It was a week that began with carnage and ended with the death of one policeman and the serious injury of another, the death of one suspect and the arrest of another. It was a week that showed the heroism of ordinary people and the courage of first responders. The week was notable for many things, not least of which was a sensible government approach. There was an absence of calls for more controls to prevent future attacks. This past week, very difficult in many ways, was a good week for common sense and privacy, at least as far as the government went.
But if the government did well on the privacy front, others did not. In an attempt to use the power of online communities, people scrutinzed photos and videos of the marathon finish line to find the bombers. They shared their thoughts, their guesses, and their suspicions. The online crowd didn't have the skill or all the tools that law enforcement did, but they had numbers. It seemed as if that might help, but events didn't quite work out that way. Instead innocent people were fingered. A missing student and a pair of friends carrying a backpack and a weighted-down shoulder bag were identified as potential suspects, in one case with photos appearing on the front page of the New York Post. But these individuals had nothing to do with the attacks.
In a matter of a few years, online social networks and the power of the Internet and search have changed the public's ability to determine, "What do we know? And how do we know it?" Sometimes, such as when Google uses search data to discover flu epidemics even before the Centers for Disease Control and Prevention has the relevant data from doctors and hospitals, the use of such information is quite beneficial. But sometimes online data can be wrong. Or its use can simply be grievously invasive of an individual's privacy.
There's been lots of discussion about how governments and industry can misuse the social network information. The result is many laws and regulations constraining these players. Government investigators are limited by everything from laws on the books to investigatory guidelines. (Whether these are sufficient -- and I think not -- is not the point of this post.) In the U.S., the Federal Trade Commission (FTC) has fined Facebook and Google for privacy violations. But no one constrains the public against infringing against individual's privacy rights.
A little over one hundred and twenty-two years ago, two Boston lawyers, Samuel Warren and Louis Brandeis (the latter later became a Supreme Court Justice), wrote a now famous essay on "The Right to Privacy." Concerned about the development of new, privacy-invasive technology -- lightweight, portable cameras -- and the simultaneous rise of yellow journalism, they wrote, "That the individual shall have full protection in person and in property is a principle as old as the common law; but it has been found necessary from time to time to define anew the exact nature and extent of such protection," and "Even gossip apparently harmless, when widely and persistently circulated, is potent for evil. It belittles and perverts."
These words resonate after the events of last week. The suspicions cast on the two friends and the missing student were not harmless. Given the fear and anger last week, such misinformation had the potential to do much more harm than the social gossip that motivated Warren and Brandeis's article. The New York Times reported that Boston Police Commissioner Edward Davis said part of the reason authorities released photos of the suspects was to prevent the problems being caused by the "online vigilante detectives."
The question is what is to be done. Since Warren and Brandeis's article, we have developed such powerful tools that very private information about people can be concluded by strangers -- often without the knowledge of the individuals involved. Several years ago two MIT students showed how one could determine a person's sexual orientation using public information about their family, friends, and acquaintances. The Obama campaign relied heavily on techniques that used an individual's publicly available data to predict their voting preferences. Few people realize how much can be determined about their very private preferences from their public information.
We constrain government and business use of such data because of their power over individuals. That is reflected in the Fourth Amendment of the U.S. Bill of Rights, in the 1974 Privacy Act (now badly in need of updating), in our laws on criminal investigation, in the Code of Federal Regulation (which puts further restrictions on investigators), in the FTC's enforcement mechanisms, and through various sector-specific privacy laws.
In the U.S., we have no such restraints on private individuals' use of private data of others'. Freedom of speech is a protected right in the United States, and I would not have it any other way. But the world in which we live is a very different one from a decade ago. It is a world in which information about divorces, adoptions, and real estate transactions, information found once only in courthouses, is now on the Internet, in which knowledge of a person's place of employment and college, which once needed a personal connection to determine, is now available online. Where photos of people standing at the finish line at the Boston Marathon once resided on people's cameras, they now reside in the cloud, accessible by millions. In our new world, very private information about an individual can be put together instantly from publicly available sources. In this new world, it is not only government and business who should abide by good privacy practices; it is the public who has such responsibility as well.
Over three centuries ago Voltaire wrote, "With great power comes great responsibility." Online social networks, search, and the Internet have given the public great power. Now we must learn to use that power with care. Few people choose to live their lives in a fishbowl; private citizens have the right to expect that their private lives are private. For the public, exercising privacy should not only include what information you choose to present about yourself, but about what actions you take in exposing information about others. Even if disparate bits of information about those others are "public" in some sense, if the person is not "public," then the amalgamation of the data about them should not be either.
Internet technologies are here to stay. We must learn to adopt our use of them in order to preserve the private boundaries that almost all of us want and need in order to go about our daily business. Warren and Brandeis wrote the "right to life has come to mean the right to enjoy life," including "the right to be let alone." We would do well to follow the wise precepts laid down by two Bostonians a century and a quarter ago.