes say products are for law enforcement, so refuse to sell to defense attorneys -- or even allow independent research.

Congress should consider various remedies to give defense counsel access to exculpatory evidence.

@tolmanbrett or @RightOnCrime. There's a reasonable expectation of privacy in people's digital footprint. The Constitution requires a warrant, but purchasing databases in bulk sidesteps this.

@tolmanbrett: "not long ago, I was tasked in the Senate with renewing the Patriot Act. We heard assurances years ago from DOJ and the FBI about FISA and those surveillance authorities not being turned against honest Americans. We've seen how that worked out."

@tolmanbrett cites "the recent, and disturbing, Inspector General reports" about FISA and the PATRIOT Act. Disturbing indeed!

lawfareblog.com/fbis-fisa-mess

And here's more on the Inspector General's previous disturbing FISA memo.

lawfareblog.com/inspector-gene…

Now @LizaGoitein of @BrennanCenter. Cites SCOTUS' Carpenter decision that law enforcement needs a warrant to collect a week's work of cellphone data. But despite this ruling, federal agencies secretly have purchased this data -- FBI, DoD, DHS, IRS.

Purchasing data doesn't just invade our privacy, it invites abuse -- talks about targeting based on race, religion, political activities. Cites the Muslim prayer app example, as well as purchasing data about protestors in Ferguson.

@LizaGoltein ends with a call to pass the Fourth Amendment is Not For Sale Act.

And now, questions. @RepJerryNadler asks @greenarchives1 to trace how data gets from Facebook to databrokes, and @RebeccaWexler about barriers to defense counsel getting exculpatory info.

Did ECPA intend to allow this kind of communication? Goodlatte says no, it focused fairly narrowly on email. Now there's so much more -- he's got 160 apps on his phone, "probably half of them are tracking me."

[Probably _all_ of them are tracking him]

@greenarchives1 notes that predictive analytics can be built for almost any purpose -- such as determining who's visiting Planned Parenthood clinics.

@RepAndyBiggsAZ urges the Chair to bring Fourth Amendment Is Not For Sale Act up for a vote as soon as possible.

Confirms with @greenarchives1 that companies can use geolocation data to know where people are. Yep.

Cites case where a Gainesville Florida man was wrongly arrested based on geolocation data because he rode his bike past a home that was burglarized.

nbcnews.com/news/us-news/g…

@LizaGoitein notes that the geolocation data is simultaneously accurate enough that it can identify very specific location -- but inaccurate enough that it often leads to mistaken arrests.

Biggs is now talking about ballot harvesting and promoting a disinformation movie. Sigh.

Now submitting several New York Times articles for the record, incuding one on Pegasus. It might be this one. nytimes.com/2022/07/10/us/…

@RepZoeLofgren says it's essential that we move this bill -- but insufficient. Cites ICE as one o the biggest privacy violators in the government. They've scanned 1/3 of the drivers' licenses, have access to 75% of utility records, etc.

@RepZoeLofgren submits article on ICE using LexisNexis
theintercept.com/2022/06/09/ice…

Asks Goodlatte if FANSFA would completely solve the problem. He says it's a big step but more is needed - dealing with geofence warrants, selling data to foreign companies.

@RepZoeLofgren says more is needed, cites the privacy bill she and @RepAnnaEshoo introduced, talks about privacy bill in another committee (ADPPA) that has some data broker regulation.

@LizaGoitein agrees about the importance of a comprehensive privacy law -- but don't slow down the Fourth Amendment Is Not For Sale.

Lofgren agrees.

@repdarrellissa notes we're selling personal data, the equivalent of what used to be kept safely in your house -- to law enforcement, to Russians and Chinese. Need to return to original intent.

Issa bring up HIPAA, which limits law enforcement *and everybody else* from sharing without informing you and getting your consent. Do we need that for everything? To him that's the key question.

@LizaGoitein agrees that this is a strength of HIPAA, notes also weaknesses - it allows selling deidentified data, which can then be reidentified; it only applies to health care institutions, not to app developers.

Issa: agree, we can do better.

@davidcicilline talks about opt-out. Are users typically aware their info is being retained and sold? Can users understand the consequences? Is that sufficient? Does more need to be done?

@greenarchives1: no, that's not sufficient. We all just click on "agree".

Agrees that most Americans have no idea they're consenting to the sale of their data to 3rd parties.

@greenarchives1 adds that companies try to make people comfortable by saying they'll anonymize it -- but it's easily reidentified.

Ciclline asks about targetting Muslim Americans, LGBTQ+ individuals, other communities.

@LizaGoitein cites Muslim prayer app. Police departments contract with data brokers who advertise ability to track racial justice protestors

Will this get in the way of government agencies doing their job? Goodlatte: when they have probable cause, they can get a warrant. Notes that state and local government agencies also buy data.

@RepJerryNadler asks whether we have evidence government is tracking other religions. @LizaGoitein says not as far as we know, but it's not transparent -- so even if it's happening we probably wouldn't know.

Jordan: is this geolocation data being used for political purposes? @tolmanbrett says no question about it, whoever's in power uses the data to target their opponents -- and FISA makes it worse. Agrees that the bill's a good step, encouraging that it's bipartisan.

Jordan's also concerned about facial recognition technology. @LizaGoitein absolutely agrees, a huge threat, could wipe out anonymity. "We also know it doesn't work well." Jordan agrees, especially for minority groups.

Goodlatte agrees, need to focus on broader scope as well. But need to start with government agencies, because they have the most power.

Jordan: "yeah, it's called the Fourth Amendment"

@greenarchives1 agrees, and notes that it's important to include large data brokers. If we focus only on facial recognition companies, they'll just sell their data to the data brokers.

@RepHankJohnson asks which law enforcement agencies are the most prolific purchasers.

@greenarchives1 says it's hard to tell, cites lack of transparency. Cites ICE's huge predictive analytics, but also state and local. LexisNexis alone contracts with over 1300 state and local

What kind of data do law enforcements mostly purchase?

@greenarchives1: All the data! Over 10,000 kinds of data - work history, geolocation data, licenses, voting records, predictive policing technologies that look at the data

What individuals are the prime targets?

@greenarchives1: disparate impact for people who already have a lot of information in the criminal system, disproportionately black men

@LizaGoitein often nobody's being targeted -- it's a dragnet. They buy it all and sift through it. ACLU's docs showed that DHS collects a lot of data without reasonable suspicion.

@mattgaetz: "I've heard enough." Says they should advance this bill, it could be their signature achievement.

Now puts Goodlatte on the spot. Does Disney collect this info? Goodlatte doesn't know. Gaetz: "You're the Republican that Disney hired. And you don't know?"

Y'know, I have a feeling Gaetz' point here isn't fundamentally about the Fourth Amendment Is Not For Sale Act.

That said, I agree with him: surveillance by Disney and other private actors is a huge problem too.

And even though I agree with Goodlatte's testimony, I also think Gaetz is right about the problems of the revolving door between government and lobbyists.

Gaetz suggests state-based laws could also tackle these issue.

Enters articles into the record, including this one latimes.com/business/la-fi…

@RepSylviaGarcia is encouraged by bipartisan agreement. Enters into the record a report about ICE collecting utility data. It might be this one washingtonpost.com/technology/202…

Or perhaps medium.com/center-on-priv…

@greenarchives1 talking about how ICE investigators can access all the data. The data from NCTUE (mentioned in the above articles) make it easy to identify you and ties it together with everything else.

@RebeccaWexler highlights that allowing the accused to challenge the accuracy of the data is essential.

@RepDanBishop is concerned that passing Fourth Amendment Is Not For Sale act first might just empower private entities. Aren't they a threat?

Goodlatte agrees they are, although notes that it involves different committees, so go ahead with this.

@LizaGoitein: it's not a zero-sum game. First, close loopholes in existing laws; then, expand universe of privacy protection. This won't take the political pressure off -- people are upset at how advertisers and corporate entities are using their data without consent.

@tolmanbrett agrees: start with government.

@RebeccaWexler notes that privacy statutes often have exceptions for law enforcement access -- but not for defendants. Similar exceptions should be added

Wexler: "The majority of privacy statutes selectively empower law enforcement," cites and example in the stored communications act.

Bishop also brings up FBI's purchase of Pegasus

@RepDean brings up pre-Dobbs/post-Dobbs difference. What about menstruation tracking?

@RebeccaWexler: "this data tracking makes people who are pregnant and seeking medical care very vulnerable." Suggests an evidientiary privilege via statue, cites SCOTUS "Pierce County" case.

Wexler re-emphasizes that data tracking makes people who are pregnant and seeking medical care very vulnerable.

Dean: this reminds me of the Watergate-era expression "follow the money".
Lamdan lists several of the contracts, cumulatively hundreds of millions of dollars going to data brokers: LexisNexis, Oracale, Thompson Reuters, Palantir

Different companies on state level, also analytics companies.

Votes being called on House floor, committee is now in recess.

Here's the Pierce County v. Guillen case that @RebeccaWexler mentioned.

oyez.org/cases/2002/01-…

The Disinfo Defense League (@TeamDDL) is calling on Congress to defend online privacy -- and pass the Fourth Amendment Is Not For Sale Act

freepress.net/news/press-rel…

Signers on the @TeamDDL letter include @AccessHumboldt @accessnow @AAAJ_AAJC @CCDHate @fightfortheftr @FylproMabuhay @IndiPlusWA @mediajustice @MuslimAdvocates @NewGAProject @cyber4democracy @snoco_indiv @C2i2_UCLA @votolatino and @wapeopleprivacy
freepress.net/news/press-rel…

And the hearing has started up again.

@RepKenBuck Questions about action movies, are various scenes constitutional or unconstitutional, or just creepy?

judiciary.house.gov/calendar/event…

@RepKenBuck supports Fourth Amendment Is Not For Sale Act limiting government. SHould there also be something that limits private companies like Google?

Goodlatte says the more opportunities the consumer has to limit this info, the better.

@RepMGS asks whether Americans still have a reasonable expectation of privacy, based on Katz decision.

@LizaGoitein: yes. The question is whether the court will recognize it. SCOTUS is starting to catch up -- Carpenter.

Unfortunately, court limited its holding in Carpenter to only historical location data. What about browsing data? DNA? It could take years for the court to extend it to all those protections. Congress needs to act.

@LizaGoitein notes the broad bipartisan consensus that Fourth Amendment is Not For Sale Act should be passed quickly. This will close loopholes in ECPA and FISA

And Congress should undertake comprehensive privacy legislation. Big project!

@RepMGS brings up concern about data tracking pregnant women's travel and used in procecutions.

@RebeccaWexler notes that it's not only period-tracking apps. Location data, messaging, much more. Don't stop with FANSFA and privacy statute, add evidentiary privilege!

@RepSteveChabot asks Goodlatte about balancing government interests preventing crime and civil liberties.

Goodlatte says it's gotten out of balance, because the way people store their information has changed so dramatically.

@RepRaskin says tech has a momentum of its own, what to do about the assumption that once the data exists, government should have access to it.

@RebeccaWexler: this is why we have evidentiary privileges -- which are very powerful! Could have one for abortion-related travel

@LizaGoitein notes that the government can still get access to the record with a warrant or subpoena -- access through legal process. "This is all about the balance between privacy and law enforcement", as established by the framers.

Raskin: this is the tech equivalent of saying if the government can't enter your home without a warrant, they can't pay somebody to do it.

Goltein: excellent analogy.

Raskin: how big a problem is this?

Goltein: there's no transparency, but we know from investigative reporting and contgressional investigations that this is a widespread practice.

Raskin: sounds like very sensible legislation

Rep. Mclintock: if people agree to terms of service that include disclosure, they don't have to agree with it! I'm old enough to remember when we didn't have this digital technology ...

Goodlatte: it's a separate issue, it'd be good for Congress to look at it.

Mclintock: the important thing is that consumers have notice and choice.

Goodlatte: correct, the Fourth Amendment doesn't apply to that. But you haven't waived your Fourth Amendment right.

Mclintock: but if I've allowed them to sell my information, why can't they sell it to government?

Goodlatte: the Fourth Amendment is directed at the government.

Mclintock suggests that location data doesn't fall under the Fourth Amendment.

Goodlatte: SCOTUS says it does, see Carpenter.

Raskin suggests that maybe it doesn't directly violate the Fourth Amendment to buy the data, we're dealing with the policy question.

Mclintock says they should still be able to sell data.

@RepSwalwell talks about post-Roe world, efforts to track down women who cross state lines, has a lot of concerns. R's have promised that if they win the house, they'll use broad subpoena powers. If Chair Jim Jordan wants to seek patients travel records, could he?

@RebeccaWexler absolutely. An evidentiary privilege could drop that!

Swalwell: is there enough data to identify women seeking abortions? Abortion providers?

Wexler: yes, and HIPAA wouldn't prevent that.

Swalwell: could Jordan subpoena companies that provide travel benefits to women who travel for abortion services?

Wexler: yes.

Swalwell cites Time feature on "crisis preganancy centers". How could they weaponize this data against women?

time.com/6189528/anti-a…

Wexler: any entity that obtains this data can voluntarily hand it to law enforcement. Under some state statutes, the can file civil actions as well.

Swalwell: so they could turn over the data, perhaps as a bounty?

Wexler: yep.

Some sparring between @RepTiffany and @RepSwalwell.

@LizaGoitein: consent isn't informed consent. Apps don't tell you that they disclose deidentified data to third-parties who then disclose to the government and it can be used to identify you. Privacy policies don't say that.

Goitein: Carpenter was very clear that people don't have to choose between Fourth Amendment rights and participating in society.

@JacksonLeeTX18 cites case of a woman prosecuted for a miscarriage. Are pregnant women at risk post-Roe?

Wexler: yes. we need an evidentiary privilege!

Rep. Jackson Lee: very concerned. What about data brokers?

@greenarchives1: they get data from thousands for firms, license it to agencies -- no oversight or supervision

@RepBentz: could this data have prevented tragedies like Uvalde?

Goitein (I think): no. It's always tempting to say it could be the reality is that it can't.

I missed some questions there about warrants, sorry about that.

@RepJayapal talks about concerns on facial recognition, this is why she introduced the Facial Recognition moratorium act. Talks about IRS and 40 states working with ID.me

congress.gov/bill/117th-con…

Asking specific questions about what's available to government.

Login information for all these different sites? yes.
Babel Street? Yes.
Clearview AI? Yes.

14 states do facial recognition scans of drivers license -- including Washington until it was discovered. Are immigrants the only one whose license are being scanned?

Wexler: no, this affects all of us.

How does ICE's use of facial recognition technology impact people's lives?

Lamdan: that's why the title of today's hearing is "dragnet", they pick up all of our data.

@RepJaypal reemphasizes they'll send _everybody's_ data through their system

Lamdan notes that these systems tend to discriminate -- facial recognition disproportionately misidentifies people of color.

Jayapal: federal government has built out a very invasive surveillance infrastructure, including facial recognition.

@RepBurgessOwens passes it to @tolmanbrett, who highlights that the risks are not just to people seeking abortions, but also relate to vaccination status. "It goes back and forth, depending on the political power in DC or the states or local issues"

Tolman: "It should be frightening, and I'm encouraged by the bipartisan support"

@RepGregStanton talks about a man wrongly arrested in Arizona because his location data indicated he was in the vicinity of a shooting. I think that's this story.

phoenixnewtimes.com/news/google-ge…

Stanton asks about the risks of geofence warrants.

@LizaGoitein describes how these warrants get all activities in an area, and the government looks at activities. Even though there's a warrant, there's MAJOR Fourth Amendment problem -- lacks particularity

Stanton asks if they could be used for abortion providers to identify people seeking abortion care.

Goitein: yes. And it will also sweep up lots of others visiting that provider as well.

@alfredwkng has a great article on this.

politico.com/news/2022/07/1…

@RepFitzgerald has a question about FISA. Has law enforcement jumped the guard rails?

Goodlatte: yes. Committee has an opportunity next year to look at FISA Section 702 and tighten access to it.

Fitzgerald: CBP and ICE have spent millions of dollars with data brokers, concern that this info is being gathered and collected on citizens.

@tolmanbrett: no question it's happening.

Discussion of the threat of Tiktok (I missed the details, sorry). "Congress is our last hope to fix it."

@RepDeborahRoss cites Carpenter, recent case quashing geofencing warrant. "users often do not consent to the surveillance. Or, they consent once, while setting up their account, without recognizing how broadly info will be shared."

Asks each witness what one change they'd ask Congress to make to strengthen Fourth Amendment:

Goiten: short-term: pass Fourth Amendment Is Not For Sale Act. And, begin project of comprehensive privacy legislation

Goodlatte: when FISA court issues warrants, almost always only the government making the argument. Also often need somebody representing the public's interest in unlawful investigations. And #1 right now: Pass Fourth Amendment Is Not For Sale

Lamdan: agreed with both. and in addition take another look at Privacy Act of 1974, based on Fair Information Practices.

Wexler: require law enforcement to get exculpatory evidence

@tolmanbrett agrees on FISA, also give IG more power

@RepGregSteube looks at broad use of social media data. Does this lead to sloppineess?

@tolmanbrett yes, no question that using these big databases lead to mistakes

Does it open the door to target political opponents?

Tolman: yes, there's often the case that a target is identified and they reverse-engineer the information they need. A problem no matter who's in power.

Steube says that Pelosi is dubbing right wingers as "domestic terrorists" which opens the door to using the Patriot Act to surveil them.

Tolman: no question that back in 2001 and 2005 DOJ and FBI said most of Patriot Act wouldn't apply to US citizens.

We learned that wasn't the case. And I'm sure that abuse hasn't stopped.

Steube: we'll never know until there's an investigation. DOJ will hide until it's brought out.

And that's it. Whew. Quite a hearing!!!!!

@justinhendrix has an excellent summary of the Digital Dragnets/Fourth Amendment Is Not For Sale hearing @techpolicypress

techpolicy.press/bipartisan-sup…

@threadreaderapp, please unroll when you get a chance