Law Enforcement, Private Enterprise, and Personal Data

The internet era has brought privacy into the forefront of our concerns. But the central issues get too little notice. The following article highlights this neglect.

In a May 2018 article, To catch a killer: Are DNA detectives creating a Brave New World?, updated in June 2019, Julie O'Connor wrote for the New Jersey Star-Ledger Editorial Board:

The Golden State Killer brought terror to the city of Sacramento with a series of spectacularly sadistic rapes and murders, escaping every time, almost taunting the police as he picked his next victims.

But finally, they caught him, at the age of 72, thanks to a sleuthing team of detectives who used a genealogy website to track him down.

The tactic came as a shock to most Americans, who had no idea this was possible.

Yet what most people still don't realize is the threat to privacy this case highlights: Once you submit your DNA to one of these sites, you've effectively lost control of it.

The companies say they set up guardrails, but police have access to this data for the rest of your life. Millions are volunteering their DNA. And even if you don't spit into a vial and send it, a distant cousin could catch you up in a police manhunt.

Now, this case has thrust the issue into the spotlight, much like Cambridge Analytica did for Facebook. It shows just how tentative our grip on privacy really is. 

One expert, John Cohen, a former homeland security official and police officer, defended the police tactic:

And when people decide to hand over their personal information to a private company that profits off it, why should we exclude law enforcement from using these databases to solve crimes? How, Cohen asks, is that in the public interest?

"Why should police be banned from using the same tools available to Cambridge Analytica?" he wonders.

[My emphasis]

O'Connor goes on to make the following equivocation between commercial activity and law enforcement:

And we need government oversight of the companies. Should they be allowed to sell your DNA profile to Big Pharma, which may someday market a drug to you based on your genetic health risks? Maybe you'd rather not know you're prone to Alzheimer's.

I left these comments, edited and expanded for clarity:

There is a dangerous equivocation in the question, "Why should police be banned from using the same tools available to Cambridge Analytica?" The government has a power no private company can have--the power of the gun. Government can compel obedience to its laws. It can seize your wealth. It can throw you in jail. Private enterprise cannot. Private companies cannot harm you, within the law--e.g., barring fraud or breach of contract, upon which the government can prosecute the wrongdoers. Private companies collecting data freely given for commercial purposes does not violate anyone’s rights. 

Government makes the laws. It needs this lawmaking power to fulfil its responsibility to protect us from and prosecute criminals. But it’s for this very reason--its power of the gun--that we have a constitution designed to limit that power; that is, to prevent the government from becoming the criminal.

Giving the same freedom to police to collect our data as Cambridge Analytica amounts to giving the police free reign to search our homes without a warrant. Cambridge Analytica or Facebook or “Big Pharma” should be free to collect our freely given data, so long as it operates within the law--e.g., obeys the government’s privacy and contract laws. They cannot force us. They can only offer us a product. The police, as agents of the state, should be barred from accessing data without a warrant--that is, without “probable cause.” Isn’t there something in the Fourth Amendment about this?

I realize the issue is complex, and the article does call for “rules.” But it’s the equivocation that bothers me. O'Connor is right at the start: It’s government access to our data that we should fear. Government vs. private enterprise are, by their natures, opposites. There is a huge difference between accessing your private data for commercial purposes and accessing for law enforcement purposes. The government can compel. A private firm cannot. 

O’Connor further observes:

But talk to Kimberlee Moran, head of forensics at Rutgers-Camden, and you'll feel leery again.

She believes only the convicted should go into law enforcement DNA databases, not arrestees. That's what they now do in the UK. The European Court of Human Rights ruled it a violation of privacy to keep arrestees who were not found guilty in law enforcement's DNA databases.

But the U.S. constitution doesn't explicitly say we have a right to privacy. And police are navigating a new frontier. They have to get a court order to draw blood from a suspect to get his DNA, or root through his trash. But they apparently searched for distant relatives of the Golden State Killer without one.

[My emphasis.] 

I’m always amazed at people who should know better, such as a reporter, making statements like this about rights in the U.S. Constitution. The constitution doesn’t have to “explicitly say we have a right to privacy.” The Constitution explicitly highlights some of the more important individual rights, such as those listed in the First and Fourteenth Amendments, for example. But the Constitution implicitly protects all rights. The Ninth Amendment reads, “The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people.” 

This is not exactly some obscure point. As the Legal Information Institute of Cornell Law School explains of the Fourth Amendment:

The Fourth Amendment of the U.S. Constitution provides that "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

The ultimate goal of this provision is to protect people’s right to privacy and freedom from unreasonable intrusions by the government. However, the Fourth Amendment does not guarantee protection from all searches and seizures, but only those done by the government and deemed unreasonable under the law.

[My emphasis.] 

In other words, contra Cohen, the police should be banned from using the same tools available to Cambridge Analytica. The Constitution draws a bright red line between government and private entities with regard to searching and seizing the personal information of private individuals, even if such data is freely given and otherwise publicly available. Yet the whole privacy rights discussion routinely sidesteps this crucial red line. If we value our individual rights, we should keep in mind two critical points; the crucial difference between government and private activity, and the fact that the Constitution limits government, not our rights, whether or not the U.S. constitution explicitly says we have that right.

Related Reading:

Facebook/Cambridge Analytica Data Breach Should Not Be a Pretext for Government Controls

The Internet is Not a ‘Surveillance State’

The Dollar and the Gun--Harry Binswanger