LawGeek

Sixth Circuit rules videocameras in school lockerrooms are illegal

Closed Circuit Televsion (CCTV) has become a huge issue in privacy law and policy in the U.S. as of late, as cities from San Francisco to Chicago have begun installing surveillance networks in a manner similar to London's CCTV network.

While CCTV holds out the promise of an enhanced security and forensic tool, the jury is still out on whether it actually helps fight crime.  Meanwhile, privacy advocates worry about the impact such systems will have our our freedom and civil liberties, especially for those who participate in unpopular, embarrassing, or controversial activities.  (E.g., political protests, Alcoholics Anonymous meetings, psychotherapy, HIV testing, rape crisis centers, etc).

In the wake of this trend, the Sixth Circuit Court of Appeals issued a decision in Brannum v. Overton County School Board the other day addressing some of these issues.  The case involved 34 Tennessee middle school students who sued various school officials and board members as well as the camera vendor for installing CCTVs in the boys' and girls' locker rooms and then viewing and recording the footage.  The students claimed this was in violation of their Constitutional right to privacy under the Fourth and Fourteenth Amendments.

The school defendants moved to dismiss the case claiming qualified immunity in their official capacity.  The Court of Appeals denied qualified immunity to the school officials but granted it for the board members.  The Court's initial description of the case gives you a pretty good idea of where the ruling was headed:

The images captured by the cameras were transmitted to a computer terminal in [Assistant Principal] Jolley’s office where they were displayed and were stored on the computer’s hard drive.  Jolley testified that, in September 2002, he discovered that the locker room cameras were videotaping areas in which students routinely dressed for athletic activities.  He said that he immediately notified Principal  Beaty of the situation and suggested that the placement of the cameras be changed. But, the cameras were not removed nor were their locations changed for the remainder of the fall semester.

In addition to Jolley receiving the images on his computer, they were also accessible via remote internet connection.  Any person with access to the software username, password, and Internet Protocol (IP) address could access the stored images. Neither Jolley nor anyone else had ever changed the system password or username from its default setting.  The record indicates that the system was accessed ninety-eight different times between July 12, 2002, and January 10, 2003, including through internet service providers located in Rock Hill, South Carolina; Clarksville, Tennessee; and Gainsboro, Tennessee.

During a girls’ basketball game at LMS on January 9, 2003, visiting team members from Allons Elementary School noticed the camera in the girls’ locker room and brought this to the attention of their coach, Kathy Carr.  Carr questioned Principal Beaty, who assured Carr that the camera was not activated.  In fact, the camera was activated and had recorded images of the Allons team members in their undergarments when they changed their clothes.  After the game, Carr reported the camera incident to the Allons school principal, who contacted Defendant Needham later that evening.  Needham immediately accessed the security system from his home and viewed the recorded images.  The following morning, January 10, Needham, Beaty, and two other officials viewed the images in Needham’s office by remote access.  Needham later stated that in his opinion, the videotapes of the 10 to 14 year old girls contained “nothing more than images of a few bras and panties.”  School employees removed the locker room cameras later that day.

The Court went on to find that the students had a reasonable expectation of privacy in the locker rooms, both because those are generally private areas and because the activities they pursued there (undressing and dressing) were of an intimate nature:

Surveillance of school hallways and other areas in which students mingle in the normal course of student life is one thing; camera surveillance of students dressing and undressing in the locker room—a place specifically set aside to offer privacy—is quite another.

...

Given the universal understanding among middle school age children in this country that a school locker room is a place of heightened privacy, we believe placing cameras in such a way so as to view the children dressing and undressing in a locker room is incongruent to any demonstrated necessity, and wholly disproportionate to the claimed policy goal of assuring increased school security, especially when there is no history of any threat to security in the locker rooms. 

Finally, the Court ends with a reprimand to the school officials, who tried to claim qualified immunity for pursuing the surveillance activities in good faith:

Some personal liberties are so fundamental to human dignity as to need no specific explication in our Constitution in order to ensure their protection against government invasion. Surreptitiously videotaping the plaintiffs in various states of undress is plainly among them....

Stated differently, and more specifically, a person of ordinary common sense, to say nothing of professional school administrators, would know without need for specific instruction from a federal court, that teenagers have an inherent personal dignity, a sense of decency and self-respect, and a sensitivity about their bodily privacy that are at the core of their personal liberty and that are grossly offended by their being surreptitiously videotaped while changing their clothes in a school locker room.  These notions of personal privacy are “clearly established” in that they inhere in all of us, particularly middle school teenagers, and are inherent in the privacy component of the Fourth Amendment’s proscription against unreasonable searches.

Not all that shocking especially given the facts, but in an era of unprecedented surveillance and ubiquitous cameras, it's nice to see a court reaffirm our reasonable expectations to privacy.  Of course, questions remain as to how far this zone of privacy extends.

Schneier: security vs. privacy is a false tradeoff

Bruce Schneier has written an eloquent column over at wired.com on the false dichotomy between security and privacy:

The debate isn't security versus privacy. It's liberty versus control.

You can see it in comments by government officials: "Privacy no longer can mean anonymity," says Donald Kerr, principal deputy director of national intelligence. "Instead, it should mean that government and businesses properly safeguard people's private communications and financial information." Did you catch that? You're expected to give up control of your privacy to others, who -- presumably -- get to decide how much of it you deserve. That's what loss of liberty looks like.

It should be no surprise that people choose security over privacy: 51  to 29 percent in a recent poll. Even if you don't subscribe to Maslow's hierarchy of needs, it's obvious that security is more important. Security is vital to survival, not just of people but of every living thing. Privacy is unique to humans, but it's a social need. It's vital to personal dignity, to family life, to society -- to what makes us uniquely human -- but not to survival.

If you set up the false dichotomy, of course people will choose security over privacy -- especially if you scare them first. But it's still a false dichotomy. There is no security without privacy. And liberty requires both security and privacy. The famous quote attributed to Benjamin Franklin reads: "Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety." It's also true that those who would give up privacy for security are likely to end up with neither.

(Thanks Jen!)

Ninth Circuit reaffirms right to "informational privacy", nixes overbroad NASA background checks

The Ninth Circuit Court of Appeals issued a decision on Friday in the Nelson v. NASA case.  The case is an interesting one, pitting individual rights of informational privacy versus national security.

In the case, NASA  had issued a new mandate requiring "low risk" employees and contractors who worked at their Jet Propulsion Lab in Pasadena, California to submit to extensive and invasive background checks, including giving NASA permission to collect any information relating to their activities from:

• Schools
• Residential management agents
• Employers
• Criminal justice agencies
• Retail business establishments, or
• "other sources of information."

The records and information sought may include, but is not limited to:

[the applicant’s] academic, residential, achievement, performance, attendance, disciplinary, employment history, and criminal history record information.

In addition, NASA told personnel that they would also send a form inquiring as to:

"any reason to question [the applicant’s] honesty or trustworthiness” or has “any adverse information about [the applicant’s] employment, residence, or activities” concerning “violations of law,” “financial integrity,” “abuse of alcohol and/or drugs,” “mental or emotional stability,” “general behavior or conduct,” or “other matters.”

Personnel were then given the opportunity to explain any of this "adverse information."  Refusal to give NASA permission to collect this information resulted in termination of employment or one's contract. A number of employees and contractors then sued NASA and Cal Tech (where JPL is located), claiming the new requirements were unlawful and moved for a preliminary injunction against their enforcement.  The district court denied the injunction and an appeal ensued.

After dealing with some procedural issues, the Ninth Circuit quickly recognized that every citizen has a constitutional right under the Fifth Amendment to "informational privacy" -- the right to avoid disclosure of "personal matters", including sexual activity, medical information, and financial information.  Thus, the government would need to show that it had a legitimate state interest in requesting the information and that the requests were narrowly tailored to that purpose in order to have the court uphold them.

In reviewing the forms at issue, the court held that the sweeping and overbroad nature of the information requested, without any narrowing to the specific purpose of the investigation (national security risks), was unconstitutional.  The court also went on to consider whether the inquiries were also a violation of the Fourth Amendment's prohibition against searches and decided that they weren't, since all of the information had been given to third-parties and thus was no longer subject to a reasonable expectation of privacy by the personnel under the Supreme Court's holding in United States v. Miller.

Congress should not assist in a cover-up of NSA spying

Written by Cindy Cohn, Legal Director at EFF and appearing in Today's SF Chronicle: Congress should not assist in a cover-up of NSA spying:

When Congress rushed to pass the so-called "Protect America Act" on its way out the door for its August recess, San Francisco's Nancy Pelosi, speaker of the House of Representatives, expressed great regret, telling the New York Times on Aug. 5 that the new law "does violence to the Constitution of the United States." She vowed to take steps to correct the temporary measure long before it expires in February 2008.

Now is the time for Speaker Pelosi to make good on that promise, or at least prevent any further harm. In the last couple of weeks, the Bush administration has stepped up the pressure on Congress to surrender even more of individual citizens' privacy and civil liberties. At the top of the Bush administration's list: granting retroactive immunity to the telecommunications companies that have been participating with the National Security Agency in the widespread and incontrovertibly illegal warrantless surveillance of ordinary Americans since 2001. Granting this immunity would prevent the courts from ever ruling on the legality of the "dragnet" surveillance and from imposing needed restraints. Not content with the sweeping new powers granted to it by Congress in August, the Bush administration is essentially demanding that the now Democratic-led Congress cave in to a cover-up.

San Franciscans have a special reason to be concerned about the Bush administration's retroactive immunity push. The best evidence of the dragnet surveillance comes from AT&T's building at 611 Folsom St. in San Francisco. AT&T's own documents show an NSA-controlled room on the sixth floor of that building where millions of e-mail messages to and from ordinary San Franciscans are being indiscriminately copied for the NSA. The 40 or so lawsuits challenging this warrantless surveillance are all being heard here in San Francisco. The U.S. Ninth Circuit Court of Appeals - just a few blocks from the AT&T spy room - heard the leading case in mid-August and is expected to rule soon. The courts appear to be handling the litigation with extreme care: doing their job to ensure that the law is followed without endangering national security.

So what could make Speaker Pelosi, along with Sen. Dianne Feinstein, D-San Francisco, who is a member of the key Senate Intelligence Committee, consider bending to this latest administration effort to muscle the courts out of their role in enforcing the law? Some say the Democrats are so afraid of looking soft on terrorism that they would rubber-stamp anything the administration labels "terrorism-related" - even handing over millions of innocent communications between ordinary Americans. Others fear that most Democrats in Congress don't really know the details of what's actually going on. The administration has only publicly admitted "targeting" individuals located abroad whose messages happen to pass through the United States.

Maybe Speaker Pelosi and Sen. Feinstein don't realize that there is hard evidence that the NSA is engaging in the wholesale interception of everyone's communications with the help of the telecommunications companies like AT&T. Or maybe the phone companies are arguing that, if they are not let off the hook scot free this time, they might refuse the next time the NSA asks for wholesale access to the communications of Americans. But isn't that exactly what we want them to do? Shouldn't a polite "come back with a warrant and we'll jump right on it," be the telecommunication carriers' response to government requests that violate customer privacy and the law?

Given recent struggles with the Republican minority, it may be that Speaker Pelosi cannot fix all of the problems with the temporary Protect America Act now. But she cannot and should not make things worse. Granting blanket, no-questions-asked immunity for the telephone companies - particularly retroactive immunity with the aim of ending critical ongoing cases now before federal courts - is a bad idea that must be taken off the table.

The courts must be allowed to determine whether the NSA's wiretapping is illegal and, if so, to put a stop to it. Ordinary San Franciscans have a personal stake in this and, with it, a unique opportunity and responsibility to tell the speaker and senior senator from California - their hometown representatives - what they think. The most fundamental of American freedoms is at stake, and there's no time to lose. Speaker Pelosi's San Francisco office number is (415) 556-4862. Sen. Feinstein's is (415) 393-0707. The local carrier for those calls? AT&T.

Bush-appointed "privacy" board OK's NSA wiretapping program

Here's a shocker.  A five-member board "appointed by and serving at the pleasure of the President" has signed off on both of the NSA's controversial surveillance programs:

"We looked at the program, we visited NSA and met with the top people all the way down to those doing the hands-on work," said Carol Dinkins, a Houston lawyer and former Reagan administration assistant attorney general who chairs the board.

"The program is structured and implemented in a way that is properly protective and attentive to civil liberties," she said.

Unless you believe the 4th Amendment applies to emails and call records, of course.  Or perhaps the NSA decided to demonstrate the system for her by playing back some drunk-dialing episodes from her last weekend in Vegas...

(Thanks Kurt!)

PBS' NOW Weekly News Magazine covers the AT&T/NSA wiretapping program

NOW, the weekly news magazine from PBS, has a nice overview of the illegal AT&T/NSA wiretapping
program that we've been fighting at EFF.  (click on the "video link on the right). There's also an interview at the end with Prof. John Yoo, who helped push the legal agenda for both the wiretapping and the controversial detentions at Guantanamo Bay.

(Thanks Dad!)

Are search engines the new therapists? Not from a privacy perspective, they aren't.

I was talking with my colleague Kevin last night about the amount of data that Google and other search engines collect on most Americans.  As was shown in the AOL search history data leak last year, many people input a ton of personal information into search engines, and not just the names of products and services they are looking to purchase.

Rather, many people appear to be using search engines like doctors or therapists, inputting searches for tips on how to deal with depression, how to recover from being the victim of child molestation, how to get out of bad relationships, what drugs would improve their lifestyle and happiness, etc.  What's wonderful about this, Kevin pointed out, is that the Internet can be a resource for people who lead these lives of "quiet desperation" (as Thoreau might say), offering them solice and solutions where they might overwise fail to seek them out.

The flip side, however, is the lack of privacy and security for this kind of information. When you go to a physician or therapist, all of the information about your condition, the advice you are given, and the worries you express are legally kept confidential by the doctor/therapist-patient privilege.  In other words, the law prohibits the practitioner from disclosing the information, even to law enforcement officers, without either a court order or your consent.

With web search, however, none of these protections are explicitly in place.  There are arguments, of course, that your search history should be protected under the Electronic Communications Privacy Act, but those argument are untest in court.  Contrast this with the well-defined privileges mentioned above and laws like HIPAA that explicitly protect patients records and communications.

So while many people are turning to the web and specifically Web Search to seek help, they are doing so at the price of sacrificing the fundamental confidentiality and privacy protections that we depend on in society to keep those requests safe from intrusion and protected from exploitation and embarassment.   With laws in place to protect our financial records and even our video rental records, isn't it about time we had laws to protect our web search records?

Update: Prof. Eric Goldman notes that his article here makes the proposal that our electronic search tools should be given a privilege similar to the attorney-client privilege.

The Damage Caused By AOL's Data Valdez

AOL's Data Valdez:

In August 2006, AOL intentionally released three months of search queries by 650,000 AOL users. Though AOL has removed the data from its site and rightly apologized, the grave damage is already done. The data quickly became available all over the Net, and AOL may have violated its own privacy policy as well as existing federal law. Both companies like AOL and Congress should heed the lessons of this Data Valdez and enhance protections for your privacy.

AOL's actions demonstrate a shocking disregard for user privacy. Search terms can expose the most intimate details of a person's life -- private information about your family, your medical history, your financial information, and much more. These details can be embarrassing and even cause great harm. Would you want strangers to know where you or your child work or go to school? How about your medical history, financial information, sexual orientation, or religious affiliation?

Though the data was associated with random ID numbers, that information could still be connected back to an individual given enough clues, as this NY Times article clearly demonstrates. Whether it's because of vanity searches for your name or MySpace profile or searches related to your city and neighborhood, your search history could create a trail of breadcrumbs that ultimately leads to your doorstep.

This incident highlights the dangers of allowing search companies to store this kind of personal data. While AOL has rightly apologized, its customers deserve more than that -- AOL must take steps to rectify the damage done and to improve its privacy-protections in the future. Congress should also take note of this latest Data Valdez by creating stronger, crystal clear legal protections for user information and by limiting data retention.

Judge Denies DOJ/ATT efforts to dismiss EFF Anti-spying case

We just heard from the Court -- we have successfully defeated the Gov't and AT&T's motions to dismiss our case over their illegal warrantless surveillance programs.  Specifically, they had asserted that the National Security "States Secrets" privilege trumped the Constitutional rights of American citizens.  The Court rejected that argument and has allowed our case to go forward.

w00t!

The judge's decision

More on the AT&T lawsuit.

Are online profiles the new tattoos?

Recently, a number of friends have been asking me what it's like to have an online presence and if I worry sometimes that this will affect my privacy and success in the future.

"What if some employer finds your profile/blog/flickr stream and won't hire you?" is usually how it starts.

A lot of people have done a lot of thinking about this, so I don't claim any original position on the issue.  I assume I can predict the risks I take disclosing personal info and adjust over time according to new trends.  Maybe I'll be right and maybe I'll be wrong, but if you don't take risks, you can never experience what life is like, right?

It occurs to me, though, that we've always had this question looming over our heads in one form or another.  What if I protested the Vietnam war or dodged the draft? What if I had long hair in high school or was gay? What if I get a tattoo when i'm a teenager?

This last example strikes me as the closest analogy.  A lot of people I know, both here in SF and all over the country, are getting tattoos.  Some are more colorful and obvious; others are subtle and hidden.  Some even call them "strategically placed" when they are on the small of the back or between the shoulder blades.  In other words, you can wear them out when you want to show off to your friends and potential mates but still cover them up when you want to go in for that corporate interview.

Online profiles are much the same way.  One can be quite colorful and obvious about who you are, what you are doing, and what the results are. Or one can be more obscure and subtle.  One can make things very easy to Google in association with your name, or one can cloak them with password-protection, pseudonyms, or limiting things to just friends and family.

The key, of course, is to know what you want ahead of time and adjust your privacy preference accordingly.  Fortunately for most, the online world today is a little easier to erase than an ink tattoo.  Google has a special page for removing content about yourself from their index.  Other search engines tend to be the same, respecting information that people want off the web.

But this stands to change quite a bit in the future.  As data continues to be easier and cheaper to store, we can only expect that copies of everything we write online will be kept and eventually sold to the highest bidder who wants to see them.  There will be no dress shirts or full-length skirt to hide our online tattoos if they were once public and now we want them not to be.

This scares me a bit, but like I said, no risk, no gain.  I can only hope i'm taking the right risks and making the right bets for my future.  Guess we'll find out in due time.