In the United States we enjoy a feeling of comfort from knowing that the government generally needs a warrant to pry deeply into our lives. There have been arguable exceptions, but overall the mood is that those protections have held.
Our ad based internet has resulted in a rich market for user data that has ultimately created a massive loophole in those 4th Amendment protections from undue government surveillance. The government can just buy our data on the open market. And the ease with which that loophole is exploited is only going to accelerate thanks to sophisticated AI sifting through all that sensitive information.
To be online is to accept that “our data” is out there. But we don’t really care. Who cares if the virtual beer app sends my location data home every time I want to wow a date?
Well, no one. But in the aggregate, the location of everyone who has ever dazzled their friends with a simulated beer becomes something more interesting. That’s a bundle of data showing the habits of a particular group of people. At some point the app’s creators, perhaps sensing the interest in virtual beers has peaked, decide they need to diversify their revenue streams. And that data, originally collected for in-app advertising, gets packaged up and sold.
One potential buyer is a Data Broker. Their business model relies on the accumulation of as much data on as many people as possible. They gather records from advertising exchanges, apps, retailers, credit bureaus, public filings, loyalty programs, websites, and even other brokers. They then connect those fragments using digital markers like cookies.
The result is much more valuable than the location of the beer app’s users. It’s a profile of a particular person: where they live, where they work, where they travel, their interests, and even who they spend time with. When a broker does not know something directly, they may still know enough to infer it. For the most part this type of aggregation and analysis is completely legal.
Those profiles are then sold to advertisers, compliance departments, insurance agencies, and increasingly, the government.
Usually when the government demands sensitive information from a company, it may require a court order. These orders can be broad but usually have limitations in scope and must invoke some legal authority. However, when a private company has already collected the data and is happy to sell it, then the government does not need a warrant. It is simply engaging in a typical commercial transaction in the open market.
When you consent to sharing your data, by quickly clicking “agree” to a Terms-of-Service, or even ignoring that cookie warning on every site, you are not just sharing your data with that site or even just its advertisers; you are sharing your data with everyone, even the government. And they have gotten a whole lot better at connecting those dots with AI.
Commercial databases can be correlated to create dossiers on people that go far further than anything the government could legally collect:
AI is also being used to rip data out of previously siloed or difficult to use sources for the purposes of building such tools. Like in this example:
We have written about this before as the death of practical obscurity:
In 1989 much of your life was already on file. It just wasn’t in any one file.
Your deed sat in one county’s recorder office. The lawsuit from your twenties sat in a courthouse two states away. Your voter registration, your divorce, the news blurb about you from a local paper — each was a public record, open to anyone willing to track it down. But tracking it down was riddled with hurdles. Putting a person together from those pieces meant travel across geography, navigating bureaucracies, paying clerks and investigators, and asking questions of people disinclined to answer. The cost of infringing on an ordinary person’s privacy was so high that, outside the famous and the suspected, it was rarely paid.
Government surveillance used to be limited by both the amount of work it took to track the movements of a single person and protections of the 4th amendment. AI completely eliminates that first part, and the robust market for the digital breadcrumbs AI can use makes it trivial to sidestep the second. The warrant has been replaced by an invoice.
The ability of AI to correlate our digital traces will require a broader reckoning in society. Now something as mundane as a Zillow picture leftover from when your house was previously listed for sale can be enough to pinpoint your address. Even if you don’t fear the government, the availability of such a granular database is terrifying in itself. If this company selling the service to law enforcement can build this, so can a criminal network.
There’s no way to undo the data we’ve already leaked. But this new threat should accelerate the adoption of privacy preserving tools to limit further damage. For a start, maybe we should all start blurring our zoom backgrounds. -Neeraj
Read more:
Uncovering Webloc - An Analysis of Penlink’s Ad-based Geolocation Surveillance Tech
FBI is buying location data to track US citizens, director confirms
ATF cancels phone tracking contract after lawmakers raise concerns
Wyden Releases Documents Confirming the NSA Buys Americans’ Internet Browsing Records
American Dragnet: Data-Driven Deportation in the 21st Century
What else we’re reading:
If you found this interesting, please share and subscribe. It helps us grow.