Transparent predictions

University of Illinois Law Review

Volumn 2013, Issue 4, 2013, Pages 1503-1569

  Zarsky, Tal Z ^a  

^a UNIVERSITY OF HAIFA   (Israel)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84885989545     PISSN: 02769948     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Article

References (141)

1. See John Markoff, Government Aims to Build a 'Data Eye in the Sky,' N.Y. TIMES, Oct. 10, 2011, at D1.
2. Frank Pasquale, Restoring Transparency to Automated Authority, 9 J. ON TELECOMM. & HIGH TECH. L. 235,235-36 (2011).
3. PHILIP K. DICK, THE MINORITY REPORT (2002).
4. See Anita Ramasastry, Lost in Translation? Data Mining, National Security and the "Adverse Inference" Problem, 22 SANTA CLARA COMPUTER & HIGH TECH. L.J. 757,760 (2004) (discussing the reaction to the "Total Information Awareness" initiative);
5. Christopher Slobogin, Government Data Mining and the Fourth Amendment, 75 U. Cm. L. REV. 317 (2008); see also CRS REPORT, infra note 63, at 5-11.
6. For an account of these analyses, see Tal Z. Zarsky, "Mine Your Own Business!": Making the Case for the Implications of the Data Mining of Personal Information in the Forum of Public Opinion, 5 YALE J.L. & TECH. 1,18-50 (2002);
7. see also TECHNOLOGY AND PRIVACY ADVISORY COMMITTEE, SAFEGUARDING PRIVACY IN THE FIGHT AGAINST TERRORISM (2004) [hereinafter TAPAC REPORT], available at http://epic.org/privacy/profilmg/tia/tapac-report.pdf;
8. JULIE E. COHEN, CONFIGURING THE NETWORKED SELF: LAW, CODE, AND THE PLAY OF EVERYDAY PRACTICE 167-69,256 (2012);
9. Daniel J. Solove, Data Mining and the Security-Liberty Debate, 74 U. Cm. L. REV. 343 (2008);
10. James X. Dempsey & Paul Rosenzweig, Technologies That Can Protect Privacy as Information Is Shared to Combat Terrorism, LEGAL MEMORANDUM, No. 11, May 26, 2004, available at James X Dempsey link: http://www.heritage.org/ research/reports/2004/05/technologies-that-can-protect-privacy-as-information- is-shared-to-combat-terrorism.
11. See Fred H. Cate, Government Data Mining: The Need for a Legal Framework, 43 HARV. C.R.-CL. L. REV. 435,485 (2008);.
12. Todd Essig, 'Big Data' Got You Creeped Out? Transparency Can Help, FORBES, Feb. 27, 2012, http://www.forbes.com/sites/toddessig/2012/02/27/big- data-got-you-creeped-out-transparency-can-help/.
13. Federal Agency Data Mining Reporting Act of 2007, 42 U.S.C. § 2000ee-3(c)(2) (Supp. III 2007).
14. See, e.g., Frederick Schauer, Transparency in Three Dimensions, 2011 U. ILL. L. REV. 1340 n.10 (providing an extensive list of recent publications).
15. In addition, recently, on his popular "Legal Theory Blog" Larry Solum chose to highlight this concept. Lawrence Solum, Legal Theory Lexicon: Transparency, LEGAL THEORY BLOG (Jan. 22,2012,5:53 PM), http://lsolum.typepad. com/legaltheory/2012/01/legal-theory-lexicon-transparency.html.
16. See, e.g. Freedom of Information Act Memorandum for the Heads of Executive Departments and Agencies, 74 Fed. Reg. 4683 (Jan. 21, 2009), available at http://edocket.access.gpo.gov/2009/pdf/E9-1773.pdf.
17. This concept of transparency is also advocated in the context of large private entities. These discussions will not be the focus of this Article, yet I will at times refer to the rationales and arguments stated in the broader discussion of transparency and examine how they can be applied to the governmental context. See, e.g., Louis D. BRANDEIS, OTHER PEOPLE'S MONEY AND HOW THE BANKERS USE IT (1914);
18. Kenneth A. Bamberger, Technologies of Compliance: Risk and Regulation in a Digital Age, 88 TEX. L. REV. 669 (2010).
19. The Department of Homeland Security (DHS) issued privacy guidelines and a privacy policy by which it must abide. Memorandum from Hugo Tevfel III, Chief Privacy Officer, U.S. Department of Homeland Security, on The Fair Information Practice Principles: Framework for Privacy Policy at the Department of Homeland Security (Dec. 29, 2008) [hereinafter DHS GUIDELINES], available at http://www.dhs.gov/xlibrary/assets/privacy/privacy-policyguide-2008-01.pdf.
20. See ARCHON FUNG ET AL., FULL DISCLOSURE: THE PERILS AND PROMISE OF TRANSPARENCY 12-15 (2007).
21. Office of E-Government & Information Technology, THE WHITE HOUSE, http://www.whitehouse.gov/omb/e-gov/ (last visited Feb. 22, 2013).
22. For advances in the mobile realm, see José M. Alonso et al., Improving Access to Government Through Better Use of the Web, W3C (May 12, 2009), http://www.w3.org/TR/2009/NOTE-egov-improWng-20090512/.
23. This is a process also referred to as E-Gov 2.0. See Viktor Mayer-Schönberger & David Lazer, E-Gov and the Coming Revolution of Information Government (Belfer Center Sci. Int'l Affairs, Working Paper), available at http://live.belfercenter.org/files/intro-wp.pdf;
24. Richard MacManus, E-Government Meets Web 2.0: Goodbye Portals, Hello Web Services, READWRITE (NOV. 5, 2007), http:// www.readwriteweb.com/archives/e- governnient-meets-web-20.php.
25. In the context of participation in rulemaking, see Beth Simone Noveck, The Electronic Revolution in Rulemaking, 53 EMORY L.J. 433, 436-37 (2004).
26. See generally Viktor Mayer-Schönberger, Information Government and the Locus of Implementation (Belfer Center Sci. Int'l Affairs, Working Paper), available at http://belfercenter.ksg.harvard.edu/files/vms.pdf.
27. Jennifer Shkabatur, Cities @ Crossroads: Digital Technology and Local Democracy in America, 76 BROOK. L. REV. 1413,1437 (2011).
28. Mireille Hildebrant, Profiling and the Rule of Law, 1 IDENTITY INFO. SOC'Y 55,66 (2008).
29. See Danielle Keats Citron, Technological Due Process, 85 WASH. U. L. REV. 1249, 1271 (2008) [hereinafter Citron, Technological Due Process].
30. Citron, Technological Due Process, supra note 30, at 1256-58.
31. Danielle Keats Citron, Open Code Governance, 2008 U. CHI. LEGAL F. 355, 357 [hereinafter Citron, Open Code Governance].
32. Citron, Technological Due Process, supra note 30, at 1279.
33. The accepted estimate is one percent for individuals. These facts are frequently published by the 1RS. For 2007, see Fiscal Year 2007 Enforcement and Services Results, INTERNAL REVENUE SERVICE, http://www.irs.gov/uac/Fiscal-Year- 2007-Enforcement-and-Services-Results (last updated Sept. 6,2013) [hereinafter 2007 Tax Statistics].
34. FREDERICK SCHAUER, PROFILES, PROBABILITIES AND STEREOTYPING 161 (2003).
35. I acknowledge that the 1RS example is somewhat problematic; the 1RS auditing process is not only intended to detect cheating, but also to generate deterrence. For that, the 1RS engages in a variety of strategies which includes the manipulative use of the media. For this discussion, I am setting aside this aspect of the 1RS enforcement actions, and focusing on the mere struggle to detect cheating to the greatest extent possible. For more on the IRS's latter strategies, see Joshua D. Blank, In Defense of Individual Tax Privacy, 61 EMORY L.J. 265,318 (2011).
36. For instance, to sustain a dataset so as to later find trends for auditing or to examine whether compliance levels and patterns changed-for an argument that only random examinations of returns would achieve a fair and effective outcome, see BERNARD E. HARCOURT, AGAINST PREDICTION: PROFILING, POLICING, AND PUNISHING IN AN ACTUARIAL AGE 238 (2007).
37. As the IRS explains: "We accept most taxpayers' returns as filed. If we inquire about your return or select it for examination, it does not suggest that you are dishonest. The inquiry or examination may or may not result in more tax. We may close your case without change or you may receive a refund. The process of selecting a return for examination usually begins in one of two ways. One way is to use computer programs to identify returns that may have incorrect amounts. The programs may be based on information returns, such as Forms 1099 or W-2, on studies of past examinations, or on certain issues identified by other special projects. Another way is to use information from compliance projects that indicates a return may have incorrect amounts. These sources may include newspapers, public records, and individuals. If we determine the information is accurate and reliable, we may use it to select a return for examination." I.R.S. Publication 3498 (Rev. 11-2004), available at http://www.irs.gov/pub/irs-pdf/p3498.pdf;
38. see also I.R.S. Publication 1 (Rev. Sept. 2012) [hereinafter Taxpayer Rights], available at http://www.irs.gov/pub/irs-pdf/pl.pdf. The system is commonly referred to as the DIF score.
39. Some refer to the elements used as "audit triggers." See Andrea Coombes, IRS Audit Triggers and Red Flags-the 2010 Tax Guide from MarketWatch, MARKETWATCH (Apr. 13, 2009, 10:27 AM), http://www.marketwatch.com/story/want- avoid-audit-consider-how;
40. Tax Audit Triggers to Watch Out For, BosTON.COM, http://www.boston.com/ business/taxes/articles/macpa/new-2005/Tax-auditjriggers/ (last visited Feb. 22,2013) [hereinafter Tax Audit Triggers].
41. See U.S. GENERAL ACCOUNTING OFFICE, GAO-04-548 DATA MINING: FEDERAL EFFORTS COVER A WIDE RANGE OF USES (2004) [hereinafter GAO REPORT], available at http://www.gao.gov/new.items/d04548.pdf. For instance, veteran data is mined to search for frauds and abuses. Additional projects for the detection of fraud are listed. There is a long list of planned projects that involve data mining and are destined to increase tax compliance. See id. at 52; see also Citron, Technological Due Process, supra note 30, at 1263.
42. See IRS, INTERNAL REVENUE MANUAL 10.8.19.1 (Aug. 11, 2006), available at http://www.irs.gov/irm/part4/irm-04-010-008-cont02.html. ("The taxpayer may inquire about why his/her return was selected for examination. Publication 1, Your Rights as a Taxpayer, has been revised and includes a statement describing the criteria and general procedures for selecting taxpayers for examination. The Service is not required to disclose the basis for the selection of a particular taxpayer for examination. Generally, it is the practice of the Service to respond if the source of the examination is random, DIF generated (without explaining the scoring process), or if generated from a public source (e.g., public media report). However, if the source of the examination is an informant, the Service is not obligated to, nor would it be appropriate to, disclose an informant exists. The examiner and his manager should consult with Disclosure when requested to provide a response to return selection for informant cases.").
43. Christopher A. Szechenyi, Talking Taxes-How to Avoid an Audit, SALARY.COM, http:// www.salary.com/Articles/ArticleDetail.asp?part=par258 (last visited May 20,2013);
44. See JEFFREY W. SEIFERT, CONG. RESEARCH SERV., RL31798
45. DATA MINING AND HOMELAND SECURITY: AN OVERVIEW 8 (2008) [hereinafter CRS REPORT], available at http://www.fas.org/sgp/crs/homesec/RL31798.pdf.
46. U.S. DEP'T. OF HOMELAND SECURITY PRIVACY OFFICE, 2009 DATA MINING REPORT TO CONGRESS 2 (2009), available at http://www.dhs.gov/xlibrary/assets/privacy/ privacy-rpt-datamining-2009-12.pdf.
47. Laura K. Donohue, Criminal Law: Anglo-American Privacy and Surveillance, 96 J. CRIM. L. & CRIMINOLOGY 1059,1145 (2006).
48. See Secure Flight Program, TRANS. SEC. ADMIN. (May 14, 2013), http://www.tsa.gov/stakeholders/secure-flight-program.
49. Secure Flight, EPIC.ORG, http://epic.org/privacy/airtravel/secureflight. html (last visited May 20,2013) (outlining delays and how the project is moving forward, and listing additional sources).
50. The nature of this list and the ability to seek redress and learn why someone is included in it, and how one can get off the list, received recent academic interest. See, e.g., Ramasastry, supra note 11, at 779-92; Solove, supra note 12, at 344. A recent report indicates that the list is shorter than people think, including about 10,000 names, less than ten percent of whom are American. Jamie Tarabay, The No Fly Lisv FBI Says It's Smaller Than You Think, NPR (Jan. 26,2011,12:01 AM), http://www.npr.org/2011/01/26/133187841/the-no-fly- list-fbi-says-its-smaller-than-you-think.
51. See Privacy & FOIA Reports, U.S. DEPT. OF HOMELAND SECURITY, http://www.dhs.gov/privacy-foia-reports (last visited May 20,2013) (listing all the recent data mining reports).
52. DHS has indicated that data mining is not yet used, but might subsequently be applied for this objective. U.S. DEP'T OF HOMELAND SECURITY PRIVACY OFFICE, 2010 DATA MINING REPORT TO CONGRESS 13 (2010) [hereinafter 2010 DATA MINING REPORT], available at http://www.dhs.gov/ xlibrary/assets/privacy/ 2010-dhs-data-mining-report.pdf.
53. Indeed, the 2011 Data Mining Report already notes that "data mining queries of data in ATS and its source databases may subsequently be used by analysts to refine or further focus those rules to improve the effectiveness of their application." U.S. DEPT OF HOMELAND SECURITY PRIVACY OFFICE, 2011 DATA MINING REPORT TO CONGRESS 11-12 (2012) [hereinafter 2011 DATA MINING REPORT], available at http://www.dlis.gov/xlibrary/assets/privacy/dlBprivacy- 2011datarniningreport.pdf. A possible reason as to why predictive data mining is featured in the ATS-P context but not with regard to "Secure Flight" and the "No Fly List" is that only the former process is followed by human review, which allows for correcting automated errors. E-mails exchanged between Tal Zarsky and Paul Rosenzweig, Founder, Red Branch Law and Consulting, PLLC (Sept. 24, 2012, 9:57 AM) (on file with author). Note, however, that in the 2011 DHS Data Mining Report, DHS states that "TSA's Secure Flight Program (Secure Flight) began leveraging ATS-P to identify individuals requiring enhanced screening prior to boarding an aircraft." 2011 DHS DATA MINING REPORT, supra note 77, at 5. As ATS-P makes use of predictive data mining, this statement might indicate that data-mining measures are migrating to the "Secure Flight" context as well.
54. Several experts have questioned the ability of data mining to provide a helpful tool in this context. See, e.g., Jeff Jonas & Jim Harper, Effective Counterterrorism and the Limited Role of Predictive Data Mining, (POL'Y ANALYSIS, No. 584, Dec. 11, 2006) available at http://www.cato.org/sites/cato. org/files/pubs/pdf/pa584.pdf;
55. Bruce Schneier, Why Data Mining Won't Stop Terror, WIRED (Mar. 9, 2006), http://www.wired.com/politics/security/commentary/securitymatters/2006/03/70357? currentPage=all;
56. see also COMMITTEE ON TECHNICAL AND PRIVACY DIMENSIONS OF INFORMATION FOR TERRORISM PREVENTION AND OTHER NATIONAL GOALS ET AL., PROTECTING INDIVIDUAL PRIVACY IN THE STRUGGLE AGAINST TERRORISTS: A FRAMEWORK FOR PROGRAM ASSESSMENT 185 (2008), available at http://www.nap.edu/catalog.php?record-id=12452#toc (finding these practices neither feasible nor desirable). This Article, however, assumes prediction models will be applied and examines when and how transparency is mandated to mitigate other concerns, while believing that in some contexts, prediction models can prove effective and efficient.
57. See, e.g., Press Release, IBM, Memphis Police Department Reduces Crime Rates with IBM Predictive Analytics Software (July 21, 2010), available at http://www-03.ibm.com/press/us/eri/pressrelease/32169.wss.
58. In a broader context, the government is considering the use of "fusion centers" to battle organized crime and drug trafficking. According to the DOJ Privacy Impact Assessment, such operations will include the use of data mining at one point. See U.S. DEPT. OF JUSTICE, PRIVACY IMPACT ASSESSMENT FOR THE ORGANIZED CRIME DRUG ENFORCEMENT TASK FORCE FUSION CENTER AND INTERNATIONAL ORGANIZED CRIME INTELLIGENCE AND OPERATIONS CENTER SYSTEM 9 (2009), available at http://www.justice.gov/opcl/crime-taskforce.pdf.
59. For a discussion of the problems and shortcomings of fusion centers in general, see Danielle Keats Citron & Frank Pasquale, Network Accountability for the Domestic Intelligence Apparatus, 62 HASTINGS L.J. 1441 (2011).
60. There are still other examples for the uses of predictive data mining in the criminal justice context. For a discussion as to how data mining is being considered for "[providing well-tailored rehabilitation services to juvenile offenders" and the problematic implications of using data mining to predict recidivism, see Danielle Citron, Data Mining for Juvenile Offenders, CONCURRING OPINIONS (Apr. 21, 2010, 3:56PM), http://www.concurringopimons.com/ archives/2010/04/data-mining-for-juvenile-offenders.html.
61. K. A. Taipale, Data Mining and Domestic Security: Connecting the Dots to Make Sense of Data, 5 COLUM. SCI. & TECH. L. REV. 1,15-17 n.43 (2003).
62. "The results of queries in ATS-P are designed to signal to [U.S. Customs and Border Protection] officers that further inspection of a person may be warranted⋯." Id. at 12. Yet there might be more severe cases. According to EPIC, CAPPS II included a category of very high-risk passengers, who are to be delayed and possibly arrested. Passenger Profiling, EPIC.ORG, http://epic.org/privacy/airtravel/profiling.html (last visited May 20,2013).
63. PETER CABENA ET AL., DISCOVERING DATA MINING: FROM CONCEIT TO IMPLEMENTATION 18-21 (1998).
64. Batya Friedman & Helen Nissenbaum, Bias in Computer Systems, in HUMAN VALUES AND THE DESIGN OF COMPUTER TECHNOLOGY 21, 21-39 (Batya Friedman ed., 1997).
65. I thank Ken Farrall for illuminating this point. Ken Farrall, Address at New York University Law School: Mapping Information Flows in the Detection and Prevention of Terrorist Attacks (Oct. 13,2010). For a discussion of the unclear definition of a terrorist event and the difficulty of defining it, see U.S. DEP'T OF JUSTICE, FEDERAL BUREAU OF INVESTIGATION, TERRORISM 2002-2005 iv-v, available at http://www.fbi.gov/stats-services/publications/terrorism-2002-2005/ terror02-05.pdf.
66. see also Dean Abbott, Data Mining: An or Science?, DATA MINING AND PREDICTIVE ANALYTICS BLOG (Aug. 6, 2003, 11:16 AM), http://abbottanalytics. blogspot.com/2003/08/data-mining-art-or-science.html.
67. This is mostly the case when more advanced tools of data mining are applied, such as decision tree learning. Since these tools generate specific concerns of their own, they will not be further addressed here. For a discussion of such instances that at times involved tens of thousands of factors, see David Martens & Foster Provost, Explaining Documents' Classification 2 (N.Y.U.-Stern Sch. of Bus., Working Paper No. CeDER-11-01), available at http://archive.nyu.edu/handle/2451/29918.
68. "Building" a theoretical justification for a statistical correlation, however, is usually easy and merely requires some imagination. Thus, assuring causation exists will probably prove to be a weak form of protection against inaccurate analyses. For a discussion in a very different context, see S. Stanley Young et al., Comment, Cereal-Induced Gender Selection? Most Likely a Multiple Testing False Positive, 276 PROC. ROYAL BIOL. SOC'Y 1211, 1212 (2009), available at http://www.ncbi.nlm.nih.gov/sites/ppmc/articles/ PMC2660953/pdf/rspb20081405.pdf (using the term "Retrospective Rationalization").
69. For instance, see U.S. DEPT. OF HOMELAND SECURITY PRIVACY OFFICE, ANNUAL REPORT TO CONGRESS: JULY 2007-JULY 2008, at 9 (2008), available at http:ZAvww.dhs.gov/xlibrary/assets/privacy/privacy-rpt-annual-2008.pdf.
70. Privacy Compliance, U.S. DEPT. OF HOMELAND SECURITY, http://www.dhs.gov/ privacy-compliance (last visited May 20,2013) (defining what are PIAs).
71. Kenneth A. Bamberger & Deirdre K. Mulligan, Privacy Decision Making in Administrative Agencies, 75 CHI. L. REV. 75,81-82 (2008).
72. See Civil Rights & Civil Liberties Impact Assessments, U.S. DEPT. OF HOMELAND SECURITY, http://www.dhs.gov/clvil-rights-dvil-liberties-impact- assessments (last visited May 20, 2013) [hereinafter CLIA Website].
73. OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT, OMB MEMORANDA NO. M-03-22, OMB GUIDANCE FOR IMPLEMENTING THE PRIVACY PROVISIONS OF THE E-GOVERNMENT ACT OF 2002, Attachment A § II(C)(a)(l)(l)(2003) [hereinafter OMB GUIDANCE] available at http://www.wnitehouse.gOv/omb/memoranda- ni03-22#a ("PIAs must analyze and describe⋯ what information is to be collected (e.g., nature and source)⋯.").
74. For instance, see U.S. DEP'T OF HOMELAND SECURITY, PRIVACY IMPACT ASSESSMENT FOR THE AUTOMATED TARGETING SYSTEM 6-8 (2007) [hereinafter ATS-P PIA], available at http://www.dhs.gov/xlibrary/assets/privacy/privacy-pia-cbp- ats-updated-fr.pdf. As mentioned, PIAs prepared by the DHS are subject to an additional set of guidelines. These guidelines require forms of disclosure similar to those addressed in the Data Mining Reporting Act. Id. at 6-13. These guidelines even go into additional detail so as to include specific factors which must be addressed in the PIA report. Id. at 6-7.
75. This law, however, includes a law enforcement exemption. Computer Matching and Privacy Protection Act of 1988, Pub. L. No. 100-503, 102 Stat. 2507, 2512 (codified at 5 U.S.C. § 552a(a)(8)(B)(iii) (2006)); Cate, supra note 13, at 467. When the law applies (despite the exemption), it requires notice on data sharing and some form of overall supervision by a Data Integrity Board. See U.S. DEP'T. OF HOMELAND SECURITY PRIVACY OFFICE, ANNUAL REPORT TO CONGRESS: JULY 2009-JUNE 2010, at 17 (2010), available at http://www.dhs.gov/ xlibrary/ assets/privacy/privacy-rpt-annual-2010.pdf (outlining DHS's compliance with these requirements). In general, this requirement does not appear to enhance transparency, but merely overall accountability.
76. For a call to change this outcome, see Citron, Technological Due Process, supra note 30, at 1308-09.
77. 2010 DATA MINING REPORT, supra note 77, at 10.
78. The analysis in this Section assumes that all the factors here discussed pertain to disclosure regarding final decisions made by government (or can be referred to as "post-decisional" step). In doing so, our discussion sidesteps the thorny issue as to possible requirements for disclosing internal governmental deliberations, protocols, discussions, and memos. These are usually considered outside our discussion of transparency requirements, and covered (thus rendered opaque) by the "deliberative process privilege," which is also somewhat accepted into the FOIA in exemption 5. For more on this privilege, see Freedom of Information Act Guide: Exemption 5, U.S. DEP'T. OF JUSTICE (May 2004), http://www.justice.gov/oip/exemption5.htm. One can here argue that the abovementioned assertion is misplaced, and that the Analysis portion of the automated predictive process in its entirety is pre-decisional by nature-these are steps that come before the final "decision"-which is the nature of the profile or pattern being used. See infra Table 1. If this final assertion is correct, the Analysis stage should be rendered opaque in its entirety as well, and the transparency measures considered in the text should be set aside. I find this pro-opacity argument unconvincing. While the structuring of the patterns could be seen as a process, it is one that would be ongoing and premised upon standards and technologies which were previously set by the government. In other words, our discussion here addresses disclosures of "meta" rules, which establish the nature of the automated prediction, rather than the actual ongoing internal discussions between employees implementing the prediction process, which should remain privileged.
79. For instance, see the results of a study concerning NYPD policy for stopping individuals, which turned out to be extremely biased. See Second Supplemental Report of Jeffery Fagan, Ph.D., Floyd v. City of New York, 08 Civ. 01034 (SAS) (S.D.N.Y. Dec. 12, 2012), available at http://ccrjustice.org/files/ FaganSecondSupplementalReport.pdf.
80. This is done either by law or within the agency. See U.S. DEP'T OF HOMELAND SECURITY, REPORT TO CONGRESS ON THE DEPARTMENT OF HOMELAND SECURITY OFFICE FOR CIVIL RIGHTS AND CIVIL LIBERTIES 20-21 (2008), available at http://www.dhs.gov/xlibrary/assets/crcl-annual- report-FY-2008.pdf.
81. U.S. DEPARTMENT OF HOMELAND SECURITY OFFICE FOR CIVIL RIGHTS AND CIVIL LIBERTIES, CIVIL LIBERTIES IMPACT ASSESSMENT TEMPLATE (2008), available at http://www.it.ojp. gov/documents/Civil-Liberties-Impact.pdf.
82. Stuntz, who advocates strongly against transparency, argues that this form of information is extremely important to enable the monitoring of the actions of government; namely, more information about outcomes and less about process. William J. Stuntz, Against Privacy and Transparency, NEW REPUBLIC (Apr. 17, 2006), http://www.tnr.com/article/against-privacy-and-transparency. It should be noted, however, that Stuntz refers mainly to information regarding arrests and prosecutions, which are merely a small and limited segment of the form of data here discussed.
83. The Obama Administration has accepted this notion, as stated on the White House website. "Government should be transparent. Transparency promotes accountability and provides information for citizens about what their Government is doing." Transparency and Open Government, THE WHITE HOUSE, http://www.whitehouse.gov/the-press-office/TransparencyandOpenGovernment/ (last visited May 20,2013) (emphasis omitted).
84. This Article sets aside the discussion as to whether governmental transparency could be derived from a constitutional analysis. Scholars reviewing this question find it to be inconclusive. See Adam M. Samaha, Government Secrecy, Constitutional Law, and Platforms for Judicial Intervention, 53 UCLA L. REV. 909,970 (2006).
85. Mark Fenster, The Opacity of Transparency, 91 IOWA L. REV. 885,895-96 (2006).
86. For a discussion of this right, from a comparative perspective, see TOBY MENDEL, FREEDOM OF INFORMATION: A COMPARATIVE LEGAL SURVEY (2d ed. 2008), available at http://portal.unesco.org/ci/en/files/26159/12054862803freedom- information-en.pdf/freedom-informa tion-en.pdf.
87. For a recent move to expand such actions by Rep. Darrell Issa, see David M. Herszenhorn, Chairman Seeks New Power for Watchdogs, N.Y. TIMES, Nov. 28, 2010, at Al.
88. For more on this distinction, see Schauer, supra note 18, at 1346. Scholars have noted several difficulties with meeting accountability without transparency; they note that especially when both the legislator and the executive belong to the same party, the internal balances among powers is insufficient without full transparency. DANIELE J. SOLOVE, NOTHING TO HIDE: THE FALSE TRADEOFF BETWEEN PRIVACY AND SECURITY 86 (2011) (noting violations of FISA). Furthermore, free access to all resources enables government agencies to provide better checks over each other (and in part can even benefit from public inquiries and investigations).
89. See Paul M. Schwartz, Reviving Telecommunications Surveillance Law, 75 U. CHI. L, REV. 287, 313 n.164 (2008)
90. citing Neal Kumar Katyal, Internal Separation of Powers: Checking Today's Most Dangerous Branch from Within, 115 YALE LJ. 2314,2341-42 (2006)).
91. This option is also advocated by Stuntz, supra note 148. But see Antonin Scalia, The Freedom of Information Act Has No Clothes, REG., MarVApr. 1982, at 14.
92. Accountability could be achieved through a variety of strategies: regulation ex ante and by setting access controls and audit functions, which will regulate behavior ex post. See Ira S. Rubinstein et al., Data Mining and Internet Profiling: Emerging Regulatory and Technological Approaches, 75 U. Cm. L. REV. 261,267,269 (2008).
93. For a concrete example of such a system, see Daniel J. Weitzner et al., Information Accountability, 51 COMM. ACM, No. 6, June 2008, at 85.
94. Lawrence Lessig, Against Transparency, NEW REPUBLIC, http://www. newrepublic.com/ article/books-and-arts/against-transparency (last visited May 20,2013).
95. see also Noah Feldman, In Defense of Secrecy, N.Y. TIMES MAG., Feb. 15, 2009, at MM11.
96. Scholars have recently examined the return of shame-based punishment in criminal law, while pointing out various benefits and shortcomings. Dan Kahan, for instance, is a famous supporter of shaming, with limitations, although in a recent paper he expressed some reservations. See Dan M. Kahan, What's Really Wrong with Shaming Sanctions, 84 TEX. L. REV. 2075, 2095 (2006). I will not address this debate within the confines of this Article, mainly because this Article does not focus on using shaming as punishment (even as an alternative to imprisonment) but as a tool for generating accountability. Thus, many of the social and psychological dynamics addressed in this shaming-related literature would not apply.
97. Seth F. Kreimer, The Freedom of Information Act and the Ecology of Transparency, 10 U. PA. J. CONST. L. 1011,1056 (2008). Schwartz and Janger made a similar point in a somewhat different context-that of notification rules regarding data security breaches.
98. See Paul M. Schwartz & Edward J. Janger, Notification of Data Security Breaches, 105 MICH. L. REV. 913, 915 (2007). Schwartz and Janger explain that breach notification rules are not necessarily generating a direct market dynamic in which consumers "punish" firms, but an indirect one in which the information regarding breaches flows to the media, legislators, and regulators, and in that way have a delayed, yet substantial effect. Id. at 956.
99. YOCHAI BENKLER, THE WEALTH OF NETWORKS: HOW SOCIAL PRODUCTION TRANSFORMS MARKETS AND FREEDOM 59 (2006), available at http://www.benkler.org/Benkler- Wealth-Of-Networks.pdf.
100. A great deal of popular writing has flourished in these fields. See e.g. CLAY SHRIKY, HERE COMES EVERYBODY: THE POWER OF ORGANIZING WITHOUT ORGANIZATIONS 55, 109 (2008);
101. JAMES SUROWIECKI, THE WISDOM OF CROWDS 85 (2004);
102. DON TAPSCOTT & ANTHONY D. WILLIAMS, WIKINOMICS: HOW MASS COLLABORATION CHANGES EVERYTHING 268 (2006).
103. Peter P. Swire, A Model for When Disclosure Helps Security: What Is Different About Computer and Network Security?, 3 J. TELECOMM. & HIGH TECH L. 163, 168-69 (2004). Swire argues that the benefits of contributing "white hat" hackers will surpass the risks of easily showing the systems shortcomings to the "black hat" ones.
104. Citron, Technological Due Process, supra note 30, at 1308-13.
105. Citron, Open Code Governance, supra note 33, at 366. For a critical view of how these dynamics are applied to the governmental and municipal context, see Shkabatur, supra note 28, at 1419,1436,1443.
106. In other contexts (such as open software source and content projects) scholars indicate that individuals might be motivated by spite to develop products competing to those of Microsoft. In yet other contexts, spite might prove to be a motivator to "get back" at a bad employee or vendor, and in that way inform the public of their wrongdoings. See Shmuel I. Becher & Tal Z. Zarsky, E-Contract Doctrine 2.0: Standard Form Contracting in the Age of Online User Participation, 14 MICH. TELE. & TECH. L. REV. 303,336 n.145 (2008).
107. For a different perspective, which plays down the current level of contribution to open source projects which is altruistically motivated, see generally Jonathan M. Barnett, The Host's Dilemma: Strategic Forfeiture in Platform Markets for Informational Goods, 124 HARV. L. REV. 1861, 1874(2011).
108. See Citron, Open Code Governance, supra note 33, at 383-84 (stating that interested parties of skill will participate in these projects, mentioning reputation as a driver of such actions and participation).
109. ERIC RAYMOND, THE CATHEDRAL AND THE BAZAAR: MUSING ON LINUX AND OPEN SOURCE BY ACCIDENTAL REVOLUTIONARY (1999);
110. Lior Jacob Strahilevitz, "How's My Driving?" for Everyone (and Everything?), 81 N.Y.U. L. REV. 1699, 1701 (2006).
111. Citron, Open Code Governance, supra note 33, at 384-87. In addition, Swire, supra note 181, at 186, explains that the security realm includes specific attributes that make data exposure less severe. Namely, he explains that in many contexts vulnerabilities are apparent to any adversary. Id. at 194. It is interesting to note that the same could be said of some contexts of this discussion as well.
112. Citron, Technological Due Process, supra note 30, at 1292-93.
113. ALAN F. WESTIN, PRIVACY AND FREEDOM 23 (1968).
114. For a critique of this theory, see Paul M. Schwartz, Beyond Lessig's Code for Internet Privacy: Cyberspace, Privacy Control, and Fair Information Practices, 2000 Wis. L. REV. 743, 746.
115. DANIEL J. SOLOVE ET AL., INFORMATION PRIVACY LAW 38 (2d ed. 2006).
116. For a recent discussion of the formulation of Fair Information Practices (FIPs), see ROBERT GELLMAN, FAIR INFORMATION PRACTICES: A BASIC HISTORY (2012), available at http://bob.gellman.com/rg-docs/rg-FIPShistory.pdf.
117. OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, ORGANIZATION FOR ECONOMIC COOPERATION AND DEVELOPMENT (Sept. 23, 1980), available at http://www.oecd.org/internet/ieconomy/ oecdguidelinesontheprotectionofprivacyandtransborderflowso fpersonaldata.htm.
118. See Marc Rotenberg, Fair Information Practices and the Architecture of Privacy (What Larry Doesn 't Get), 2001 STAN. TECH. L, REV. 1, at 14.
119. see also Joel R. Reidenberg, Setting Standards for Fair Information Practice in the U.S. Private Sector, 80 IOWA L. REV. 497,515 (1995).
120. Id. at § 552a (e)(4). See System of Records Notices (SORNs), U.S. DEP'T. OF HOMELAND SECURITY, http://www.dhs.gov/system-records-notices-sorns (last visited May 20,2013).
121. Many have argued that this should change. For a recent and balanced discussion which also takes into account the possible "property-like" attribute of privacy protection, see Paul M. Schwartz, Property, Privacy, and Personal Data, 117 HARV. L. REV. 2056,2060,2076 (2004).
122. For an exception, see The Cable TV Privacy Act of 1984,47 U.S.C. § 551 (2006). See also SOLOVE ET AL., supra note 194, at 191. For an overall mapping of the distinction between the EU and the US regarding this matter, see PETER P. SWIRE & ROBERT E. LITAN, NONE OF YOUR BUSINESS: WORLD DATA FLOWS, ELECTRONIC COMMERCE, AND THE EUROPEAN PRIVACY DIRECTIVE (1998).
123. This right is closely related to the European understanding of privacy and data protection as a notion closely related to metaphors stemming from the works of Franz Kafka; see Daniel J. Solove, Privacy and Power: Computer Databases and Metaphors for Information Privacy, 53 STAN. L. REV. 1393 (2001); (Pubitemid 33646599)
124. MARY DEROSA, DATA MINING AND DATA ANALYSIS FOR COUNTERTERRORISM 14,16 (2004), available at http://csis.org/files/media/csis/pubs/040301-data-mining- report.pdf.
125. Daniel J. Steinbock, Data Matching, Data Mining, and Due Process, 40 GA. L. REV. 1, 23 (2005).
126. The underlying premise of the assumption in the text is that individuals have no expectation of privacy vis-à-vis government (in terms of Fourth Amendment protection) if the information was consensually provided to (even commercial) third parties. Smith v. Maryland, 442 U. S. 735, 743-44 (1979). This notion is known as the "third party doctrine," which is commonly critiqued by legal scholars. See, e.g., Katherine J. Strandburg, Home, Home on the Web and Other Fourth Amendment Implications of Technosocial Change, 70 MD. L. REV. 614 (2011). The days of this doctrine might be numbered, however. Recently, in an important concurring opinion, Justice Sotomayor questioned the wisdom of this rule, by noting how she "would not assume that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment protection." United States v. Jones, 132 S. Ct. 945,957 (2012) (Sotomayor, J., concurring) (emphasis added). If the doctrine is to change, then obviously the statement made in the text must be revised as well.
127. Sherry F. Colb, Innocence, Privacy, and Targeting in Fourth Amendment Jurisprudence, 96 COLUM. L. REV. 1456,1464 (1996). (Pubitemid 126406327)
128. Citron, Technological Due Process, supra note 30, at 1305.
129. For an excellent recent discussion of this issue, see Douwe Korff, Data Protection Laws in the EU: The Difficulties in Meeting the Challenges Posed by Global Social and Technical Developments (European Comm'n Directorate-Gen. Justice, Freedom and Sec, Working Paper No. 2, 2010), available at http://ec.europa.eu/justice/policies/privacy/docs/studies/new-privacy- challenges/final-report-working-paper-2-en.pdf.
130. General Data Protection Regulation, supra note 228, at art. 1. Korff finds that this rule originated from French law, where indeed it was premised upon principles of dignity. Korff, supra note 227, at 82. Lee A. Bygrave, Minding the Machine: Article 15 of the EC Data Protection Directive and Automated Profiling, 17 COMPUTER L. & SECURITY REP. 17, 21 (2001), available at http://folk.uio.no/lee/oldpage/articles/Minding-machine.pdf (noting the threat to human dignity created by automation).
131. For more on this argument, see Tal Z. Zarsky, Governmental Data Mining and its Alternatives, 116 PENN. ST. L. REV. 285 (2012).
132. Citron, Technological Due Process, supra note 30, at 1278.
133. Citron, Technological Due Process, supra note 30, at 1305.
134. Fenster, supra note 152, at 906 (citing James T. O'Reilly, FOIA and Fighting Terror: The Elusive Nexus Between Public Access and Terrorist Attack, 64 LA. L. REV. 809, 812-14 (2004); Scalia, supra note 164, at 15).
135. See Erin Murphy, The Politics of Privacy in the Criminal Justice System: Information Disclosure, the Fourth Amendment, and Statutory Law Enforcement Exemptions, 111 MICH. L. REV. 485,503 (2013); see also Fenster, supra note 152, at 906.
136. A specific discussion arising in this context pertains to the chilling effects generated by using proxies of behaviors which relate to expression and association (such as attending meetings and reading books). For this discussion, let us assume that these factors are not being used. For more on the specific difficult issues the use of such proxies may raise, see Katherine J. Strandburg, Freedom of Association in a Networked World: First Amendment Regulation of Relational Surveillance, 49 B.C. L. REV. 741 (2008);.
137. This tendency is commonly referred to as the "Fundamental Attribution Error," and is also recently referred to as the "Correspondence Bias." See Daniel T. Gilbert & Patrick S. Malone, The Correspondence Bias, 117 PSYCHOL. BULL. 21,24 (1995).
138. For a recent discussion of the importance of understanding context to predict human behavior (and how predictive behavior changes from one context to another), see YOCHAI BENKLER, THE PENGUIN AND THE LEVIATHAN: THE TRIUMPH OF COOPERATION OVER SELF-INTEREST 66-73 (2011).
139. BRUCE SCHNEŒR, BEYOND FEAR: THINKING SENSIBLY ABOUT SECURITY IN AN UNCERTAIN WORLD 38-40 (2003);
140. see Schwartz, supra note 164, at 310-11. For a similar argument, see JEFFREY ROSEN, THE NAKED CROWD: RECLAIMING SECURITY AND FREEDOM IN ANXIOUS AGE 8 (2005).
141. See Adam M. Samaha, Regulation for the Sake of Appearance 125 HARV. L. REV. 1563, 1585-90 (2012).