A coalition of prominent netizens and watchdogs released its wishlist this week for Digital Due Process.  Google, Microsoft, AT&T, the ACLU, and EFF, among others, are advocating for an update of the 1986 Electronic Communications Privacy Act.  The statute, which includes the current regulations government agencies follow to access an individual’s electronic data and communications, was passed the year after Windows 1.0 was released and five years before the World Wide Web was publicly introduced.  Attempts to shoehorn unexpected emerging technologies into the Act’s framework has led to inconsistent application to the same type of communication across jurisdictions and within the life cycle of the communication (for example, depending on the length of time since a stored email was first read), confusing all parties—government officials seeking information, service providers receiving such requests, and users wanting to know the extent to which their data is protected—and arguably providing insufficient protection. Therefore, the coalition is lobbying Congress to amend the law to reflect modern developments of widespread reliance on email, cloud computing, social networking, and location technologies.  Their list of principles would require warrants—with an exception for emergencies—for disclosure of a communication without regard for where or how it is stored, its age, or whether the service provider itself has access to the information for business purposes.  Location information would also require a warrant.  And the government must have a court order to obtain aggregate information (e.g., data from a non-particularized set of subscribers to a social networking site).

While legislation embodying these principles would clarify limits and valid procedure for U.S. government agents seeking information, it does not ultimately secure user data.  Companies that request or record personal information can sell it or otherwise use it without user authorization.  Hackers can surreptitiously acquire information from sites where it has been collected or archived.  In addition, because the Internet extends across jurisdictions, foreign states have their own rules governing data seizure which may be broader or less certain than U.S. standards.  Finally, the personal information of one person is often disclosed by others, for example on blogs or in online photo repositories.

One way a user can address the first three of these risks and assert a measure of control how his or her data is used or disseminated is to understand what information is being collected, why it is needed, and how security measures are implemented to safeguard it.  Unfortunately, this is often difficult for the average user to assess, especially considering the plethora of apps requesting access and their technical nature.  A new online resource recently launched that harnesses the power of the community to provide this information.  WhatApp compiles a database of apps, mining both the knowledge of technical experts and the experience of users.  Experts rate the apps along dimensions of privacy, security, and openness, based on a specific set of criteria.  Users review the apps on how they work in practice.  Should WhatApp be successful, it may serve not just as a tool to comment on apps, but itself affect change within the app ecosystem.  If a user has a choice of several apps to perform a specific task and makes a decision based on WhatApp’s assessment of their relative privacy and security, app developers will have to take these concerns into account to be competitive.

Both Digital Due Process and WhatApp still have to gain a critical mass to sustain the movements to their completion, whether that be legislation or a comprehensive and useful database of app privacy and security.  But at least initially, they seem to be growing steadily—another promising sign that institutional and individual members of the online community are taking initiative to maintain the Internet as a safe and open environment.  However risks to Privacy 2.0 remain, in particular how to control personal information disseminated broadly by others.  These concerns will require implementing additional ameliorative mechanisms online; JZ suggests data genealogy, reputation bankruptcy, and contextualization of information.

–by Jennifer Halbleib