4 ms·

I should explain how this process works, and how I wound up giving this testimony. Basically, a staffer on the committee found me online, was interested in my

I should explain how this process works, and how I wound up giving this testimony. Basically, a staffer on the committee found me online, was interested in my ideas, and asked for a phone call. A couple of days later, he scheduled a second phone call, this time including the committee chairman's staff from the opposing party. I got a formal invitation to appear with about eight days' notice, along with a request for written testimony on specific topics. You pay your own way to get to D.C. for the hearing. The testimony was due 24 hours before the hearing, so that staff had a chance to review it and plan their questions. In the hearing, there is a two-hour block of time, and senators each get five minutes to ask questions, alternating parties, in order of seniority. Some of them want to know stuff, others want to read a statement into the record. You get a glass of ice water and a little countdown clock at your desk that tells you when the five minute blocks of time are up. At the start of the process, the three witnesses each get a five minute opening statement. In my hearing, we had a former diplomat and expert on the GDPR, and someone from the financial industry. The hearings are open to the public and if you are in D.C., you should attend one! It is quite a spectacle! I'm very thankful to Matt Blaze and others who wrote about what hearings are like, to help me prepare for this. And I am happy to answer questions in turn.

skrebbel 7y ago
I watched a portion of the video, and I get the impression that the people asking the questions appear to have a pretty good idea what they're talking about. Do you feel the same? Those are the senators, right? Gives some good hopes for the future.
- Permit 7y ago
  > I get the impression that the people asking the questions appear to have a pretty good idea what they're talking about This video is edited so perhaps it's misleading, but I did not get that sense at all: https://www.youtube.com/watch?v=t-lMIGV-dUI https://www.youtube.com/watch?v=t-lMIGV-dUI Edit: As mentioned below this is not from the same hearing. I interpreted skrebbel's praise more generally and the representatives in these clips didn't inspire much confidence.
  - skrebbel 7y ago
    That's.. different people in a different hearing.
    - deleted 7y ago
      [deleted]
    - drilldrive 7y ago
      Not to mention the editing cut footage mid-sentence. I can't watch something like that.
- idlewords 7y ago
  Those are all senators, yeah. They have staff experts who brief them for these hearings so they can go into knowing what they want to ask (or say), as well as what they are likely to hear. The level of staff expertise is extremely high, and the senators themselves are no fools. They are used to regulating the financial industry, which is even more slippery than big tech.
  - YokoZar 7y ago
    Perhaps today's Senators have learned not to completely wing it - we're a long way from the "series of tubes" era.
    - lostlogin 7y ago
      Perhaps in the legislative branch, the executive branch suffers no such limitations. Eg. https://www.whitehouse.gov/briefings-statements/remarks-president-trump-marine-one-departure-30/ https://www.whitehouse.gov/briefings-statements/remarks-pres...
sjackso 7y ago
I'm really glad that US senators are hearing your perspective on these issues. Thank for putting in the time and for your patience with their endless name-mangling. :) Do you feel any more or less optimistic about what's coming in privacy law, having done this? Any part of the experience that was especially surprising? Edit: wording.
- idlewords 7y ago
  There seems to be a strong desire for regulation, which gives me some hope. On the other hand, the big tech companies have a massive lobbying operation in D.C., and I'm not naive enough to think my testimony will have much effect. I was ready for the questioning to be far more adversarial. That was a very pleasant surprise. Another surprise was the party imbalance—many of the Republican senators did not attend. My sense is that the current direction in drafting privacy law is "GDPR lite", on the basis that 'everybody owns their data'. I don't think that framing works, but it seems to have captured many of the senators' imaginations. I believe the time pressure for regulation is coming from the California law, which will go into effect in 2020 unless pre-empted by Federal regulation. In principle, the privacy issue cuts across party lines and could have a real bipartisan consensus form around it. In practice, we live in polarized times. I am not optimistic, but we have to try our best.
  - kevin_thibedeau 7y ago
    What is likely to happen is that new internet based companies will be snubbed to appease the latest round of pitchfork masses. Much like how Equifax got away without punishment, nothing will be done for the entrenched data broker industry which has been invasively profiling consumers since before the internet was invented. Where Faceboock mostly collects it's data via voluntary submission in exchange for a free service, traditional data brokers get their mitts on it without any consent. They are the real demons. I'm sure their people are working behind the scenes to keep the attention focused on Facebook so that legislative theater can make it look like something is being done without affecting their bottom line.
    - 7y ago
pantaloons 7y ago
In your written testimony, the goals for privacy regulation seem quite watered down from past proposals of yours like prohibiting behavioral ad targeting, or eliminating data brokers altogether. Does this represent a shift in what you think is reasonable, or achievable, or just language tailored for the audience?
- idlewords 7y ago
  I wanted to stay within the parameters of the hearing, and also talk about stuff that I thought had a fair chance at getting bipartisan support (like regulation for making binding voluntary commitments about privacy). I don't think I've watered down my proposals, but I think choosing winnable battles is important now that the legislative wheels are turning. For example, I think a good way to get rid of behavioral ad targeting is to give publishers a way to demonstrate that they make more money by not doing it (like we saw with the NYT in Europe).
OrwellianChild 7y ago
Many thanks for taking advantage of your opportunity to give a thoughtful and reasoned statement to the committee! Your advocacy of late has done a lot to raise the profile of these privacy issues, and you've been able to keep your explanations clear and understandable. That's not easy, and you've clearly taken time to prepare your critiques. This extends to your Tech Solidarity [1] work, coaching politicians and journalists... (Thank you for updating/clarifying your recommendations last month to keep it current!) Your Tech Solidarity security guidelines are purely defensive in nature, while this testimony was much more proactive and forward-thinking... Have you given consideration to spending more of your time lobbying in favor of specific legislation or educating politicians about these topics on a longer term basis? You seem to have their ear, and could conceivably fundraise around these issues. (I realize the personal commitment it would require on your part - just curious whether you're thinking about next steps...) In the meantime, are there things that average internet citizens can do beyond following the Tech Solidarity guidelines to both protect their own privacy and also support/advocate for progress on these issues? I can pretty easily block trackers, use 2FA, use HTTPS Everywhere, but as you've articulated in your testimony, what we really need is a sort of "herd immunity" like what vaccines attempt to achieve. How do we get there from here? [1] https://techsolidarity.org/resources/basic_security.htm https://techsolidarity.org/resources/basic_security.htm
- Despegar 7y ago
  >In the meantime, are there things that average internet citizens can do beyond following the Tech Solidarity guidelines to both protect their own privacy and also support/advocate for progress on these issues? Focusing on tech solutions is a band aid to a systemic and structural problem that can only be addressed in law. That's why GDPR is good and why Congress grappling with passing privacy legislation is good.
  - ethbro 7y ago
    Coming up with proof of concept technical solutions is a good first step. It helps determine facts about the problem (What type of trackers are used? How widely? What changes when they're blocked?), which is critical for quality legislation.
mlb_hn 7y ago
At ~53:00 or so Mr. Brown asked about the impact of analytics on newspapers. You pointed out that the newspapers are basing editorial decisions on the analytics (article metrics). As we all know, click-fraud's a huge problem on the internet. Have you come across any recent numbers on click-fraud in the newspaper analytics? It seems like if your description is accurate, if I wanted more stories about a topic I could just have a botnet give those articles lots of views.
- idlewords 7y ago
  This information is very jealously guarded. The best public info I know of is here: https://cdn2.hubspot.net/hubfs/3400937/White%20Papers/ANA_WO_BotBaseline2016-2017.pdf https://cdn2.hubspot.net/hubfs/3400937/White%20Papers/ANA_WO... I'd welcome any other info, public or not so public, people care to share.

skrebbel 7y ago

I watched a portion of the video, and I get the impression that the people asking the questions appear to have a pretty good idea what they're talking about. Do you feel the same? Those are the senators, right? Gives some good hopes for the future.

Permit 7y ago
> I get the impression that the people asking the questions appear to have a pretty good idea what they're talking about This video is edited so perhaps it's misleading, but I did not get that sense at all: https://www.youtube.com/watch?v=t-lMIGV-dUI https://www.youtube.com/watch?v=t-lMIGV-dUI Edit: As mentioned below this is not from the same hearing. I interpreted skrebbel's praise more generally and the representatives in these clips didn't inspire much confidence.
- skrebbel 7y ago
  That's.. different people in a different hearing.
  - deleted 7y ago
    [deleted]
  - drilldrive 7y ago
    Not to mention the editing cut footage mid-sentence. I can't watch something like that.
idlewords 7y ago
Those are all senators, yeah. They have staff experts who brief them for these hearings so they can go into knowing what they want to ask (or say), as well as what they are likely to hear. The level of staff expertise is extremely high, and the senators themselves are no fools. They are used to regulating the financial industry, which is even more slippery than big tech.
- YokoZar 7y ago
  Perhaps today's Senators have learned not to completely wing it - we're a long way from the "series of tubes" era.
  - lostlogin 7y ago
    Perhaps in the legislative branch, the executive branch suffers no such limitations. Eg. https://www.whitehouse.gov/briefings-statements/remarks-president-trump-marine-one-departure-30/ https://www.whitehouse.gov/briefings-statements/remarks-pres...

sjackso 7y ago

I'm really glad that US senators are hearing your perspective on these issues. Thank for putting in the time and for your patience with their endless name-mangling. :) Do you feel any more or less optimistic about what's coming in privacy law, having done this? Any part of the experience that was especially surprising? Edit: wording.

idlewords 7y ago
There seems to be a strong desire for regulation, which gives me some hope. On the other hand, the big tech companies have a massive lobbying operation in D.C., and I'm not naive enough to think my testimony will have much effect. I was ready for the questioning to be far more adversarial. That was a very pleasant surprise. Another surprise was the party imbalance—many of the Republican senators did not attend. My sense is that the current direction in drafting privacy law is "GDPR lite", on the basis that 'everybody owns their data'. I don't think that framing works, but it seems to have captured many of the senators' imaginations. I believe the time pressure for regulation is coming from the California law, which will go into effect in 2020 unless pre-empted by Federal regulation. In principle, the privacy issue cuts across party lines and could have a real bipartisan consensus form around it. In practice, we live in polarized times. I am not optimistic, but we have to try our best.
- kevin_thibedeau 7y ago
  What is likely to happen is that new internet based companies will be snubbed to appease the latest round of pitchfork masses. Much like how Equifax got away without punishment, nothing will be done for the entrenched data broker industry which has been invasively profiling consumers since before the internet was invented. Where Faceboock mostly collects it's data via voluntary submission in exchange for a free service, traditional data brokers get their mitts on it without any consent. They are the real demons. I'm sure their people are working behind the scenes to keep the attention focused on Facebook so that legislative theater can make it look like something is being done without affecting their bottom line.
  - 7y ago

pantaloons 7y ago

In your written testimony, the goals for privacy regulation seem quite watered down from past proposals of yours like prohibiting behavioral ad targeting, or eliminating data brokers altogether. Does this represent a shift in what you think is reasonable, or achievable, or just language tailored for the audience?

idlewords 7y ago
I wanted to stay within the parameters of the hearing, and also talk about stuff that I thought had a fair chance at getting bipartisan support (like regulation for making binding voluntary commitments about privacy). I don't think I've watered down my proposals, but I think choosing winnable battles is important now that the legislative wheels are turning. For example, I think a good way to get rid of behavioral ad targeting is to give publishers a way to demonstrate that they make more money by not doing it (like we saw with the NYT in Europe).

OrwellianChild 7y ago

Many thanks for taking advantage of your opportunity to give a thoughtful and reasoned statement to the committee! Your advocacy of late has done a lot to raise the profile of these privacy issues, and you've been able to keep your explanations clear and understandable. That's not easy, and you've clearly taken time to prepare your critiques. This extends to your Tech Solidarity [1] work, coaching politicians and journalists... (Thank you for updating/clarifying your recommendations last month to keep it current!) Your Tech Solidarity security guidelines are purely defensive in nature, while this testimony was much more proactive and forward-thinking... Have you given consideration to spending more of your time lobbying in favor of specific legislation or educating politicians about these topics on a longer term basis? You seem to have their ear, and could conceivably fundraise around these issues. (I realize the personal commitment it would require on your part - just curious whether you're thinking about next steps...) In the meantime, are there things that average internet citizens can do beyond following the Tech Solidarity guidelines to both protect their own privacy and also support/advocate for progress on these issues? I can pretty easily block trackers, use 2FA, use HTTPS Everywhere, but as you've articulated in your testimony, what we really need is a sort of "herd immunity" like what vaccines attempt to achieve. How do we get there from here? [1] https://techsolidarity.org/resources/basic_security.htm https://techsolidarity.org/resources/basic_security.htm

Despegar 7y ago
>In the meantime, are there things that average internet citizens can do beyond following the Tech Solidarity guidelines to both protect their own privacy and also support/advocate for progress on these issues? Focusing on tech solutions is a band aid to a systemic and structural problem that can only be addressed in law. That's why GDPR is good and why Congress grappling with passing privacy legislation is good.
- ethbro 7y ago
  Coming up with proof of concept technical solutions is a good first step. It helps determine facts about the problem (What type of trackers are used? How widely? What changes when they're blocked?), which is critical for quality legislation.

mlb_hn 7y ago

At ~53:00 or so Mr. Brown asked about the impact of analytics on newspapers. You pointed out that the newspapers are basing editorial decisions on the analytics (article metrics). As we all know, click-fraud's a huge problem on the internet. Have you come across any recent numbers on click-fraud in the newspaper analytics? It seems like if your description is accurate, if I wanted more stories about a topic I could just have a botnet give those articles lots of views.

idlewords 7y ago
This information is very jealously guarded. The best public info I know of is here: https://cdn2.hubspot.net/hubfs/3400937/White%20Papers/ANA_WO_BotBaseline2016-2017.pdf https://cdn2.hubspot.net/hubfs/3400937/White%20Papers/ANA_WO... I'd welcome any other info, public or not so public, people care to share.