Privacy implications of automated monitoring and data tracking technology

Automated Banking in Our Future

Privacy's advent in the technological era

Information technology (it) has changed and modified life throughout the world. In fact, it has redefined "the world." Neighbors now reside thousands of miles apart. Strangers live next door.

Almost every aspect of our lives is affected daily by tremendous increases in computer processing, inter-connectivity, data mining, and the resulting availability and exploitability of information on each of us as often unknowing and unsuspecting civilians.

Automated or managed monitoring and recording of every private daily transaction has already skyrocketed well beyond what most people understand and this trend will continue to increase, and personal privacy as we have understood it in the past will be challenged and even forgotten in many circumstances.

Relying on his vast knowledge of trends, Potomac Institute symposiast David Brin remarked summarily, but deliberatively: "Get over it." (Brin, 2001) According to McBride's research, "From the perspective of technological innovation, the inevitability of Brin's suggestion might be inescapable. Digital face recognition technology, for example, is remarkably capable in large crowds and at appreciable range. Authorities are already deploying this maturing brand of it even as organized and other elements of American citizenry question the use of significantly less sophisticated tools -- automobile license plate identification as an example, to associate people with automobiles with places -- for multiple uses in law enforcement." (McBride, 2003)

That is why there is ample rationale to anticipate that this portends even worse in the future. Accoridng to McBride and Brin, signals as personal as body odor may soon be exploited for detecting, identifying, or tracking suspicious individuals in high-risk environments. It is probably forevermore beyond "just conceivable" that organizations will face fewer and less expensive technical barriers to analyzing an individual's whereabouts and actions of today, in 2003, as they may be "recalled to life," as Dickens wrote in "A Tale of Two Cities," decades and centuries in the future.

The business community always uses advanced it in search of entirely legitimate purposes. Internet-delivered product "suggestions" may appear to be simply botherances to some, or time-savers to others, but the inferencing technology that underlies this marketing technique is as straightforward as it is effective.

Software builds models of people based on seemingly private (shopping) behavior. Algorithms are implemented worldwide by the banking and credit card industry with an end to decreasing fraud and protecting customers, here once more by "profiling." As McBride writes, "Benign and blind as the technology trends may seem in clear circumstances, applications in contexts that are not understood by those who are not voluntarily party to the scheme can appear threatening to personal freedoms. For example, in order to minimize retail loss (shoplifting), one international razor blade manufacturer has pursued the idea of embedding radio-frequency identification devices (RFIDs) in its product packaging." (Fitzgerald, 2003 and McBride, 2003)

Even though in today's the effective range for detecting and reading RFIDs is a matter of inches, concerns of privacy are predictable, rational, and they are already growingly organized through privacy groups.

Concerns of privacy protection from corporate meddling are not philosophically different from concerns about intrusions from fellow citizens. Having received an unwanted voice mail prank at the Potomac Institute, McBride notes that an irritated junior researcher -- in a matter of minutes and clicks -- produced a "file" on the perpetrator, including his home address, age, school and class photo, and the names of his parents, their employment and civic membership, all packaged with the prankster's voice message, ready made for electronic or U.S. Postal Service shipping to the person's parents. (McBride, 2003)

Moreover, as McBride points out, "Defiantly, a senior staff member declared that he was entirely immune from similar search. In short order, a "dossier" was produced with most of the above categories of information, including a downloaded overhead image of the staffer's suburban home, and of course minimum-effort driving directions complete with the residential telephone number, otherwise bought and paid for as "unlisted." (McBride, 2003)

McBride notes that in the experiment, the file production was stopped before mortgage and other information was appended. All of the above tasks and intrusions were accomplished with routinely accessible data-mining software obtained over the Internet. This is not black market software -- it is largely free and entirely available from top-drawer companies.

The societal ramifications of the examples noted may pale in comparison to the consequences of gathering data as vitally personal as DNA (the government already owns genetic data on military personnel) or other biomedical data for the examination of insurance availability, job qualification, or myriad other largely unregulated purposes. Regulation in any facet, indeed, implies oversight by the government; in the present case, this means protection by the government against possible and therefore permanent government intrusion. (McBride, 2003)

Within the course of privacy regulation, what is the most fundamental of landmarks in our constitutional history was the post-Watergate passing of the Privacy Act of 1974.

This act was constructed to rectify widely acknowledged shortcomings in privacy protection, one arguable consequence was that the act is in practice, weak and difficult to enforce. The American Civil Liberties Union (ACLU), in fact, maintains that on balance, there may be more ill-advised intrusion than ever intended by this statute. The ACLU is unexcelled in its analysis and passionate pursuit of privacy matters; however today, many more groups such as the Privacy Institute have emerged as even more left-wing protectors of privacy issues, especially on the banking level.

Indeed, ACLU documentation of minimally impeded intrusion into "personal" records (including social security, school records, electronic communication -- as well as criminal histories) demonstrates lear public concern for privacy protection -- more so now than ever as information technology tentacles increasingly reach and penetrate our sensitivities.

As McBride writes, "But intrusion cannot be examined on its face value alone. As Amitai Etzioni has written compellingly, the realities of ambitious life will always require balance (perhaps to also mean efficacy and safety). The risks of inappropriate meddling must be squared with the risks of inappropriate neglect. Are parents justified in discovering from government fries or officers that the house they are about to purchase and move into -- with their 10-year-old daughter -- sits next door to the home of a multiple episode sex offender? An emotionally informed answer might certainly be "yes" but what if there is an error? Suppose the neighbor is not a rapist; he is clinically depressed, suicidal and fatally sensitive to being ostracized. As Etzioni outlines with clarity, a reformulated concept of "common good" must be derived and made central to balancing privacy and security: This is particularly defensible in the era of expansive, high access it." (McBride, 2003 and Etzioni, 1999)

Transactional data will serve an increasingly important role in national and local security efforts for identifying and slowing and mitigating criminal behavior. Public acceptance of this enterprise is positive and probably growing since the late summer of 2001, and then of course after the advent of the new age of terrorism after the events of September 11 of that year.

Prosecutorial pursuit of criminals occurs, however, groundedthe presumption of universal innocence. The correctexploitation of all transactions thus requires security and privacy policies to protect the rights of Americans, suspects or otherwise, consistent with the letter, and spirit of law. The "law" is a lot more than just the Fourth Amendment, and its spirit as a whole is much greater than the sum of its case law parts. Although beyond the scope of this document, it is entirely feasible to guess that most Americans don't know much about privacy theory or privacy law, but as the Supreme Court justices argued about pornography, they seem to know what they want - and they are adamant about protecting that.

According to McBride's research, "Whereas U.S. citizens seem willing to sacrifice some degree of privacy for some payoff in security, there may be few universally agreeable solutions in practice. As one example, reports of fairly streamlined examination of passengers at airport security screens suggests that reluctance to disclose contents of bags, shoes, and garments is offset by the desires for safe flight." (McBride, 2003)

In recent months and years, however, researchers discovered that passengers were significantly less willing to be weighed (because of privacy matters) for the purposes of aircraft loading -- a management process that is vitally important to safe flight, particularly for small aircraft.

As a result, privacy is more valued in issues of the person; but it is sacrificed for protection from terrorism, but not other causes of ills and harms. This, despite the fact that center of gravity loading errors are statistically a far greater danger than the untoward prospects of in-flight terrorism.

The confrontation of arriving at a balance between privacy and security is not a new challenge indeed. Our democracy has met, solved, or held in compromise this challenge many times, through many technological eras and through many legal regimes over the decades and centuries.

Occasionally, technological discoveries and changes have resulted in maturational change in statutory or regulatory context, and on other occasions, modifications in constitutional interpretation have become the enzyme of technological innovation. In either case, privacy issues were known to be much more complicated than mere issues of personal secrecy. In fact, as Richard Posner suggested more than 20 years ago, there is a fundamental economics of personal privacy -- an economics that is in large part responsible for, and untiringly organic to, our Constitution.

It is feasible, therefore, that there are rudimentary, biological, economic bases at the very roots of humankind's insatiable desire and need for privacy and security. (Posner, 1983)

As McBride's research further indicates, "In 2002, the Potomac Institute for Policy Studies initiated Project Guardian: Maintaining Civil Liberties in the Information Age. The effort is aimed at shepherding discussion from all qualified voices on issues central to the tradeoff between privacy and security, particularly as this balance is threatened, or is perceived to be compromised, by advances in technology. Guardian is enriching the discussion by establishing a rigorous, multiway forum for scholars, policy professionals, and everyday citizens by distilling opinions to reveal core facts, laying bare unchallenged assumptions, and by honoring but qualifying disparate attitudes. The program will seek meaningful policy options so that appropriate decisions can be made -- not at all absent opinion -- but by building upon objective analysis and by submitting rigorously informed opinion." (McBride, 2003)

What do we do about it?

What is the proper response to this, the newest twist in the privacy wars? A federal regulatory proposal would bring Big Brother to your bank, where he would be counting more than just your pennies.

George Orwell hit the nail on the head in his dystopia novel Nineteen Eighty-Four, but he simply missed the mark by a decade. Big Brother wants bankers to create a dossier on every account holder. And a federal regulatory proposal dubbed "Know Your Customer" could do just that by turning bank tellers into snoops. Indeed, today it sounds like an episode from the X-Files, but in reality, it is exactly what banks are fighting for to protect privacy and continue to do business.

This indeed is the welcome to the Orwellian dawn of the 21st century, where the lost age of Aquarius has become the new age of surveillance, bolstered by electronic cascades of personal information that are ever more readily accessible. According to Maier's research, "Both liberals and conservatives increasingly are concerned about a society they fear is all too willing to surrender another layer of privacy in exchange for a false sense of security.

Across the nation - in Maryland, for instance -- camera cops are replacing the squad car. In New York, witnesses are frisked like suspects as part of a crackdown on violent crime. In New Jersey, critics charge that "Megan's Law" which requires child sex offenders to register with the local cops, turns neighbors into spies and vigilantes. In Chicago, U.S. Customs agents routinely strip search and probe body cavities of black females traveling internationally if authorities believe they fit a certain profile." (Maier, 1999)

If this scare is not personal enough, one need simply ask one's local motor-vehicle administration if they are selling your driver's-license photograph and personal data. For those who live in South Carolina or Florida, the authorities there have sold some 17 million such photographs to a New Hampshire company, claiming to be building a national database to identify theft.

According to Maier, on Capitol Hill, medical-identity cards and even universal identity cards top political agendas, while the Federal Communications Commission hopes to turn your wireless telephone into a personal tracking device so the government can keep tabs on you -- for your own protection and privacy, of course. And personal computers built by Intel Corp. were to contain silicon chips allegedly to protect electronic transactions but, as it happens, also to let marketers track consumers' every move in cyberspace.

As a result, it should arrive as no revelation that your trusted banker has been enlisted by Big Brother to help him watch every financial move you make. The Federal Deposit Insurance Corp., or FDIC, the Federal Reserve System, the Office of the Comptroller of the Currency and the Office of Thrift Supervision are frighteningly vague about how your banker should implement the program. According to Maier, "However, the rule published Dec. 7, Pearl Harbor Day, in the Federal Register calls for uniform banking procedures to identify customers, establish their sources of money, note their "normal and expected transactions" watch for transactions that are inconsistent with the customer's "normal and expected transactions" report any transactions that are determined to be suspicious and place limitations on amounts that can be withdrawn at any one time." (Maier, 1999)

The regulators say Know Your Customer snooping is for your own good. The banks say they do not actually support it through and through. After all, it is costly and burdensome and an invasion of privacy, says John Byrne, senior counsel and compliance manager for the Washington-based American Banker's Association, or ABA. (Maier, 1999)

Byrne claims that it is not fair that banks are required to do this while broker dealers, insurance agencies and security dealers don't operate under the same requirement. He sees it as a substantial cost to community banks, which would be required to purchase hardware and software programs to conduct all of the spying. "We are concerned about the language of the proposal," Byrne says. "It's an intrusive requirement that banks are going to profile customers." (Maier, 1999)

So indeed, why should bankers be turned into federal snoops? The proposal is supposed to attack money-laundering techniques employed by drug traffickers and other criminals who hide illegal profits. Such methods include wire transfers, bank drafts and "smurfing," the practice of cutting transactions into lesser amounts that don't have to be reported as suspicious under the $10,000 bank-reporting laws established under President Reagan. (Maier, 1999)

In today's post-9/11 world, automated banking holds even more promise for detectives and anti-terrorism experts as they try to stop terrorism funding. After all, the 9/11 terrorists had to raise the money to buy plane tickets, train to fly and maintain their lifestyles, and with tabs on all electronic purchases, transactions and banking, the government would be better able to do just that.

According to Richard Small, assistant director at the Federal Reserve and author of the proposed regulation, it simply will not be as unbelievably costly as many bankers believe. Take that small bank in Kansas, he says. "They know everyone. They know the person. They may not have to tell them to show a driver's license. They aren't going to have to buy a new computer or software. We just want them to formalize their policy." (Maier, 2005)

In fact, Small says most banks even today have Know Your Customer programs in place. Indeed, a 1990 ABA survey claimed that 86% of the ABNs membership already employed such policies. One of those doing so is Terre Haute Savings Bank in Indiana. This bank publishes a list of suspicious banking activities, such as customers unwilling to provide identification information or a borrower who pays down a loan with no explanation of the source of funds. (Maier, 1999)

It is easy to examine how this Indiana bank's efforts would assist the FBI in tracking down would-be terrorists.

As many banks and citizens are complaining about the proposed rule as an invasion of privacy, most see no problem with asking customers who aren't account holders to put their thumbprint on the check, Small observes. More than 16 states have adopted this as a rule, though it is not (yet) mandated by federal regulatory agencies. "I haven't heard any uproar about that," he says. (Maier, 1999)

Byrne argues that is different. Banks that mandate it are protecting their customers by reducing check fraud, he says, noting that banks requiring fingerprinting have reported a 40% to 50% drop in fraud since implementing the practice. "The fingerprints don't go anywhere" unless the check doesn't clear, he says, and this is the sentiment expressed by many experts. (Maier, 1999)

According to Maier's research, "Account holders, known to the banks, may not mind because they aren't being fingerprinted. But what about future customers? Sharon Weidenfeld, a Maryland private investigator, was a potential customer for NationsBank. That is, until she was ordered to surrender her thumbprint to cash a check there. "I thought they were going to take my mug shot next and it would be hanging on the post-office wall next week," says Weidenfeld.

While fingerprinting as an internal policy may be some banks' idea of getting to know their customers, Small says the proposed rule is needed to ensure all banks and savings institutions have consistent policies. "Right now there is no standard or baseline," Small says. "We want to set up that baseline. We want a system to understand and identify the customer." (Maier, 1999)

Conclusion

So the changes in technology impose many challenges on the banking industry, and most are owing to privacy concerns. The business has changed entirely since 9/11 with automated banking features both helping in tracking terrorists, and helping terrorists accomplish what they want to.