Your Browser History: How Recent ISP Legislation Affects Privacy

Episode Notes

Transcript

Lawyer 2 Lawyer – Law News and Legal Topics

Your Browser History: How Recent ISP Legislation Affects Privacy

04/14/2017

[Music]

Ernesto Falcon: This is why you have a whole host of states now introducing their own broadband privacy bills, from New York, to Washington, to even Texas, because people care about this stuff. People really do feel that there is this fundamental relationship with their ISP. That’s different than their email provider. That’s different than social media. That’s different than any really online service that they choose or choose not to use, because they have to use their ISP in order to get access to the Internet at the end of the day.

Alden F. Abbott: Critics who are saying that this is some sort of great harm to consumers are not making a correct representation; in fact, they are misrepresenting things.

[Music]

Intro: Welcome to the award-winning podcast Lawyer 2 Lawyer with J. Craig Williams and Robert Ambrogi, bringing you the latest legal news and observations with the leading experts in the legal profession.

You are listening to Legal Talk Network.

[Music]

J. Craig Williams: Welcome to Lawyer 2 Lawyer on the Legal Talk Network. I am Craig Williams coming to you from Southern California. I write a legal blog called May It Please the Court.

Bob Ambrogi: And this is Bob Ambrogi out of Massachusetts. I write a blog called LawSites. I also co-host another Legal Talk Network program called Law Technology Now, alongside Monica Bay.

And before we introduce today’s topic, we would like to take just a moment to thank our sponsors Clio and Litéra.

Clio’s cloud-based practice management software makes it easy to manage your law firm from intake to invoice. Try it for free at  HYPERLINK “http://www.clio.com” clio.com.

And Litéra is the authority on document creation, collaboration and control. Increase your productivity, collaborate securely and ensure protection of your vital information. Learn more at HYPERLINK “http://www.litera.com” www.litera.com.

J. Craig Williams: Well, on April 3rd, 2017, President Trump signed into law a controversial measure repealing online privacy protections that were established by the FCC under the Obama Administration and almost ready to go into effect. This legislation allows Internet providers or ISPs to sell customer data without the customers consent.

Bob Ambrogi: Supporters of this legislation believe that keeping browsing information private would stop innovation, where opponents voice their concerns over the privacy protections of customers and users.

J. Craig Williams: So today on Lawyer 2 Lawyer we are going to take a look at the passing of this legislation involving Internet service providers and web surfing data. We will take a look at this controversial legislation, the privacy issues, and the potential ramifications and impact on customers.

Bob Ambrogi: To help us explore this issue today we have two guests. First of all, I would like to introduce Ernesto Falcon, Legislative Counsel at the Electronic Frontier Foundation, with a primary focus on intellectual property and open Internet issues.

Prior to joining EFF, Ernesto worked as a legislative staffer for two members of Congress during the years 2004-2010. He then became Vice President of Government Affairs at Public Knowledge, where he advocated on behalf of consumers on copyright issues and broadband competition.

During his tenure Public Knowledge was successful in achieving one of the largest consumer victories in telecom policy by defeating AT&T’s merger with T-Mobile.

Welcome to Lawyer 2 Lawyer Ernesto Falcon.

Ernesto Falcon: Thank you for having me.

J. Craig Williams: And Bob, our next guest is Alden F. Abbott. He is the Rumpel Senior Legal Fellow and Deputy Director of the Meese Center for Legal and Judicial Studies at The Heritage Foundation. Alden previously served as the Director of Patent and Antitrust Strategy for BlackBerry and in a variety of senior government positions, including the Director of Antitrust Policy for the FTC, Acting General Counsel of the Commerce Department, Chief Counsel for the National Telecommunications and Information Administration, and Senior Counsel in the Justice Department.

Alden is also an Adjunct Professor at George Mason Law School, a member of the Leadership of the American Bar Association’s Antitrust Section, and a Non-Governmental Advisor to the International Competition Network.

Welcome to the show Alden.

Alden F. Abbott: Well, thank you very much.

J. Craig Williams: So how did this, if we can get a little bit of an overview perhaps from you Alden, how did this bill get into place, what was the background, the rationale from the Obama Administration and why is Congress and President Trump making this change.

Alden F. Abbott: Well, the history really is that, first of all, it’s a mistake to say that Internet privacy regulation, federal regulation, and oversight did not exist. The background has existed for many, many years under the Federal Trade Commission, which is a leading federal consumer protection agency.

(00:04:59)

Now, the Federal Communications Commission, in a 3:2 vote highly contested decision decided to impose privacy regulation on broadband Internet access service providers. That is the big firms that provide Internet access. Now, there are a couple of things troublesome about this. I won’t get into the argument of it was beyond its authority, but even assuming it was under its authority, in doing so it created two tiers.

It created lots of companies like Google, Amazon, all sorts of companies that interact on the Internet and got a lot of private information from consumers, who were not subject to this special regulation, but it imposed a very much tighter set of regulations really on Verizon, AT&T, other providers of services, so that for starters is sort of troublesome tat you have people asking you for your information subject to two different privacy regulatory regimes.

Second, it ignored, as I said, it ignored the economic analysis and learning that suggested, hey, what it could do would create disincentives for, by in effect requiring consumers to opt into almost any use of their data. It created disincentives for the investment in new services by the Internet service providers and quality of service improvements. In fact, it imposed sort of a very strict regulatory regime on a certain number of providers.

After it was enacted with a lot of controversy and subject to potential legal challenges, it was basically undone by a majority act of Congress under something called the Congressional Review Act. And the Congressional Review Act, which actually was enacted during the Clinton Administration 21 years ago, says that Congress has a right within, I think it’s 60 legislative days after regulation is finalized to review the regulation and basically by majority vote and receive the signature of the President to undo it.

And under that Congressional Review Act over the last couple of months there have been lot of regulatory provisions that have just been enacted, which fell under the law that had been overturned by Congress. And I think the reasons for overturning it made perfect sense, because as I say, it created a sort of discriminatory system. It paid no heed to the economics of privacy.

And by the way, this does not mean that consumers are going to be without protection. Indeed the new Chairman of the FCC and Acting Chairman of the FTC, Federal Trade Commission on March 1st agreed that they would work together to come up with common approaches to protect consumer privacy over the Internet.

So in short, I think critics who are saying that this is some sort of great harm to consumers are not making a correct representation; in fact, they are misrepresenting things.

Bob Ambrogi: Ernesto, you just heard Alden’s position on this. What’s your take on this legislation and its effect on consumer privacy?

Ernesto Falcon: Certainly. So we will have very differing opinions on this, namely, let’s think about the — let’s start with the history. We talk about — there’s a lot of talk about how the Federal Trade Commission was somehow the only entity ever to exist to handle privacy, which begs the question, why did Congress create the Communications Privacy Provisions of the Communications Act, which applied to broadband, then didn’t apply to broadband, and then did apply to broadband, if you followed the classification and reclassification debate that happened between the last, give or take, 10 plus years.

That being said, the reason why the FCC has a rule that applies to communications companies, common carriers, is the fact that Congress created it. I mean, that is the law that Congress created under the Communications Act of 1996, which is telecommunications carriers are subject to Section 222 of the Communications Act, which is essentially the authority that the FCC relies on for its privacy rules.

So a lot of times I think people take issue of the FCC looking at ISPs differently when they seem to forget that the source of that differentiation was Congress, Congress made that choice. If they have an issue with that, they should change the law, not make it sound like it’s somehow this unelected bureaucracy that created the distinction.

The other issue, I think a lot of discussion about the Federal Trade Commission also has to take into account the common carrier exclusion under the Federal Trade Commission Act, which has essentially played out recently last year at a Ninth Circuit Case, FTC v. AT&T Mobility, where the Ninth Circuit found that the Federal Trade Commission has no real oversight power over AT&T, because of its common carrier status as a telephone company. This is even prior to reclassification of its broadband services, because of its status as a common carrier.

(00:10:08)

So when I see arguments that the Federal Trade Commission will kind of leap in and save us and fill in the void or resolve these issues, it ignores the legal work that AT&T lawyers have done at the Ninth Circuit, but undoubtedly, they will attempt to replicate every time the FTC takes action against the telephone company or Comcast or the other cable companies will look to and point to as persuasive interpretation of the FTC Act as a means to shield themselves from Federal Trade Commission Authority.

So now you have a bill that Congress passed, the Congressional Review Act, as it was correctly described, like what it was, this is in response to 10:47 essentially, a way to have a legislative process that repeals rules and regulations.

No one can tell you exactly the ramifications of what will happen when the fateful day of when one of these federal agencies has to confront the repeal on the grounds of the other part of what the CRA does, which is prohibits any substantially similar rule from taking effect.

To what extent does a judge read the law to think about what is substantially similar, no one has any case law, because it has never been tested. They can read it very narrowly and perhaps a change in the market will allow a rule that looks similar to a rule in the past to take effect, but because the market has changed dramatically it’s effectively not the same rule, because it’s different situations.

Or you read it much more extensively, a judge could read it as, not only can you create any rule in terms of the FCC broadband and privacy context, the FCC cannot enforce Section 222 in a way that effectively looks like the rule, namely looking at the consumer consent provisions of broadband companies.

Say a cable company wanted to do something with browsing information and without permission from a customer and the FCC wishes to invoke Section 222, its privacy authority to discipline the company and force the law in some sense. Without a doubt that entity as a defendant will raise the CRA as the defense saying the Congress has spoken you are not allowed to use Section 222 in this manner. Again we don’t know the outcome of that.

And it’s that overhang and that cloud that’s creating a repeal as well as a preclusion on the agency from taking further action that essentially has created the gap. This is why you have a whole host of states now introducing their own broadband privacy bills, from New York, to Washington, to even Texas, because people care about this stuff. People really do feel that there is this fundamental relationship with their ISP. That’s different than their email provider. That’s different than social media. That’s different than any really online service that they choose or choose not to use, because they have to use their ISP in order to get access to the Internet at the end of the day.

And in most parts of this country, outside of Washington DC, where in their neighborhoods they have three choices, lots of people only have one choice when you talk about high speed Internet access, and it’s that friction and that lack of choice that has created the response that people have had to Congress repealing broadband privacy rules.

Bob Ambrogi: Does it go farther? Do the privacy concerns with regard to an ISP go farther than what Google can track through our browsing or whatever else?

J. Craig Williams: Yeah, how granular is this information? Is Google supposedly through Alexa and the other services can record everything you say?

Ernesto Falcon: If I may, at the Electronic Frontier Foundation we have developed a lot of tools that shield your exposure to edge providers. There’s ways you can block ads, there’s ways you can block tracking on your web browser, block the installation of that on your machines.

We do not have a real clean way to block the Internet Service Provider, because you have to tell them where you are going, you have to tell them where you want to go. And HTTPS everywhere, which is essentially the encryption standard for websites, that’s helped a lot in the sense that the ISP can’t see the information or the content that you are transmitting because it’s encrypted, but they still know where you are going. They still know it’s at the top level.

So in some sense, there is a real difference on technological matter because you could effectively shield yourself from Facebook or Google in a way that prevents them from seeing what you are doing. Absent using a really robust virtual private network and paying money for that, there is no way to block the ISP in its totality from kind of piecing together all the pieces of your activity online.

J. Craig Williams: Alden, do you see it that way, do you see that the privacy concerns are different with regard to the ISPs than with regard to other kinds of — with regard to web browsing and companies such as Google?

(00:14:52)

Alden F. Abbott: Actually, I think you hit on an excellent point. The fact is typically Google, Amazon, lots of these sites will demand all sorts of personal information far in excess, sorts of information that the broadband Internet service providers typically request.

And I don’t want to get into legalities, but I respectively think that one looks at Section 222 of the 1992 Act, it only covered, empowered the FCC to regulate customer proprietary network information over voice telephony; voice telephony is a phrase they used, not broadband.

And indeed I will say, I was the career lawyer in the Clinton Administration and there was no understanding whatsoever that broadband would be treated as a common carrier, with good reason. I think the Clinton Administration understood that a vibrant unregulated broadband, and it was in its earlier forms, not the type of broadband you have now, it was critical to the growth of the Internet and they were quite correct about that.

So it takes a heroic and in my view absurd interpretation of Section 222 to justify what the FCC did, but again, this is a sort of a lawyer’s argument. I think the fact is one can say all you like about filters.

J. Craig Williams: You can use lawyer’s arguments on this show.

Alden F. Abbott: Yes. So I think the argument that the FCC was clearly authorized and Congress intended, that is nonsense, very honestly, and with all due respect, Congress did not at all refer to broadband as being subject to the sort of Section 222 regulation that the FTC thought it was subject to a year or two ago, and that was a narrow 3:2 majority of the FTC.

I have got to say that, again, the Clinton Administration FCC I think had a very different understanding of that. In fact, the FCC always had a different understanding until just a couple of years ago.

And by the way, until a couple of years ago it was never anticipated that broadband would be characterized as common carriage. I think in November 2014 President Obama suggested, and this was in connection with net neutrality that common carriage might be a way to go in, but very frankly, I think that most neutral commentators I think were skeptical about legal justifications for that; nevertheless, the FCC did it.

But now, again, I will just note that the Federal Trade Commission has entered into a number of consent decrees based on egregious violations of privacy by your Googles, your Facebooks, other edge providers from whom you can supposedly shield your information.

So the fact is you may try and shield the information, but edge providers’ record in privacy is not necessarily the best. In fact, I would argue it’s a lot worse than these broadband Internet service providers has been.

So again, in all due respect, I recognize that there’s a contrary argument than that and I have great respect for EFF and their beliefs in open Internet, but I just think as a matter of law and as a matter of fact, the story is quite different.

Bob Ambrogi: All right. Please stay with us Alden and Ernesto and our listeners, we are going to take a short break and hear a few words from our sponsors and we will be right back.

[Music]

Advertiser: Imagine what you could do with an extra 8 hours per week. That’s how much time legal professionals save with Clio, the world’s leading practice management software, with intuitive time tracking, billing, and matter management. Cleo streamlines everything you do to run your practice, from intake to invoice. Try it for free at  HYPERLINK “http://www.clio.com” clio.com.

[Music]

Bob Ambrogi: Documents are the currency of business. They represent you in every business interaction. Executives need to know what changes have occurred in documents, what metadata risks exist and how to encrypt, share and collaborate securely.

Litéra simplifies the document creation and collaboration process to protect you from risk and loss of reputation. Litéra offers better solutions for document lifecycle management so you can focus on doing what really matters;  HYPERLINK “http://www.litera.com” www.litera.com.

Bob Ambrogi: Welcome back to Lawyer 2 Lawyer. This is Bob Ambrogi and with us today is Ernesto Falcon, Legislative Counsel at the Electronic Frontier Foundation, and Alden F. Abbott, Rumpel Senior Legal Fellow and Deputy Director of the Meese Center for Legal and Judicial Studies at The Heritage Foundation.

And we are talking about legislation involving privacy, ISPs, being able to sell our web browsing, our Internet usage activity.

Ernesto, Verizon has issued a statement saying we do not sell the personal web browsing history of our customers. We don’t do it and that’s the bottom line. What should we expect from ISPs? Are we going to be seeing this history sold or is this a threat that isn’t going to be carried out?

(00:20:04)

Ernesto Falcon: I will speak to that. I just want to respond a bit to a comment earlier. As a matter of law, as a matter of the DC Circuit, broadband companies are telecom carriers and telecom carriers are regulated under Section 222 of the Communications Act.

DSL in its early days was a Title II service until the FCC decided to classify it as a Title I service, and that led to the Brand X case. I mean, there’s a long tortured history about kind of the legal status of broadband companies and falling in and out of whether they are regulated in a certain way, particularly in the privacy authorities.

And even when they were all considered information services, the FCC still had this theory called ancillary jurisdiction, which Comcast defeated in Comcast v. FCC, that there is some sort of cross-pollination hook with Title II authorities to effectively carry out the duties that the FCC has been given by Congress.

So it’s not as clear-cut as saying Communications Act was created just for telephone and that was it. This is a lawyer show. So it is much, much more complex than that, and I don’t think there has ever been a time where the Federal Communications Commission proactively said they have no real way to have oversight or any sort of authority over broadband companies.

That’s starting to change I think nowadays. I think FCC Chairman Pai has an intent to relinquish legal authority in exchange for promises by the companies, and this ties to your question on Verizon. There’s a media report that says that after meeting with the cable and the telephone industry, Chairman Pai intends to essentially reclassify back into an information service broadband companies and cable telephone companies, which would under all the cases that have been litigated up to this point essentially give the FCC the ability to ask for some basic transparency, I suppose, but not much else in terms of its oversight with broadband companies.

And we would effectively then have to rely on the promises of these companies to not do harm to the open Internet despite the extraordinary value in controlling the Internet experience, controlling what people go to, what websites are the preferred destination. There’s just enormous value in being able to dictate that future that has grown more valuable as more people use the Internet.

So I think when the companies say things like we won’t sell personal, identifiable information, or we won’t sell individual’s browsing history, sometimes I think they parse words in a way that give you an impact or give you the perception that that means they are hands off on all of it. When in reality, they will use your information in a way that will make people uncomfortable when they dissect the dynamic.

I mean, they will still collect your information and put it together in type of aggregate profiles and then sell demographic information to an advertiser or whatever bidder, whoever wants to pay the highest fees for that information.

If you want to be able to reach an audience that fits this demographic, has these conditions, or this age and this behavior, that’s what they would like to sell. I mean that’s the kind of general information they would like to sell, and that will have to be collected and stored somewhere.

So these are the things that people don’t like. I mean, these are the reasons why people are upset with what Congress did, because at the end of the day, they would have liked to have had the choice. They would like to have said, give me a reason why you want that and then I will decide, which is essentially what the FCC did. The FCC didn’t ban the practices that they want to engage in; it just made it so that the customer, the consumer who already pays these companies a subscription fee, would have a choice, the choice to say yes or no as a legal matter, as a legal right.

Bob Ambrogi: Are there any restrictions on the sale of this information? I mean realistically, could people that really want to hack you by this information and could we as customers go out there and buy say for example Congress’ representatives browsing history information and publish it?

Ernesto Falcon: So I think there’s a very funny campaign out there about like, I want to buy each member of the Congress’ personal browsing history. No one is going to ever sell that. I don’t think that’s what’s going to happen.

I do think that the day will come and it’s going to be malicious actors and hackers and potentially foreign state actors who will get access to the information through illegal means, this won’t be a lawful act, and we are going to have a situation where like someone is running for office and their most sensitive secrets of what they do online will be connected to them in some way based on data that will be stolen and then released to the public. These are the dangers we start inviting when we encourage this type of kind of new way of monetizing and collecting information. These are the kind of things that for the most part Congress has restricted through Section 222.

I think we do under a new realm of what’s to happen next, that no one will be able to easily predict.

(00:24:55)

Bob Ambrogi: Well, gentlemen, we have just about reached the end of our program. It’s time to wrap up and get your final thoughts along with your contact information so our listeners can reach out to you if they would like to.

So Ernesto, let’s start with you.

Ernesto Falcon: Sure. Feel free to email me at  HYPERLINK “[email protected]” [email protected] and on EFF.org we often blog on these issues for folks to follow along. The legal team at EFF regularly works on a whole host of issues that impact Internet, technology, surveillance, and your privacy, and tries to keep the public informed.

I think this is going to be a long-term debate. I mean, we are seeing round 1 and this is something that I think has caught attention and caught a lot of energy and fire kind of amongst all walks of life. You don’t have to be of one political persuasion or another to care about your data, your choice.

So I suspect we will see a lot of debates at the state legislatures. I think a few of these states will pass laws and I think they will go to court as well and we will be debating a lot on the true impact of the Congressional Review Act repeal, which will be written in the future. We don’t know because there’s no case law and it’s going to be a very thorny subject.

J. Craig Williams: Alden, your final thoughts and your contact information.

Alden F. Abbott: My final thoughts are that we didn’t have the time to get into one important issue here. First of all, even without the FCC regulation, it will be privacy protections. Consumers will be able to opt out I think from use of their information. And I do think that what’s being ignored is that those consumers who benefit from being able to get beneficial uses, new services, because they agreed to let their information be used for certain purposes, all that is being ignored, but that’s subject to a separate conversation.

My contact information is  HYPERLINK “mailto:[email protected]” [email protected]. I am  HYPERLINK “mailto:[email protected]”  happy to receive emails. I also blog on this and related regulatory topics at Truth on the Market, that’s  HYPERLINK “http://www.truthonthemarket.com” truthonthemarket.com.

And I just want to say, I think Ernesto expressed his arguments well, and I don’t agree with them, but it makes for an interesting debate, and undoubtedly as he suggested, we being lawyers there will be more litigation, more opportunity to discuss these issues in greater depth.

J. Craig Williams: Great. Thank you very much. Well, Bob, we have got a few seconds left, what’s your thought?

Bob Ambrogi: You know, I am concerned about — I am of course always concerned about this issue, I am concerned about the privacy issue, something else we didn’t talk about that I have been wondering about is whether there are any special concerns here for lawyers who are engaging in work on behalf of their clients and using the Internet to do that.

I think Ernesto was kind of alluding to this issue of being able to identify — even when supposedly non-identifying information is being provided about users or aggregated in some way that it’s kind of possible to back out of that in some ways and identify individual activity online and find out information about particular individuals.

And so I think I have more questions I guess than answers. This is not an area in which I am at all an expert, but that’s a big question I have is what kinds of precautions should lawyers be taking or thinking about in this. I know, again, as Ernesto mentioned the EFF has a number of privacy tools on its website that people should be aware of, but they may not extend to this situation. So no answers, just questions I guess. How about you Craig?

J. Craig Williams: Pretty much the same. I am concerned like you are given what I have seen Lexis and Westlaw be able to do with the amount of information that’s out there right now and how specific and granular it can be about particular individuals, certainly that’s a source that lawyers look at during litigation and I can see the specter of a ghost looking at my opposing counsel’s research. It just frightens me that that might become a possibility.

Ernesto Falcon: Well, I will just say, I have two words, strong encryption.

Alden F. Abbott: On that I firmly agree.

Bob Ambrogi: Yeah, we will close on that note. Ernesto and Alden, thank you very much for taking the time to be with us. We really appreciated your insights on this topic and your time out of your busy schedules.

Alden F. Abbott: Thank you so much. I enjoyed it.

Ernesto Falcon: Thank you for having us, likewise.

J. Craig Williams: Well, thank you gentlemen. And Bob, that brings us to the end of the show. This is Craig Williams. Thanks for listening. Join us next time for another great legal topic. When you want legal, think Lawyer 2 Lawyer.

[Music]

Outro: Thanks for listening to Lawyer 2 Lawyer, produced by the broadcast professionals at Legal Talk Network. Join J. Craig Williams and Robert Ambrogi for their next podcast, covering the latest legal topic. Subscribe to the RSS feed on  HYPERLINK “http://www.legaltalknetwork.com” legaltalknetwork.com or on iTunes.

The views expressed by the participants of this program are their own, and do not represent the views of nor are they endorsed by Legal Talk Network, its officers, directors, employees, agents, representatives, shareholders, and subsidiaries. None of the content should be considered legal advice. As always, consult a lawyer.

[Music]

Continue Reading