Hi everybody. My name is Brad
and I'm here to talk to you about privacy.
So just a quick caveat
my views expressed are my own
not either of my employers,
so impute the crazy only to me.
So I wanna talk to you a little about how
privacy is changing and how the ways
that we think about what is private
has started to morph
and where I think it's going.
And so my premise to you is we've gone
from the society of privacy
laws to privacy norms
and that we can encapsulate this
with a simple phrase of
"Not cool bro" or
"bro act" or whatever
the proper term is
as the case may be.
So, now, you gonna ask,
What do I mean when I say
"Not cool bro"? So, when I say,
"Not cool bro",
I'll give you an example:
You are on Facebook and
you have a bad break-up or fight with
one of your friends.
And you block
that person and so they
can no longer see your wall.
Someone else who still has access to your
Facebook wall, goes in, and either
copies and pastes the entire thing,
or takes a screenshot every day
and mails it to that person.
OK, so our initial response is:
That's not cool. Not cool bro! Not cool!
We get the visceral feeling
that that's somehow privacy violation.
We get the feeling that that something
unseemly is happening but we don't know
how to quite talk about it.
And that is what I am talking about by
"Not cool bro" privacy, because the law
doesn't recognize that as a real
privacy interest.
So it first makes a little sense
to talk about what the law does recognize.
And most of our privacy comes from
the criminal context.
All privacy was literally --
you had to sneak up to
someones house and eavesdrop.
So the eaves of the house where water falls.
So you would stand outside
and you would listen.
You would climb over their fence,
shimmy across their lawn,
nozzle up to the side of the house,
maybe like you know poke a hole
on a window and then
you can eavesdrop.
That's what you had to do
to violate someone's privacy.
So privacy was really about access
to information.
And we didn't need special rules
regulating access to information because
you couldn't violate someone's privacy
in the 1700's, unless you showed up
at their front gate.
Right? There was no Facebook.
The only wall that happened in 1700
was literally the wall
outside the carriage house.
So we go from that to this modern era
or pre-modern era in which we have
ways of getting information
that don't necessarily involve
the traditional structures of space.
So there is a very famous case
involving a guy
who walks into the phone booth
and he closes the door behind him
and then he does some illegal activity
and the police are listening
and they don't have a warrant.
And by the way in the law
you need to get a warrant
before you can listen to any of this stuff.
And for those of you who've seen
CSI or Law and Order -
Big judges who give out warrants
are sometimes like Oprah:
You get a warrant and You get a warrant
and everybody gets a warrant.
(Laughter)
But at least we still have that
nominal process, that the privacy
is still being protected,
right, there is a reasonableness here.
Well, this guy and his name is Kats,
so you can have all sorts of phonetics --
it's spelled with a K.
He had a reasonable expectation
of privacy here. Two types:
It was subjected: meaning
he personally believed that it was private
because he closed the booth behind him.
And then two: objective.
Society as a whole is willing to say,
You know what, yeah, if you are going
into a telephone booth and close the door
that should be private.
Now, what about if we apply this to Facebook?
Right? This is the "not cool bro"
version of privacy.
You just take it one more step.
In the old version of privacy,
it's all about control over
the means of accessing information.
In the new version of privacy,
it's all about control over
who can get the information
that you give it to?
So in the old version of privacy,
if I tell someone,
"Hey I got an F on a test."
That person can tell anyone else
and it's not really considered
a violation of privacy.
I didn't keep it private,
because I allowed someone else access.
In the new version of privacy,
when you post something
to your Facebook wall,
if you prevented the rest of the world
from seeing it,
is there an implied understanding to
anyone else you've given access to
that they shouldn't re-share it?
Or another example:
If you are on Twitter
and you've got a protected Twitter stream
that no one can see
unless they expressly follow you
and you allow them.
And someone just sort of re-tweeting
all of your protected tweets.
You would say the exact same thing.
But the understanding would've been:
Wait a minute, I only let you see
my Twitter stream, because
I thought you weren't going to re-tweet it.
You violated some sort of implied understanding
we had.
So, now we have our modern eavesdropper,
who is in your Facebook wall
posting again. So this is
our modern eavesdropper overhearing
in conversation. So how do we get
to a place in which the law
can come up to where we are.
Because we think of this,
new norm, this new idea
you won't re-share something
I only share with you.
How do we get there?
And there is actually an interesting way
and I'll take it back a little bit
to give you an example.
When Facebook started out
you had to be a member of a network
to just look at someone's profile.
And I remember having a job,
where someone in HR knew
that I went to Yale
and sent me an e-mail
and said:
Brad, we know you went to Yale,
could you log into Facebook
and print out a copy
of this applicant's Facebook page?
We'd like to see it.
So, by the way, for those of you
who thought that didn't happen,
it was happening in 2004.
So you better believe it's happening now.
That said, I recoiled in like
shock and horror.
I was like that would be a violation
of that person's privacy.
It would be a betrayal of trust.
But the idea was back then,
what happened in the Yale network,
stayed in the Yale network.
It's kind of like Vegas.
(Laughter)
And so, there was a knowledge
that was like,
Hey, not cool, bro!
You knew that you only had access to this.
There was a reciprocal understanding.
You won't tell other people
what goes on in the Yale network,
and I won't tell other people
what goes on in the Yale network.
And so, if you think about it
there is an implied commitment
when you join any of these social networks,
that if you are not supposed
to re-share information, you won't.
And there is another area of the law
that actually has really
had this transformation,
where they went from a very formal --
you have to be explicit understandings --
to just anything goes.
And that's products liability.
As crazy as this may sound
there was a time where if you bought
a can of coca-cola and it blew up
in your hand as you were drinking it.
The only person you could sue
was the bodega or bodegua,
as the case may be, that you bought it from.
And over time courts sort of didn't like this.
They said, Well, there is an implied contract
between the original manufacturer
and each step in the chain
of distributions until to the ultimate consumer
does not need to be
in contractual privity
with the original manufacturer.
Which is the fancy way of saying:
We are going to say
that there is an implied contract
that runs all the way
through all these steps in the middle.
And when you finally buy
that can of coke,
you get an implied contract from Coke.
Finally a court in California said,
Enough, is enough.
We are done pretending,
we are done making up
these implied contracts.
We are just gonna say
strict liability applies
if you make a product
and you put it out in the universe.
You have a reasonable understanding
that if somebody gets hurt
by that product
they are going to sue you.
We can do the exact same thing
with privacy.
If you join a social network,
Facebook, Twitter, Google+
and you join that network
knowing that there are privacy settings
and knowing that other people
are sharing information with you,
but at the same time
prohibiting other people
from accessing that information.
It's a violation of whatever
you wanna phrase it as.
Wouldn't that person's
expressed understanding
that they would only share
the information with you
if you didn't re-share it.
Now, we can get there without
waiting, for example,
Facebook could put a little lock
or a hash icon on every post
on every element of Facebook
that's been shared with you
that would let you know
whether or not it was public,
whether or not it was OK to re-share.
Twitter already does this.
You can not one click re-tweet
a protected tweet.
And Craigslist has code-matching that
will actually look at posts
you've previously made
and if you're re-posting
similar content it will stop you.
Facebook and Twitter
could do the exact same thing
if they see you trying
to use copy and paste
to get around these mechanisms.
The other thing they could do is,
we could amend our terms of service,
we could make an expressed term of service
to re-share information
that is not supposed to be re-shared.
Like on Google+,
where you can actually click
"Disable re-sharing"
and then no one else can.
So there is a sense
that we can get there.
We also can maybe get there in law.
It won't necessarily happen
right away, but in a recent case
the Supreme Court is starting
to go there.
In the Jones case,
which dealt with GPS.
Justice Sotomayor said maybe it's time
that we start to rethink this notion
that if you share something
with one person it is no longer private.
Because our societal expectations
have changed.
We've moved from law to norms.
The norms of not-cool-bro-to-re-share
are how we now think about privacy.
And as a result our law
is lagging behind a little bit.
And although we are not there yet
with our laws,
we have inter measures
we can use from code.
So the interesting thing
to see is where we head
now that we are a society of norms
and when we think about privacy
as norm-based.
(Applause)