The case for online obscurity

California Law Review

Volumn 101, Issue 1, 2013, Pages 1-50

  Hartzog, Woodrow ^a,b   Stutzman, Frederic ^c  

^a SAMFORD UNIVERSITY   (United States)

^b STANFORD LAW SCHOOL   (United States)

^c UNIVERSITY OF NORTH CAROLINA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84874925899     PISSN: 00081221     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (199)

1. See, e.g., danah boyd, Why Youth & hearts Social Network Sites: The Role of Networked Publics in Teenage Social Life, in YOUTH, IDENTITY, AND DIGITAL MEDIA 119, 133 (David Buckingham ed., 2008), available at http://www.mitpressjournals.org/doi/pdf/10.1162/dmal.9780262524834.119 ("Most people believe that security through obscurity will serve as a functional barrier online. For the most part, this is a reasonable assumption.");
2. Danielle Keats Citron, Fulfilling Government 2.0's Promise with Robust Privacy Protections, 78 GEO. WASH. L. REV. 822, 835 (2010) ("People also have a sense that their social-network information will be kept private because they feel anonymous amidst the millions of social-network users.");
3. Lauren Gelman, Privacy, Free Speech, and "Blurry-Edged" Social Networks, 50 B.C. L. REV. 1315, 1317-18 (2009);
4. James Grimmelmann, Saving Facebook, 94 IOWA L. REV. 1137, 1160-63 (2009). This assertion is addressed in greater detail in Part II.
5. See, e.g., Miller v. Motorola, Inc., 560 N.E.2d 900 (III. App. Ct 1990);
6. Beaumont v. Brown, 257 N.W.2d 522 (Mich. 1977);
7. Yoder v. Smith, 112 N.W.2d 862 (Iowa 1962);
8. Brents v. Morgan, 299 S.W. 967 (Ky. 1927).
9. See, e.g., Virgil v. Time, Inc., 527 F.2d 1122 (9th Cir. 1975);
10. Neff v. Time, Inc., 406 F. Supp. 858 (W.D. Pa. 1976);
11. Sipple v. Chronicle Publ'g Co., 201 Cal. Rptr. 665 (Cal. Ct. App. 1984).
12. See, e.g., Illinois v. Caballes, 543 U.S. 405 (2005);
13. Smith v. Maryland, 442 U.S. 735 (1979);
14. Katz v. United States, 389 U.S. 347 (1967).
15. See Memorandum from Bemers-Lee et al., Network Working Group Members of the Internet Engineering Task Force, to the Public for Comments on RFC 1738: Uniform Resource Locators (URL) (Dec. 1994), available at http://ww.ietf.org/ rfc/rfc1738.txt.
16. A URL, or Uniform Resource Locator, describes "syntax and semantics of formalized information for location and access of resources via the Internet" Id For example, the web address http://yahoo.com is a URL that resolves to the Yahoo website.
17. See, e.g., Michael K, Bergman, The Deep Web: Surfacing Hidden Value, 7 J. ELECTRIC PUBLISHING, htrp://quod.lib.umich.edu/cgi/t/text/text-id?c=jep;view= text;rgn=main;idno=3336451.0007.104 (2001) ("Since they are missing the deep Web when they use such search engines, Internet searchers are therefore searching only 0.03%-or one in 3,000-of the pages available to them today.");
18. Norm Medeiros, Reap What You Sow: Harvesting the Deep Web, 18 OCLC SYS. & SERVS. 18 (2002);
19. Yanbo Ru & Ellis Horowitz, Indexing the Invisible Web: A Survey, 29 ONUNE INFO. REV. 249 (2005);
20. Danny Devriendt, Data Is Gold - 91,000 Terabytes of Uncharted Web: Welcome to the DarkSide, PORTER NOVELLI BLOG (Apr. 11, 2011), http://blog.portemovelli.com/2011/04/11/data-is-gold-%E2%80%93-91000-terabytes- of-uncharted-web-welcome-to-the-dark-side/ ("The dark Web, or hidden Web is approximately 550 times bigger than the Web you experience daily.");
21. Russell Kay, Quickstudy: Deep Web, COMPUTERWORLD (Dec. 19, 2005, 12:00 PM), http://www.computerworld.com/s/article/107097/Deep-Web ("[M]ore than 500 times as much information as traditional search engines 'know about' is available in the deep Web.");
22. see also PAUL PEDLEY, THE INVISIBLE WEB: SEARCHING THE HIDDEN PARTS OF THE INTERNET (2001);
23. CHRIS SHERMAN & GARY PRICE, THE INVISIBLE WEB: UNCOVERING INFORMATION SOURCES SEARCH ENGINES CAN'T SEE (2001).
24. See, e.g., boyd, supra note 1, at 133; Frederic Stutzman & Woodrow Hartzog, Boundary Regulation in Social Media, in PROCEEDINGS OF THE ACM 2012 CONFERENCE ON COMPUTER SUPPORTED COOPERATIVE WORK 769, 769-78 (2012), available at http://dl.acm.org/citation.cfm?id=2145320&bnc=1.
25. THE AMERICAN HERITAGE DICTIONARY OF THE ENGLISH LANGUAGE 1213 (4th ed. 2000), available at http://www.ahdictionary.com/word/search.html?q=obscure (defining "obscure").
26. See, e.g., R.I.M. Dunbar, Coevolution of Neocortical Size, Group Size and Language in Humans, 16 BEHAV. & BRAIN Sa. 681 (1993);
27. R.I.M. Dunbar & M. Spoors, Social Networks, Support Cliques, and Kinship, 6 HUM. NATURE 273 (1995).
28. Robin I.M. Dunbar, The Social Brain Hypothesis, 6 EVOLUTIONARY ANTHROPOLOGY 178, 184(1998).
29. See Viktor Mayer-Schönberger, DELETE: THE VIRTUE OF FORGETTING IN THE DIGITAL AGE 16-49 (2009) (explaining why remembering is more resource intensive than forgetting).
30. John A. Bargh et al., Can You See the Real Me? Activation and Expression of the "True Self' on the Internet, 58 J. SOC. ISSUES 33, 44-45 (2002).
31. There is some debate over measuring the size of human social groups, but even those debating measurement methodology agree that the average number of people to whom one is truly close-and nonobscure-to remains objectively small. See LEE RAINIE & BARRY WELLMAN, NETWORKED: THE NEW SOCIAL OPERATING SYSTEM 117-34 (2012) (discussing measurement of personal networks, effects of online interaction on personal networks);
32. Miller McPherson et al., Social Isolation in America: Changes in Core Discussion Networks over Two Decades, 71 AM. SOC. REV. 353, 360 (2006) (establishing and updating core discussion network size). Notable exceptions to this claim are celebrities or other highly identifiable individuals.
33. See GRAEME TURNER, UNDERSTANDING CELEBRITY 23-26, 46-51 (2004).
34. SUSAN T. FISKE & SHELLEY E. TAYLOR, SOCIAL COGNITION (2d ed. 1991);
35. John M. Levine et al., Social Foundations of Cognition, 44 ANN. REV. PSYCHOL. 585, 592 (1993) (explaining how some observers expect certain individuals to behave a certain way based on the "social position" the observer perceives the individual to be in).
36. In off-line settings, individuals may seek personal information to explain observed deviant behavior, such as finding out the backstory for why an unidentified neighbor did something rude. In online settings, the role of deviant behavior has been shown to interact with group membership status. See Zuoming Wang et al., Social Identification and Interpersonal Communication in Computer-Mediated Communication: What You Do Versus Who You Are in Virtual Groups, 35 HUM. COMM. RES. 59, 64-65 (2009).
37. ERVING GOFFMAN, THE PRESENTATION OF SELF IN EVERYDAY LIFE 17-21 (1959).
38. Of this particular challenge, Goffman writes, Whatever else, our activity must be addressed to the other's mind, that is, to the other's capacity to read our words and actions for evidence of our feelings, thoughts, and intent This confines what we say and do, but it also allows us to bring to bear all of the world to which the other can catch allusions. Erving Goffman, Felicity's Condition, 89 AM. J. SOC. 1, 51(1983).
39. See Erving Goffman, BEHAVIOR IN PUBLIC PLACES: NOTES ON THE SOCIAL ORGANIZATION OF GATHERINGS 151-65 (1963).
40. The notion of a zone of obscurity being optimized is in line with the work of Irwin Altman and Sandra Petronio, who both argue that privacy is regulated recursively and interactively with others. See IRWIN ALTMAN, THE ENVIRONMENT AND SOCIAL BEHAVIOR: PRIVACY, PERSONAL SPACE, TERRITORY, CROWDING (1975);
41. SANDRA PETRONIO, BOUNDARIES OF PRIVACY: DIALECTICS OF DISCLOSURE (2002).
42. See, e.g., Adam N. Joinson & Carina B. Paine, Self-Disclosure, Privacy and the Internet, in THE OXFORD HANDBOOK OF INTERNET PSYCHOLOGY 237, 237-38 (Adam N. Joinson et al. eds., 2007);
43. Rob Kling et al., Assessing Anonymous Communication on the Internet: Policy Deliberations, 15 INFO. SOC'Y 79, 82-84 (1999);
44. Su-Yu Zeng et al., Sharing Private Information Online: The Mediator Effect of Social Exchange, in PROCEEDINGS OF THE 11TH INTERNATIONAL CONFERENCE ON ELECTRONIC COMMERCE 231 (2009), available at http://dl.acm.org/ft-gateway. cfm?id=1593290&md=652035&dwn=1&CFID=194561741&CFTOKEN=39062883.
45. See Leysia Palen & Paul Dourish, Unpacking "Privacy" for a Networked World, in PROCEEDINGS OF THE SIGCHI CONFERENCE ON HUMAN FACTORS IN COMPUTING SYSTEMS 129, 131-33 (2003), available at http://dl.acm.org/citation. cfm?id=642635&bnc=1 (discussing the tensions between privacy and publicity).
46. See, e.g., Susannah Fox, PEW INTERNET & AM. LIFE PROJECT, DIGITAL DIVISIONS: THERE ARE CLEAR DIFFERENCES AMONG THOSE WITH BROADBAND CONNECTIONS, DIAL-UP CONNECTIONS, AND NO CONNECTIONS AT ALL TO THE INTERNET (2005), available at http://www.pewintemet.org/PPF/r/165/report-display.asp;
47. JOHN HORRIGAN, PEW INTERNET & AM. LIFE PROJECT, HOME BROADBAND ADOPTION 2009 (2009), available at http://www.pewintemet.org/Reports/2009/10- Home-Broadband-Adoption-2009.aspx. As these reports clearly indicate, use and nonuse of Internet resources is largely a function of socioeconomic and geographic factors. While it is likely that a certain portion of the population opts out of the Internet for privacy-related reasons, the proportion of individuals for whom this applies is so small it does not appear on nationally representative studies.
48. See, e.g., KATHRYN ZICKUHR & AARON SMITH, PEW INTERNET & AM. LIFE PROJECT, DIGITAL DIFFERENCES (2012), available at http://pewmternet.org/ Reports/2012/Digital-differences.aspx (noting that nonusers primary reasons involved lack of motivation, access to resources, or difficulty in use). We speculate that while use or nonuse of the Internet is poorly explained by privacy preferences, use and nonuse of certain applications may be better explained by privacy preference.
49. See RAINIE & WELLMAN, supra note 16, at 126-31; Andreas Wimmer & Kevin Lewis, Beyond and Below Racial Homophily: ERG Models of a Friendship Network Documented on Facebook, 116 AM. J. SOC, 583, 588-600 (explaining the theoretical bases for racial homogeneity in social networks).
50. The reinforcement of social structure can be broadly categorized into two frames. The first frame involves the replication of material and socioeconomic conditions and practices in online space, which is often conceived of as the digital divide. See, e.g., KAREN MOSSBERGER ET AL., VIRTUAL INEQUALITY: BEYOND THE DIGITAL DIVIDE, 1-15, 60-73 (2003);
51. Ritu Agarwal et al., Social Interactions and the "Digital Divide": Explaining Variations in Internet Use, 20 INFO. SYS. RES. 277, 277-94 (connecting internet use with peer behavior and social influence);
52. Eszter Hargittai, Digital Na(t)ives? Variation in Internet Skills and Uses Among Members of the "Net Generation", 80 SOC. INQUIRY 92, 108 (2010) (concluding that differences in web-use skills correlate with socioeconomic, racial, and gender differences). The second frame is the replication of off-line network structures online; that is, the degree to which online and off-line networks overlap, inherently forcing individuals to fall into off-line social roles. See, e.g., RAINIE & WELLMAN, supra note 16, at 126-30 (discussing the "diminishing" gap between physical space and cyberspace); Wimmer & Lewis, supra note 32, at 588-600 (discussing the important role off-line social structure exerts on online network formation).
53. See, e.g., Andrei Broder et al., Graph Structure in the Web, 33 COMPUTER NETWORKS 309 (2000);
54. Jon M. Kleinberg, Authoritative Sources in a Hyperlinked Environment, 46 J. ACM 604 (1999).
55. For an applied discussion of attention networks in Twitter, see Meeyoung Cha et al., Measuring User Influence in Twitter: The Million Follower Fallacy, in PROCEEDINGS OF THE 4TH INTERNATIONAL AAAI CONFERENCE ON WEBLOGS AND SOCIAL MEDIA 10 (2010), available at http://www.aaai.org/ocs/index.php/ICWSM/ICWSM10/ paper/view/1538/1826.
56. Id. at 126, 131-34. For example, consider the case of Aleksy Vayner, whose video resume "Impossible Is Nothing" became an Internet meme. See DANIL J. SOLOVE, THE FUTURE OF REPUTATION: GOSSIP, RUMOR, AND PRIVACY ON THE INTERNET 171-78 (2007).
57. See, e.g., BLOGGER, http://www.blogger.com/ (last visited Nov. 10, 2012);
58. FACEBOOK, https://www.facebook.com/ (last visited Nov. 10, 2012);
59. FOURSQUARE, https://foursquare.com/ (last visited Nov. 10, 2012);
60. TWITTER, https://twitter.com/ (last visited Nov. 10, 2012);
61. WORDPRESS.COM, http://wordpress.com/ (last visited Nov. 10, 2012).
62. See, e.g., AMANDA LENHART, PEW INTERNET & AM. LIFE PROJECT, ADULTS AND SOCIAL NETWORK WEBSITES (2009), available at http://www.pewinternetorg/PPF/ r/272/report-display.aspx;
63. AMANDA LENHART & MARY MADDEN, PEW INTERNET & AM. LIFE PROJECT, TEENS, PRIVACY AND ONLINE SOCIAL NETWORKS (2007), available at http://www.pewintemet.org/PPF/r/211/report-display.asp;
64. AMANDA LENHART et al., PEW INTERNET & AM. LIFE PROJECT, SOCIAL MEDIA AND YOUNG ADULTS (2010), available at http://pewintemet.org/Reports/2010/Social- Media-and-Young-Adults.aspx.
65. Shanyang Zhao et al., Identity Construction on Facebook: Digital Empowerment in Anchored Relationships, 24 COMPUTERS HUM. BEHAV. 1816, 1818-19 (2008) (citations omitted).
66. See, e.g., NANCY BAYM, PERSONAL CONNECTIONS IN THE DIGITAL AGE 50-58 (2010).
67. Cliff Lampe et al., A Facebook in the Crowd: Social Searching vs. Social Browsing, in CSCW '06 PROCEEDINGS OF THE 2006 20TH ANNIVERSARY CONFERENCE ON COMPUTER SUPPORTED COOPERATIVE WORK 167 (2006), available at http://alacm.org/citation.cfm?id=1180901&bnc=1 (discussing the online network construction of college students). For a more general discussion of online-off-line overlaps, see, for example, RAINIE & WELLMAN, supra note 16, at 126-30.
68. DAVID KIRKPATRICK, THE FACEBOOK. EFFECT: THE INSIDE STORY OF THE COMPANY THAT IS CONNECTING THE WORLD 15-17, 275 (2010).
69. Joan Morris DiMicco & David R. Millen, Identity Management: Multiple Presentations of Self in Facebook, in GROUP '07: PROCEEDINGS OF THE 2007 INTERNATIONAL ACM CONFERENCE ON SUPPORTING GROUP WORK 383 (2007), available at http://dl.acm.org/citation.cfm?id=1316682.
70. Meredith M. Skeels & Jonathan Grudin, When Social Networks Cross Boundaries: A Case Study of Workplace Use of Facebook and Linkedln, in GROUP '09: PROCEEDINGS OF THE ACM 2009 INTERNATIONAL CONFERENCE ON SUPPORTING GROUP WORK 95 (2009), available at http://dl.acm.org/citation.cfm?id=1531689.
71. Airi Lampinen et al., All My People Right Here, Right Now: Management of Group Copresence on a Social Networking Site, in GROUP '09: PROCEEDINGS OF THE ACM 2009 INTERNATIONAL CONFERENCE ON SUPPORTING GROUP WORK 281 (2009) [hereinafter Lampinen et al., All My People], available at http://dl.acm.org/ citation.cfm?id=1531717;
72. Airi Lampinen et al., We're in It Together: Interpersonal Management of Disclosure in Social Network Services, in CHI '11: PROCEEDINGS OF THE SIGCHI CONFERENCE ON HUMAN FACTORS IN COMPUTING SYSTEMS (2011), available at http://dl.acm.org/citation.cfm?id=1979420.
73. See, e.g., Houn-Gee Chen et al., Online Privacy Control Via Anonymity and Pseudonym: Cross-cultural Implications, 27 BEHAV. & INFO. TECH. 229 (2008).
74. Kuanchin Chen & Alan I. Rea, Jr., Protecting Personal Information Online: A Survey of User Privacy Concerns and Control Techniques, 44 J. COMPUTER INFO. SYS. 85, 87-88 (2004).
75. See, e.g., Andrew Besmer & Heather Richter Lipford, Moving Beyond Untagging: Photo Privacy in a Tagged World, in CHI '10: PROCEEDINGS OF THE SIGCHI CONFERENCE ON HUMAN FACTORS IN COMPUTING SYSTEMS 1563 (2010), available at http://dl.acm.org/citation.cfm?id=1753560;
76. Heather Richter Lipford et al., Visible Flows: Contextual Integrity and the Design of Privacy Mechanisms on Social Network Sites, in 4 CSE '09 PROCEEDINGS OF THE 2009 INTERNATIONAL CONFERENCE ON COMPUTATIONAL SCIENCE AND ENGINEERING 985 (2009), available at http://dl.acm.org/citation.cfm?id=1633633;
77. Katherine Strater & Heather Richter Lipford, Strategies and Struggles with Privacy in an Online Social Networking Community, in 1 BCS-HCI '08 PROCEEDINGS OF THE 22ND BRITISH HCI GROUP ANNUAL CONFERENCE ON PEOPLE AND COMPUTERS: CULTURE, CREATIVITY, INTERACTION 111 (2008), available at http://dl.acm.org/citation.cfm?id=1531530.
78. See, e.g., Emily Nussbaum, Say Everything, N.Y. MAG., Feb. 12, 2007, at 24-29, 102-03, available at http://nymag.com/news/features/27341/.
79. See, e.g., HELEN NISSENBAUM, PRIVACY IN CONTEXT: TECHNOLOGY, POLICY, AND THE INTEGRITY OF SOCIAL LIFE 104-26 (2010) [hereinafter NISSENBAUM, PRIVACY IN CONTEXT];
80. DANIEL J. SOLOVE, UNDERSTANDING PRIVACY 1-37 (2008) [hereinafter SOLOVE, UNDERSTANDING PRIVACY];
81. Helen Nissenbaum, Privacy as Contextual Integrity, 79 WASH. L. REV. 119 (2004) [hereinafter Nissenbaum, Privacy as Contextual Integrity];
82. Helen Nissenbaum, Protecting Privacy in an Information Age: The Problem of Privacy in Public, 17 LAW & PHIL. 559 (1998) [hereinafter Nissenbaum, Protecting Privacy in an Information Age];
83. Daniel J. Solove, Conceptualizing Privacy, 90 CALIF. L. REV. 1087 (2002) [hereinafter Solove, Conceptualizing Privacy];
84. Lior Jacob Strahilevitz, A Social Networks Theory of Privacy, 72 U. CHI. L. REV. 919 (2005).
85. See, e.g., United States v. Gines-Perez, 214 F. Supp. 2d 205, 225 (D.P.R. 2002), rev'd on other grounds, 90 F. App'x 3 (1st Cir. 2004);
86. Yath v. Fairview Clinics, N.P., 767 N.W.2d 34, 44 (Minn. Ct App. 2009).
87. Daniel J. Solove, Access and Aggregation: Public Records, Privacy, and the Constitution, 86 MINN. L. REV. 1137, 1177 (2002) (noting that when privacy is equated with secrecy, "[i]nformation is categorized as either public or private.... Understood this way, information has a particular status; it can either be in one domain or another. The law often treats information in this black-and-white manner; either it is wholly private or wholly public").
88. Sharon K. Sandeen, Relative Privacy: What Privacy Advocates Can Learn from Trade Secret Law, 2006 MICH. ST. L. REV. 667, 694. Online obscurity has also appeared in the trade secret literature.
89. See, e.g., Elizabeth A. Rowe, Saving Trade Secret Disclosures on the Internet Through Sequential Preservation, 42 WAKE FOREST L. REV. 1, 17-19 (2007). Rowe asked the question of trade secret doctrine: "Does public mean public accessibility or public publication? Does the obscurity of the Web site matter, or are all Internet postings equal?... The precise measure of obscurity or transience required to protect the trade secret, however, is unsettled." Id.
90. DANIEL J. SOLOVE, THE DIGITAL PERSON: TECHNOLOGY AND PRIVACY IN THE INFORMATION AGE 43-44 (2004).
91. See, e.g., Solveig Singleton, Privacy Versus the First Amendment: A Skeptical Approach, 11 FORDHAM INTELL. PROP. MEDIA & ENT. L.J. 97 (2000);
92. Eugene Volokh, Freedom of Speech and Information Privacy: The Troubling Implications of a Right to Stop People from Speaking About You, 52 STAn. L. REV. 1049 (2000);
93. Diane L. Zimmerman, Requiem for a Heavyweight: A Farewell to Warren and Brandeis's Privacy Tort, 68 CORNELL L. REV. 291 (1983).
94. Heidi Reamer Anderson, The Mythical Right to Obscurity: A Pragmatic Defense of No Privacy in Public, 7I/S: J.L. & POL'Y FOR INFO. SOC'Y 543, 551 (2012).
95. See, e.g., Will Thomas De Vries, Protecting Privacy in the Digital Age, 18 BERKELEY TECH. L.J. 283, 301 (2003) ("Digital technology is turning the asset of open government into a privacy nightmare. In the analog age, public records were all available, but languished in 'practical obscurity' in courthouse basements or isolated file cabinets.");
96. Lewis A. Kaplan, Litigation, Privacy and the Electronic Age, 4 YALE SYMP. ON L. & TECH 1, ¶ 6 (2001) ("This practical obscurity of information generated in all but the most exceptional cases has been eroded by technological advances.");
97. Caren Myers Morrison, Privacy, Accountability, and the Cooperating Defendant: Towards a New Role for Internet Access to Court Records, 62 VAND. L. REV. 921 (2009);
98. Peter A. Winn, Judicial Information Management in an Electronic Age: Old Standards, New Challenges, 3 FED. CTS. L. REV. 135 (2009);
99. Arminda Bradford Bepko, Note, Public Availability or Practical Obscurity: The Debate over Public Access to Court Records on the Internet, 49 n. Y.L. SCH. L. REV. 967 (2005);
100. Kristen M. Blankley, Note, Are Public Records Too Public? Why Personally Identifying Information Should Be Removed from Both Online and Print Versions of Court Documents, 65 OHIO ST. L.J. 413 (2004).
101. Computer security through obscurity involves a slightly different set of concerns than user privacy. Obscurity is not favored as a computer security technique. See, e.g., Paul Ohm, Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization, 57 UCLA. L. REV. 1701, 1724 (2010) ("Not only do reidentification scientists spurn security through obscurity, but they often assume that the adversary possesses the exact piece of data-if it exists-needed to unlock anonymized identities, in order to design responses that protect identity even in this worst case.");
102. cf. Peter P. Swire, A Theory of Disclosure for Security and Competitive Reasons: Open Source, Proprietary Software, and Government Systems, 42 HOUS. L. REV. 1333, 1350-51 (2006) ('"Obscurity is camouflage, security is armor.' Either can be useful, depending on the circumstances. They can also be useful when working together, much as tanks are often camouflaged").
103. A few have advocated online obscurity in the context of governmental searches. See, e.g., David A. Couillard, Note, Defogging the Cloud: Applying Fourth Amendment Principles to Evolving Privacy Expectations in Cloud Computing, 93 MINn. L. REV. 2205 (2009). Couillard also argued for a recognition of online obscurity, stating: Courts should... acknowledge the legitimacy of virtual concealment efforts-encryption, password protection, and the practical obscurity of unlisted links-as means of opacity in the cloud context Under this rule, courts would make a case-by-case determination as to whether a user's reliance upon a password, encryption, or obscurity was a reasonable effort to conceal in a given situation. It is not a burden for law enforcement to determine whether a password is necessary to access a website, at which point it would need a warrant prior to accessing the account Conversely, in the unlisted-link context, if an unlisted address appears on a public website as a hyperlink, law enforcement should be given discretion to treat such a virtual container as in plain view. Id. at 2236;
104. see also Carla Scherr, You Better Watch Out, You Better Not Frown, New Video Surveillance Techniques Are Already in Town (and Other Public Spaces), 3 I/S: J.L. & POL'Y FOR INFO. SOC'Y 499, 506 (2008) ("The concept of 'practical obscurity' applies to public information that is usually outside the public consciousness because it is contained in a large number of individual pieces that are practically impossible to accumulate and organize, or because it is impossible to find, for example a paper document stored in the dusty basement of the local courthouse or in an infinitely large government warehouse.");
105. Matthew J. Hodge, Comment, The Fourth Amendment and Privacy Issues on the "New" Internet: Facebook.com and MySpace.com, 31 S. ILL. U. L.J. 95, 108 (2006) ("[A] user could only try to argue that a MySpace profile is not public knowledge, and that it is so obscure as to force the police to go searching for the profile. This obscurity... could be argued to deem some expectation of a private area.").
106. A number of scholars have argued that the traditional notion of practical obscurity, which relied on off-line impediments to discovery, no longer exists in a digital world. See, e.g., Elbert Lin, Prioritizing Privacy: A Constitutional Response to the Internet, 17 BERKELEY TECH. L.J. 1085, 1100-01 (2002) ("[W]hile the scattering of information throughout numerous computer databases had preserved some practical obscurity, the Internet has all but eliminated those remnants of isolation. ");
107. Jacqueline D. Lipton, Mapping Online Privacy, 104 Nw. U. L. REV. 477, 501 (2010) ("While before there was a fair amount of practical obscurity of information gathered in a public place, today the potential for immediate global dissemination of that information is unprecedented. Once information is available online, it is impossible to put the genie back in the bottle.");
108. Omar Tene, What Google Knows: Privacy and Internet Search Engines, 2008 UTAH L. REV. 1433, 1440 ("Before... search engines, we enjoyed a degree of 'practical obscurity'... (Information] was protected de facto from all but skilled investigators or highly motivated researchers, due to the practical difficulty and costs involved in uncovering and compiling the data. Today such information has become available instantly and free of charge through search engines...").
109. See, e.g., In re French v. Am. Gen. Fin. Servs., 401 B.R. 295 (Bankr. E.D. Tenn. 2009);
110. Finnerty v. State Bank & Trust Co., 687 S.E.2d 842 (Ga. Ct. App. 2009);
111. Burnett v. Cnty. of Bergen, 968 A.2d 1151 (n. J. 2009);
112. Lambert v. Hartmann, 898 n. E.2d 67 (Ohio Ct. App. 2008).
113. Id. (citing U.S. Dep't of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 764(1989)).
114. Id. at 42 (quoting U.S. Dep't of Def. v. Fed. Labor Relations Auth., 510 U.S. 487, 500 (1994)).
115. Yath v. Fairview Clinics, 767 n. W.2d 34, 44 (Minn. Ct. App. 2009).
116. J.S. v. Bethlehem Area Sch. Dist, 757 A.2d 412, 425 (Pa. Commw. Ct 2000).
117. See Jonathan Zittrain, Privacy 2.0, 2008 U. CHI. LEGAL F. 65.
118. See, e.g., Boring v. Google, Inc., 362 F. App'x 273 (3d Cir. 2010);
119. Guest v. Leis, 255 F.3d 325, 333 (6th Cir. 2001) ("Users would logically lack a legitimate expectation of privacy in the materials intended for publication or public posting.");
120. Sandler v. Calcagni, 565 F. Supp. 2d 184 (D. Me. 2008);
121. United States v. D'Andrea, 497 F. Supp. 2d 117 (D. Mass. 2007);
122. Four Navy Seals v. Associated Press, 413 F. Supp. 2d 1136 (S.D. Cal. 2005);
123. United States v. Gines-Perez, 214 F. Supp. 2d 205 (D.P.R. 2002);
124. Moreno v. Hanford Sentinel, Inc., 91 Cal. Rptr. 3d 858, 862-63 (Ct. App. 2009);
125. Yath v. Fairview Clinics, 767 n. W.2d 34 (Minn. Ct App. 2009);
126. State v. Birchfield, No. 04-08-00132, 2007 WL 1437235 (n. J. Super. Ct App. Div. May 17, 2007).
127. Id. at 225. The "reasonable expectation of privacy" test is a complex and often maligned doctrine requiring analysis beyond the scope of this Article. It is sufficient for the purposes of this Article to acknowledge that courts generally hold that individuals do not have a reasonable expectation of privacy in "public" information for Fourth Amendment purposes. See Donald R.C. Pongrace, Stereotypification of the Fourth Amendment's Public/Private Distinction: An Opportunity for Clarity, 34 AM. U. L. REV. 1191, 1196, 1206-11 (1985).
128. For more information, see, for example, Gerald G. Ashdown, The Fourth Amendment and the "Legitimate Expectation of Privacy", 34 VAND. L. REV. 1289 (1981);
129. Sherry F. Colb, What Is a Search? Two Conceptual Flaws in Fourth Amendment Doctrine and Some Hints of a Remedy, 55 STAn. L. REV. 119 (2002);
130. Orin S. Kerr, Four Models of Fourth Amendment Protection, 60 STAn. L. REV. 503 (2007);
131. Daniel J. Solove, Fourth Amendment Pragmatism, 51 B.C. L. REV. 1511 (2010);
132. Richard G. Wilkins, Defining the "Reasonable Expectation of Privacy": An Emerging Tripartite Analysis, 40 VAND. L. REV. 1077 (1987).
133. However, a few courts have looked beyond passwords. See Four Navy Seals v. Associated Press, 413 F. Supp. 2d 1136, 1145 (S.D. Cal. 2005),
134. J.S. v. Bethlehem Area School District, 757 A.2d 412, 425 (Pa. Commw. Ct 2000), for a discussion on search visibility.
135. United States v. Gines-Perez, 214 F. Supp. 2d 205, 225 (D.P.R. 2002) (emphasis in original).
136. *4-5 (n. D. Fla. Mar. 11, 2010) (citing United States v. King, 509 F.3d 1338 (11th Cir. 2007) (finding that the accidental sharing of files over a computer network and thumb drive left in a common use computer destroyed a reasonable expectation of privacy));
137. *3 (D. Ariz. Apr. 14, 2006) ("[I]t is undisputed that the share[d] file is publically available, therefore [the counterclaimant] cannot show that the Recording Companies intruded upon her private affairs [by accessing the file-sharing folder on her computer].").
138. Four Navy Seals v. Associated Press, 413 F. Supp. 2d 1136, 1145 (S.D. Cal. 2005).
139. 18 U.S.C. § 2710 (2006). It should be noted that the Video Privacy Protection Act Amendments Act of 2012, Pub. L. No. 112-258, 126 Stat 2414 (2013), arguably weakened the statute's privacy protections by allowing video tape service providers to use advance consent obtained over the Internet to justify the disclosure of consumers' personally identifiable information. See, e.g., Chloe Albanesius, Obama Signs Bill That Lets You Share Netflix Activity on Facebook, PCMAG.COM (Jan. 11, 2013, 4:11 PM), http://www.pcmag.com/article2/0, 2817,2414206,00.asp;
140. John Paul Titlow, Thanks Congress, but We Need Privacy Laws, Not Banal Social Sharing, READWRITE (Dec. 26, 2012), http://readwrite.com/2012/05/09/ sites-wim-social-reading-apps-sacrifice-readers-to-facebook.
141. See Pineda v. Williams-Sonoma Stores, Inc., 246 P.3d 612, 619-20 (Cal. 2011);
142. Bob Egelko, Stores That Request ZIP Codes Violate Law, S.F. CHROn., Feb. 11, 2011, at D1.
143. See, e.g., Kashmir Hill, A Ridiculous California Court Ruling: Zip Codes Are Private, FORBES (Feb. 11, 2011, 12:52 PM), http://blogs.forbes.com/ kashmirhill/2011/02/11/a-ridiculous-california-court-ruling-zip-codes-are- private/;
144. cf. Chris Hoofhagle, Pineda and the Law of the Jungle, TECHNOLOGY-ACADEMICS-POLICY (TAP) (Mar. 8, 2011), http://www.techpolicy.com/ PinedaLaw-of-Jungle-Hoofhagle.aspx (arguing that the Pineda decision restrains "commercial actors that have no respect whatsoever for consumer preferences" from collecting personal information).
145. See, e.g., Martin E. Halstuk & Charles n. Davis, The Public Interest Be Damned: Lower Court Treatment of the Reporters Committee "Central Purpose" Reformulation, 54 ADMIn. L. REV. 983, 1024 (2002) ("[T]he Reporters Committee 'central purpose' definition and theory of 'practical obscurity' are judicial inventions aimed at ill-defined concerns...").
146. See, e.g., Richard J. Peltz et al., The Arkansas Proposal on Access to Court Records: Upgrading the Common Law with Electronic Freedom of Information Norms, 59 ARK. L. REV. 555, 636 (2006) (stating that Reporters Committee for Freedom of the Press "condemned the theory of 'practical obscurity,' the notion that a limited privacy interest can be maintained in public information that is available only by sifting through files in a local courthouse and not available by more efficient and remote, electronic searches..."). Jane Kirtley has argued that in Reporters Committee: Justice Stevens's failure to distinguish the expectation of privacy from the expectation of nondiscovery reflects the growing tendency of courts and legislatures to regard the conversion of data from paper to electronic form as having some talismanic significance. Obviously, paper documents in a file drawer are physically distinct from entries in a computer database, and the time and effort required to retrieve them differ significantly as well. Merely translating data from one form to another, however, should not alter their inherently public nature.
147. Jane E. Kirtley, The EU Data Protection Directive and the First Amendment: Why a "Press Exemption" Won't Work, 80 IOWA L. REV. 639, 642 (1995); Bepko, supra note 113, at 984 ("But is a privacy right threatened when a compilation of otherwise hard to find information-what is now available in the courthouse-is disclosed on the Internet?... [I]t does not follow that access to information alone is necessarily harmful.").
148. Cf. Finn Brunton & Helen Nissenbaum, Vernacular Resistance to Data Collection and Analysis: A Political Theory of Obfuscation, 16 FIRST MONDAY (May 2, 2011), http://www.firstmonday.org/htbin/cgiwrap/bin/ojs/index.php/fm/ article/view/3493/2955 (developing a political philosophy of obfuscation where actors produce "misleading, false, or ambiguous data with the intention of confusing an adversary or simply adding to the time or cost of separating bad data from good."). We think the proper metaphor for online obscurity is the key and lock. The key and lock metaphor is well suited to online disputes given the judicial reliance on the digital version of the key: the password. In essence, we simply propose that there is more than one key that can lock information. Indeed, many kinds of keys and locks, each with varying strengths, exist Considered cumulatively, these metaphorical keys and locks fall along a spectrum that will allow courts to make a more nuanced analysis of online information based on a scale of obscurity.
149. Lior Jacob Strahilevitz, Reunifying Privacy Law, 98 CALIF. L. REV. 2007, 2039 (2010) [hereinafter Strahilevitz, Reunifying Privacy Law] ("As I explained in A Social Networks Theory of Privacy, tort law typically analyzes expectations of privacy through a probabilistic lens."). Therefore, an individual who minimizes the likelihood that the public will discover her information generally enjoys a reasonable expectation of privacy.
150. Cf. Lior Jacob Strahilevitz, Pseudonymous Litigation, 77 U. CHI. L. REV. 1239, 1257-59 (2010) [hereinafter Strahilevitz, Pseudonymous Litigation] (describing the importance of using pseudonyms for one or both parties in certain disputes).
151. Discovery Definition, MACMILLAN DICTIONARY, http://www. macmillandictionary.com/dictionary/british/discovery (last visited Nov. 10, 2012).
152. Note that this is similar to the MySpace group formed in Pietrylo v. Hillstone, No. 06-5754, 2008 WL 6085437 (D.n. J. July 25, 2008). See supra note 147 and accompanying text
153. See, e.g., DEBORAH FALLOWS, PEW INTERNET & AM. LIFE PROJECT, SEARCH ENGINE USE 1 (2008), available at http://www.pewintemet.org/Reports/2008/Search- Engine-Use/Data-Memo.aspx;
154. SUSANNAH FOX, PEW INTERNET & AM. LIFE PROJECT, SEARCH ENGINES 1 (2002), available at http://www.pewinternet.org/Reports/2002/Search-Engines/ Data-Memo.aspx;
155. LEE RAINIE, PEW INTERNET & AM. LIFE PROJECT, BIG JUMP IN SEARCH ENGINE USE 1 (2005), available at htlp://www.pewinternet.org/Reports/2005/Big- jump-in-search-engine-use/Data-Memo.aspx;
156. Gary Marchionini, Exploratory Search: From Finding to Understanding, 49 COMM. ACM 41 (2006).
157. For example, the popular blogging service Blogger allows users to make their blog invisible to Google. See "Listing" and "Let Search Engines Find Your Blog" Settings, GOOGLE BLOGGER, http://www.google.com/ support/blogger/bin/answer.py?hl=en&answer=41373 (last visited Nov. 10, 2012). Similarly, Facebook profiles that utilize privacy settings are also not found by search engines.
158. See How Do I Prevent Search Engines (e.g., Google) from Showing My Public Search Listing?, FACEBOOK, https://www.facebook.com/help/?page=764#!/help/?faq= 12043 (last visited Nov. 10, 2012).
159. Restrictions to access are not limited to passwords and privacy settings. Technologies such as biometrics can also effectively restrict access to informatioa See, e.g., Mike Elgan, How Apple and Google Will Kill the Password, COMPUTERWORLD (Jan. 29, 2011, 7:55 AM), http://www.computerworld.com/s/articIe/ 9206998/How-Apple-and-Google-will-kill-the-password-?taxonomyId= 15&pageNumber=2.
160. See, e.g., Woodrow Hartzog, Website Design as Contract, 60 AM. U. L. REV. 1635, 1653 (2011).
161. Michelle Madejski et al., The Failure of Online Social Network Privacy Settings (2011) (Columbia Univ. Computer Science, unpublished Technical Report No. CUCS-010-11), available at http://academiccommons.columbia.edu/catalog/ac: 135406.
162. See, e.g., Giovanni Iachello & Jason Hong, End-User Privacy in Human-Computer Interaction, 1 FOUNDS. & TRENDS IN HUM.-COMPUTER INTERACTION 137 (2007);
163. Maomao Wu, Adaptive Privacy Management for Distributed Applications (June 2007) (unpublished Ph.D. dissertation, Lancaster University), available at http://eprints.lancs.ac.uk/12984/1/PhdThesis-MaomaoWu.pdf.
164. J. Donath & d. boyd, Public Displays of Connection, 22 BT TECH. J. 71 (2004) 73-77;
165. danah m. boyd & Nicole B. Ellison, Social Network Sites: Definition, History, and Scholarship, 13 J. COMPUTER-MEDIATED COMM. 210, 213 (2007), available at http://jcmc.indiana.edu/vol13/issuel/boyd.elhson.html ("The public display of connections is a crucial component of SNSs. The Friends list contains links to each Friend's profile, enabling viewers to traverse the network graph by clicking through the Friends lists.").
166. danah boyd, Social Steganography: Learning to Hide in Plain Sight, ZEPHORIA (Aug. 23, 2010), http://www.zephoria.org/thoughts/archives/2010/08/23/ social-steganography-learning-to-hide-in-plain-sight.html.
167. See, e.g., Martin Tanis & Tom Postmes, Social Cues and Impression Formation in CMC, 53 J. COMM. 676 (2003);
168. Joseph B. Walther, Selective Self-Presentation in Computer-Mediated Communication: Hyperpersonal Dimensions of Technology, Language, and Cognition, 23 COMPUTERS HUM. BEHAV. 2538(2007).
169. In their most extreme forms, confidentiality demands a complete restriction on the dissemination of information and anonymity demands a complete inability to identify a target. See Woodrow Hartzog, Chain-Link Confidentiality, 46 GA. L. REV. 657, 675 (2012);
170. Gary T. Marx, What's in a Name? Some Reflections on the Sociology of Anonymity, 15 INFO. SOC'Y 99 (1999).
171. See, e.g., Daniel J. Solove, "I've Got Nothing to Hide" and Other Misunderstandings of Privacy, 44 SAN DIEGO L. REV. 745 (2007).
172. See, e.g., Romano v. Steelcase, Inc., 907 n. Y.S.2d 650, 657 (n. Y. Sup. Ct. 2010). The court found no reasonable expectation of privacy in social network sites, stating: Thus, when Plaintiff created her Facebook and My Space accounts, she consented to the fact that her personal information would be shared with others, notwithstanding her privacy settings. Indeed, that is the very nature and purpose of these social networking sites else they would cease to exist. Since Plaintiff knew that her information may become publicly available, she cannot now claim that she had a reasonable expectation of privacy. As recently set forth by commentators regarding privacy and social networking sites, given the millions of users, "[i]n this environment, privacy is no longer grounded in reasonable expectations, but rather in some theoretical protocol better known as wishful thinking." Id. (citing
173. Dana L. Fleming & Joseph M. Herlihy, What Happens When the College Rumor Mill Goes Online? Privacy, Defamation and Online Social Networking Sites, 53 BOS. B.J. 16 (2009)).
174. See, e.g., Adam Thierer, Erasing Our Past on the Internet, FORBES (Apr. 17, 2011, 1:46 PM), http://www.forbes.com/sites/adamthierer/2011/04/17/erasing- our-past-on-the-intemet/; MAYER-SCHÖNBERGER, supra note 13;
175. Ciaran Giles, Internet 'Right to Be Forgotten' Debate Hits Spain, BOSTON.COM (Apr. 20, 2011), http://www.boston.com/news/world/europe/articles/ 2011/04/20/intemet-right-to-be-forgotten-debate-hits-spain/.
176. The E-Government Act of 2002 instructed that personal identifiers, such as Social Security numbers and names of minor children, be redacted from federal court filings. Pub. L. No. 107-347, 116 Stat 2899 (2002). See also Peter W. Martin, Online Access to Court Records-From Documents to Data, Particulars to Patterns, 53 VILL. L. REV. 855, 868 (2008) ('The privacy concerns articulated in the E-Govemment Act led to a federal court policy and ultimately, effective December 1, 2007, new court rules directing attorneys to avoid the inclusion of certain personal identifying information (including full Social Security numbers) in case documents.").
177. See, e.g., Venkat Balasubramani, A Look at the Commercial Privacy Bill of Rights Act of 2011, ERIC GOLDMAN: TECH. & MKTG. BLOG (Apr. 20, 2011, 9:03 AM), http:/blog.ericgoldman.org/archives/2011/04/a-look-at-the-c.htm.
178. See also Tanya Forsheit, Breaking Down the Boucher Bill, INFORMATION LAW GROUP (May 12, 2010), http://www.infolawgroup.com/2010/05/articles/behavioral- advertising/breaking-down-the-boucher-bill/.
179. What Does It Mean to File a Suit Pseudonymously?, WITHOUT MY CONSENT, http://www.withoutmyconsent.org/quick-link/what-does-it-mean-file-suit- pseudonymously (last visited Nov. 10, 2012). See Strahilevitz, Pseudonymous Litigation, supra note 188.
180. Commercial data brokers also collect obscure but available information online and should be regulated under this approach. See, e.g., Chris Jay Hoofnagle, Big Brother's Little Helpers: How ChoicePoint and Other Commercial Data Brokers Collect and Package Your Data for Law Enforcement, 29 n. C. J. INT'L L. & COM. REG. 595 (2004);
181. Daniel J. Solove & Chris Jay Hoofnagle, A Model Regime of Privacy Protection, 2006 U. ILL. L. REV. 357.
182. JANNA QUITNEY ANDERSON & LEE RAINIE, PEW INTERNET & AM. LIFE PROJECT, BIG DATA: EXPERTS SAY NEW FORMS OF INFORMATION WILL HELP PEOPLE BE MORE NIMBLE AND ADAPTIVE, BUT WORRY OVER HUMANS' CAPACITY TO UNDERSTAND AND USE THESE NEW TOOLS WELL (2012), available at http://pewinternet.org/~/media//Files/ Reports/2012/PIP-Future-of-Internet-2012-Big-Data.pdf.
183. OECD Guidelines on the Protection of Privacy and the Transborder Flows of Personal Data, OECD, http://www.oecd.org/document/18/0,2340,en-2649-34255- 1815186-1-1-1-1,00.html (last visited Nov. 10, 2012) (setting forth data privacy guidelines for industry and governments that enable the transborder transfer of information).
184. Plaintiffs in privacy disputes have an increasingly difficult time collecting monetary damages. See, e.g., Daniel J. Solove, The Slow Demise of Defamation and the Privacy Torts, HUFFINGTON POST (Oct. 11, 2010, 4:52 PM), http://www.huffingtonpost.com/daniel-j-solove/the-slow-dernise-of-defama-b- 758570.html.
185. See, e.g., MICHAEL FERTIK & DAVID THOMPSON, WILD WEST 2.0: How TO PROTECT AND RESTORE YOUR ONLINE REPUTATION ON THE UNTAMED SOCIAL FRONTIER 26 (2010) ("[F]or example, information about you that can be found only through a detailed query in a very specific government database might make up some part of your online reputation, but it is not part of your online résumé.").
186. See REPUTATION.COM, http://www.reputation.com/reputationdefender (last visited Nov. 10, 2012). One physician hired Online Reputation Manager, "a company that helps clients push down unfavorable content in search engine results. The effort has crowded out coverage of [a research] scandal and retraction notices on medical journals' websites."
187. Taylor Doherty, Potti Hires Online Reputation Manager, CHRONICLE (Apr. 14, 2011) http://dukechronicle.com/article/potti-hires-online-reputation- manager.
188. See, e.g., Wayne R. Barnes, Rethinking Spyware: Questioning the Propriety of Contractual Consent to Online Surveillance, 39 U.C. DAVIS L. REV. 1545 (2006);
189. Allyson W. Haynes, Online Privacy Policies: Contracting Away Control over Personal Information?, 111 PENn. ST. L. REV. 587 (2007);
190. Andrea M. Matwyshyn, Technoconsen(t)sus, 85 WASH. U. L. REV. 529 (2007).
191. See, e.g., Sandra Braman & Stephanie Roberts, Advantage ISP: Terms of Service as Media Law, 5 NEW MEDIA & SOC'Y 422 (2003);
192. Mark A. Lemley, Terms of Use, 91 MINn. L. REV. 459, 460 (2006);
193. Andrew J. McClurg, Kiss and Tell: Protecting Intimate Relationship Privacy Through Implied Contracts of Confidentiality, 74 U. CIn. L. REV. 887 (2006);
194. Nancy S. Kim, 'Wrap Contracts and Privacy 1 (Mar. 29, 2010) (Ass'n for the Advancement of Artificial Intelligence Press, unpublished Technical Report No. SS-10-05), available at http://papers.ssm.com/so13/papers.cfm?abstract-id= 1580111.
195. About the Licenses, CREATIVE COMMONS, http://creativecommons.org/ licenses/ (last visited Nov. 10, 2012).
196. See, e.g., Posting, TUMBLR, http://www.tumblr.com/docs/en/posting (last visited Nov. 10, 2012);
197. Tagging Photos, PICASA, http://support.google.com/picasa/answer/106209/? & (last visited Nov. 10, 2012);
198. What Is Tagging and How Does It Work?, FACEBOOK, https://www.facebook. com/help/?feq=13407 (last visited Nov. 10, 2012) (discussing how to tag posts).
199. ALDOUS HUXLEY, THOSE BARREN LEAVES 19(1925).