Hi everybody. My name is Brad

and I'm here to talk to you about privacy.

So just a quick caveat

my views expressed are my own 
not either of my employers,

so impute the crazy only to me.

So I wanna talk to you a little about how

privacy is changing and how the ways

that we think about what is private

has started to morph 
and where I think it's going.

And so my premise to you is we've gone

from the society of privacy
laws to privacy norms

and that we can encapsulate this

with a simple phrase of 
"Not cool bro" or

"bro act" or whatever 
the proper term is

as the case may be. 
So, now, you gonna ask,

What do I mean when I say

"Not cool bro"? So, when I say,

"Not cool bro",
I'll give you an example:

You are on Facebook and

you have a bad break-up or fight with

one of your friends.
And you block

that person and so they 
can no longer see your wall.

Someone else who still has access to your

Facebook wall, goes in, and either

copies and pastes the entire thing,

or takes a screenshot every day

and mails it to that person.

OK, so our initial response is:

That's not cool. Not cool bro! Not cool!

We get the visceral feeling

that that's somehow privacy violation.

We get the feeling that that something

unseemly is happening but we don't know

how to quite talk about it.

And that is what I am talking about by

"Not cool bro" privacy, because the law

doesn't recognize that as a real

privacy interest.

So it first makes a little sense

to talk about what the law does recognize.

And most of our privacy comes from

the criminal context.

All privacy was literally --
you had to sneak up to

someones house and eavesdrop.

So the eaves of the house where water falls.

So you would stand outside

and you would listen.

You would climb over their fence,

shimmy across their lawn,

nozzle up to the side of the house,

maybe like you know poke a hole

on a window and then 
you can eavesdrop.

That's what you had to do

to violate someone's privacy.

So privacy was really about access

to information.

And we didn't need special rules

regulating access to information because

you couldn't violate someone's privacy

in the 1700's, unless you showed up

at their front gate.

Right? There was no Facebook.

The only wall that happened in 1700

was literally the wall

outside the carriage house.

So we go from that to this modern era

or pre-modern era in which we have

ways of getting information

that don't necessarily involve

the traditional structures of space.

So there is a very famous case

involving a guy

who walks into the phone booth

and he closes the door behind him
and then he does some illegal activity

and the police are listening
and they don't have a warrant.

And by the way in the law
you need to get a warrant

before you can listen to any of this stuff.

And for those of you who've seen

CSI or Law and Order -

Big judges who give out warrants
are sometimes like Oprah:

You get a warrant and You get a warrant

and everybody gets a warrant.

(Laughter)

But at least we still have that

nominal process, that the privacy

is still being protected,

right, there is a reasonableness here.

Well, this guy and his name is Kats,

so you can have all sorts of phonetics --
it's spelled with a K.

He had a reasonable expectation

of privacy here. Two types:

It was subjected: meaning

he personally believed that it was private

because he closed the booth behind him.

And then two: objective.

Society as a whole is willing to say,

You know what, yeah, if you are going

into a telephone booth and close the door
that should be private.

Now, what about if we apply this to Facebook?

Right? This is the "not cool bro"
version of privacy.

You just take it one more step.

In the old version of privacy,

it's all about control over

the means of accessing information.

In the new version of privacy,

it's all about control over

who can get the information
that you give it to?

So in the old version of privacy,
if I tell someone,

"Hey I got an F on a test."

That person can tell anyone else

and it's not really considered

a violation of privacy.

I didn't keep it private,

because I allowed someone else access.

In the new version of privacy,

when you post something
to your Facebook wall,

if you prevented the rest of the world
from seeing it,

is there an implied understanding to
anyone else you've given access to

that they shouldn't re-share it?

Or another example:
If you are on Twitter

and you've got a protected Twitter stream

that no one can see

unless they expressly follow you
and you allow them.

And someone just sort of re-tweeting

all of your protected tweets.

You would say the exact same thing.

But the understanding would've been:

Wait a minute, I only let you see

my Twitter stream, because

I thought you weren't going to re-tweet it.

You violated some sort of implied understanding
we had.

So, now we have our modern eavesdropper,

who is in your Facebook wall

posting again. So this is

our modern eavesdropper overhearing

in conversation. So how do we get

to a place in which the law

can come up to where we are.

Because we think of this,
new norm, this new idea

you won't re-share something

I only share with you.

How do we get there?

And there is actually an interesting way

and I'll take it back a little bit
to give you an example.

When Facebook started out

you had to be a member of a network

to just look at someone's profile.

And I remember having a job,

where someone in HR knew
that I went to Yale

and sent me an e-mail
and said:

Brad, we know you went to Yale,

could you log into Facebook
and print out a copy

of this applicant's Facebook page?

We'd like to see it.

So, by the way, for those of you

who thought that didn't happen,
it was happening in 2004.

So you better believe it's happening now.

That said, I recoiled in like
shock and horror.

I was like that would be a violation
of that person's privacy.

It would be a betrayal of trust.

But the idea was back then,
what happened in the Yale network,

stayed in the Yale network.

It's kind of like Vegas. 
(Laughter)

And so, there was a knowledge
that was like,

Hey, not cool, bro!

You knew that you only had access to this.

There was a reciprocal understanding.

You won't tell other people
what goes on in the Yale network,

and I won't tell other people
what goes on in the Yale network.

And so, if you think about it

there is an implied commitment

when you join any of these social networks,

that if you are not supposed

to re-share information, you won't.

And there is another area of the law

that actually has really
had this transformation,

where they went from a very formal --
you have to be explicit understandings --

to just anything goes.

And that's products liability.

As crazy as this may sound

there was a time where if you bought

a can of coca-cola and it blew up
in your hand as you were drinking it.

The only person you could sue

was the bodega or bodegua,

as the case may be, that you bought it from.

And over time courts sort of didn't like this.

They said, Well, there is an implied contract

between the original manufacturer
and each step in the chain

of distributions until to the ultimate consumer

does not need to be
in contractual privity

with the original manufacturer.

Which is the fancy way of saying:

We are going to say 
that there is an implied contract

that runs all the way
through all these steps in the middle.

And when you finally buy
that can of coke,

you get an implied contract from Coke.

Finally a court in California said,
Enough, is enough.

We are done pretending,
we are done making up

these implied contracts.

We are just gonna say
strict liability applies

if you make a product
and you put it out in the universe.

You have a reasonable understanding

that if somebody gets hurt
by that product

they are going to sue you.

We can do the exact same thing
with privacy.

If you join a social network,

Facebook, Twitter, Google+

and you join that network
knowing that there are privacy settings

and knowing that other people
are sharing information with you,

but at the same time
prohibiting other people

from accessing that information.

It's a violation of whatever
you wanna phrase it as.

Wouldn't that person's
expressed understanding

that they would only share
the information with you

if you didn't re-share it.

Now, we can get there without
waiting, for example,

Facebook could put a little lock
or a hash icon on every post

on every element of Facebook
that's been shared with you

that would let you know
whether or not it was public,

whether or not it was OK to re-share.

Twitter already does this.

You can not one click re-tweet
a protected tweet.

And Craigslist has code-matching that
will actually look at posts

you've previously made
and if you're re-posting

similar content it will stop you.

Facebook and Twitter
could do the exact same thing

if they see you trying
to use copy and paste

to get around these mechanisms.

The other thing they could do is,

we could amend our terms of service,

we could make an expressed term of service

to re-share information
that is not supposed to be re-shared.

Like on Google+,
where you can actually click

"Disable re-sharing"
and then no one else can.

So there is a sense
that we can get there.

We also can maybe get there in law.

It won't necessarily happen

right away, but in a recent case

the Supreme Court is starting
to go there.

In the Jones case,
which dealt with GPS.

Justice Sotomayor said maybe it's time

that we start to rethink this notion

that if you share something

with one person it is no longer private.

Because our societal expectations
have changed.

We've moved from law to norms.

The norms of not-cool-bro-to-re-share
are how we now think about privacy.

And as a result our law
is lagging behind a little bit.

And although we are not there yet
with our laws,

we have inter measures
we can use from code.

So the interesting thing
to see is where we head

now that we are a society of norms

and when we think about privacy
as norm-based.

(Applause)