Questions from the back cue. Were using the microphone in the back of the room. And again, general rules. If one can identify ones self, we get cracking. Steve wu again. I wanted to thank you for your thoughtprovoking paper. One of the things ive been thinking about is generally the transition from physical to digital and how the law doesnt seem to have caught up. And the example that i give is in the 1990s when i was really first thinking about the internet and i was trying to do, quote unquote, computer law, i saw some of the cases having to do with Insurance Coverage for the loss of some kind of data center. And a claim was put in by the insured to seek compensation for not only the loss of the hardware but also the loss of the data. Of course policies werent very sophisticated at that time but the courts said you can cover for the loss of the hardware but data intangible and not covered by the eyes of the policy and in the eyes of the court, this data have no worth. And im saying to myself, its all about the data. I think youre seeing the same kind of thing with this transition from reading physical papers to reading peoples emails. Its all about the data. That might be something to think about in terms of further refining your draft. The other this evening i would give you a little bit of a practicers data point, which is what youre writing about has real difference in part because for the first time last week in a contract negotiation, which im trying to help negotiate an agreement for an internetbased service, a customer of the Service Wanted to impose a term on us saying that if we, my client, becomes aware of government surveillance that, we have an obligation to notify the customer. I mean mass surveillance, completely mass surveillance, that my customer i have an basically take on the nsa. And i applaud the opposing counsel for coming up with the idea and jumping on the issue of top call importance, on the other hand it was quite a burden on my client. Yet youre seeing something straight out of the news go into a contract negotiations and so what, you know, if this program didnt exist, my client wouldnt be incurring these expenses. So i agree with you totally about the data versus hardware question. I was just at a conference in toronto where one of my nell fel owe fellow attendees had lost her laptop, she had it stolen and she was talking about how she had a chapter of her book and she just lost it. We were talking about the fact that there should be a repository. Youre like just give me my data back and i wont file charges on the computer. On the first part about the law, its a truism. The law isnt fast enough to keep up with the technology. Technology is changing much faster than our dock tren can keep up. Luckily in a lot of ways, on a lot of these eissues, we have ready metaphors like cyberspace, that help us grapple with these things. In the issues of the e. C. P. A. , it protects our data in the cloud. And weve been arguing for years and i think its a strong argument that the data we store in the cloud should be treated the same way as the data we store at home in our personal file cabinets. Even with a ready metaphor, its taken many, many years. Were lucky we have a bevy of physical metaphors and simply the idea of millions of people sitting there reading everyones email, that we have some pretty strong arguments by analogy to make. What freaks me out is when the Technology Gets so weird that ready physical analogy there are no ready physical analogies. We can barely keep up with the easy issues and i consider this to be actually one of the fairly easy issues, when things get really, really weird such that theres no ready analogy to the physical world, thats when not only is the law not keeping up, its falling far, far, far, far behind. Ill just make one point on the contract negotiation. We sent out a program where they go to the providers and ask for information and then the back bone program that we tackle throughout the whole paper that theyre just getting information off the wires. Its hard for providers to know that information taken off the back bone is being taken off. So you wont get that notice that the program is even happening given to the provider but what i think that were moving toward is a world where theyre in contracts it is you have to secure our data as to the point where it cannot be picked up the wire in any readable format. Thats something were not necessarily looking at where there is a huge problem with authorized access and how much information governments are requesting for companies but also them going around companies and getting information off the back bone and what you should do to make sure this cant happen anymore. On the first point, the physical digital, the first part answers the second. You said on the one hand data has enormous value but securing date kra is costly. It it may not warrant canaries for everyone but what a fantastic legal rule that work at least from my perspective. But the fact that data does create all this value but also creates risks to the companies but also to the users whose date kra is being safeguarded i think actually does cancel itself out to some extent and argue its okay to impose renl obligations of privacy and security on private entities and it shows how this is not just a government problem or a government versus citizens problem. The intermediaries are an important part of the puzzle. On the metaphors, we can call it a robot here, we can call it an agent, we can call it a device. We can call it the cloud, which sounds very airy and puffy. We can also call it the vault or the data locker. Compare icloud to drop box and the various senses that con oates about security. And my overriding point today is that the choice of those matters and the choice is important and the choice is natural and weep should make those choices consciously, not because weve been using the met for before but because the met for helps to us capture the human and legal and social values at stake and that we cannot let our metaphors get in the way of our values. Woody . Hi. Stanford universitys Cumberland School of law. I loved this paper and i especially loved, amy, your take on the reasonable expectations of privacy and you said it should be chucked and i agree with you. We cant decide what privacy means, if it means anything. On that point i actually would like to pick up on what neal said, which is its important to create a story and its important to create a narrative. I actually think that you may have the beginnings of a very interesting narrative that i havent seen played out yet. And i wonder if you could draw upon that a little more. So one of the big problems with privacy is we dont know what it means and can you define it seven different ways. But one of the ways is the right to control information and this idea of control. But that doesnt work when were talking about surveillance because youve already lost control the moment you hit send. So we say, okay, that doesnt account for surveillance because surveillance isnt an issue about controlling information. Its picked up along the way, you know, theres control lost, then your information is traveling along, then the privacy harm happens. But the talking about the metaphor of the nfl, which i really loved and it was very intuitive to me, i wonder if the story that youre creating here is that the harm from surveillance actually occurs when control is gained by another. So not loss of control but rather an others gaining of control, because thats really what enables the harm here and it allows us to talk about privacy harms in a certain kind of way, a way in which neal has described in some of his work about one of the true harms in surveillance is pourer disparities and one of the ways in which the power disparities is created is when an other, a third party, gains control of information. I wonder what i think about that if thats maybe a way you can flesh out this theory a little more to put some scaffolding around it. Do you want to start . Yes to all of that. Clearly one of the overall themes in the paper when we step through at least the interception, the statuary analysis and the Fourth Amendment seizure analysis is that actually in some ways the robots are irrelevant. The real moment for, you know, when an interception occurred or when a seizure occurred was when the government gained control of a copy of your communication such that you no longer had the ability to decide how it was disposed of and it was taken out of the regular transmission path and someone other than the intended recipient gained control of those bits. The met for that you mentioned was an interception in football. The ball is intercepted. The moment that happened, other team has gained possession. It may be that he fumbled it, takes a knee, gets a touchdown. But whatever happened after that moment is irrelevant to the fact that it was intercepted. This does also reflect a theme that you see in work like neals or and were moving away from discussions of privacy and moving more toward discussion of pow and how data and access to data and imbalances in access to our controlled data effectuate power relationships. In a way this goes back to my Cocktail Party version of my answer to the question of why should i care about surveillance . I dont care if, like, the nsa has a copy of the recipe that my grandma isnt me or whatever. And my answer to that question is always, well, its not about you, you narcissist. It has nothing to do with you individually or whether you feel creeped out or violated. It has to do with maintaining the conditions for a democratic stat society. And if we live in a society where those already with power also have the power to look at our private communications to see if tles ago that might threaten their power, thats much bigger than a privacy question be and about whether you feel personally violated, which frankly i dont care that much about. Thats going to come back to haunt me. So just to bolster everything that i agree with that kevin just said, we spent a long time oh, the computer went black. We spent a long time looking at the diagram that used to be behind me and trying to figure out when the privacy harm occurred and what the privacy harm was. There was a very long discuss, i think, about harm, that we tried to work in and were going to try to continue to work into this paper and eventually we came up with it occurs at the point the communication is originally diverted. It doesnt matter what happens in the box. If they discard it, regardless of whether they keep it they now have the decision to make the robot has the decision to make about what to do. They have put it into the robot and now the control has been taken away from the person. So the moment it has been diverted off of the path that it was intended to go on, a harm has occurred no matter what. I think this is a great point and agree with everything kevin and amie said. If the robots are irrelevant, if they are to the story then maybe they should fall out. Even though i love the title irrelevant to the search analysis. Theyre certainly rell vent to getting the pay before the conference and im glad they did because we get to hang out with them and argue about this stuff, but i wonder i will say theres another pypo in the paper that raises the same issues but indisputably involves a robot one that amie mentioned but dogs, we mention i had as selfdriving cars. Imagine them driving around the neighborhood i mixed metaphor. Driving around the neighborhood doing heat sensing on the houses to try to detect marijuana grow operations like the Supreme Court found doing that type of scanning is a search of the house and i think that metaphor which is a different hypo from the nsahypo but raises different issues that the robots respect necessarily irdevelop haven irrelevant but at least its timely. All agents and thats the real power of the paper. Woodys question, its the Agency Theory and that is a story. And i think its a really powerful one and ties in nicely with, you know, newt tralt neutral existing neutral rules. On the nfl metaphor, i like it but i like sports and i like football. And, you know, but we have to be careful. It might work for the interception part but we cant let Fourth Amendment law be sidetracked by the nfl, right, because if theres im english, but if theres defensive call it american football. American football, right. As opposed to real football. The if there is encroachment by eight defensive lineman before the snap, theres an interception, but the play is called back when its declined afterwards by the offensive team which is complicated but the point is we cant let the nflness and the coolness of the metaphor imprison our its useful for the point they use it in the paper but then we need to need to stop sean day no more nfl because were doing privacy law and civil liberty laws and Democratic Society law not football law. Michael from the school of law. Im going to ask you guys to speculate about legal doctrine because especially one of you is a great expert and the others of you are not only experts but inside the beltway. In order to set up droctrinal point, the case, the heatsensing case is a very funny case because a key point is a reasonable expectation of privacy based on the idea most people dont have heat acceptsers. If they were built into the iphone, that case wouldnt hold that those are reasonable expectations anymore. Now, one of the great achievements of your paper which i love is that it puts agency law right at the heart of the surveillance mechanical surveillance problem and, you know, in a sense the elevator pitch for 50 of your paper is we take the action of the agent attribute it to the person and treat them like the person. And that gets us where you and i want to go, so long as there is a reasonable expectation of privacy as regards the action of the person. The question was asked to speculate about, how thats using agency law as a shield. The question i have, can we use agency law as a sword and this goats to something amie was talking about briefly before, which is how can we deal with situations where there is no expectation and thats important because the extent we have this oneway ratchet and Supreme Court doctrine where Technology Becomes more common the zone of our reasonable expectation shrinks and sh risks and may be zero, the shield is not enough. It is temporary but we may need the sword. So, you know, given the door has been a little open by jones and by other recent cases, how can we is there a way we can use this agency idea to fix things that are party doctrine, bank, whatever and the reason why this question seems to me so hard is that if i wanted tomorrow to open up a privacy bank, that gave you a contract that to the maximum extent permissible by law protected your rights and therefore gave you more reasonable expectations of privacy, i couldnt actually give you much more than my bank gives me now, because of the world of law and regulation in which banks are enmeshed and which controls what they can offer me. I think the same thing is to a certain extent true in communications and lots of other infrastructure weve built. So its not enough, i worry, merely to take your idea and try to turn night a sword, we then run up against all these other problem, what do we do . What do we do . What do we do . So i have a few thoughts and im going to just so i i dont want to refrain rephrase the question. How do we address reasonable expectation of privacy. Im not seeing the linkage between the agency question and the reasonable expectation rife si question. As i understood the paper, right, the Agency Theory gets its power because if the principle had done this thing it would have been a violation of our reasonable expectations of privacy. Uhhuh. And if there had been no reasonable expectation of privacy on the part of what the principal did there is no problem with the agent doing the same thing. Am i misunderstanding ha. No. So what about the but the problem is reasonable expectations you could say i suppose it is an answer we need to put more life back into reasonable expectation. The trouble is, its very tough and i mean were all where words have meaning and metaphors work to talk about a ream expectation when it isnt ream. Theres an interesting there are a number of interesting things we could talk about here. On just the general queson of ream expectation, i share your expectation. We have seen alternate pads to way that increases in capacity can strengthen our reasonable expectation of privacy rather thandi mennish in jones for those who respect familiar wit the Supreme Court held the 28 days of gps tracking of a vehicle on public roads was a search, did violate a ream expectation of privacy even though that information was exposed to the public. And that shorterterm, you know, or technologically unassisted tracking would not and i feel that five of the justices in that case actually held that it was the tracking that was the violation, not the attachment of the device and so that shows that theres a concern on the Supreme Court and there are five justices that believe on the Supreme Court that believe even just using technology to aggregate lots of this was that was public could violate your expectation of privacy. And in that way, increases in capacity to surveil us can actually give us pore protection than we had before in a way as a counterbalance to the kyleissue of what was a search no longer a search and the agency questioned, theres i really interesting doubleedged sword and we want to address it in the paper. We didnt have time. We cite a paper by a fellow make tokeson toxin. Tokeson. He argued it shouldnt count if a robot reads your email from a Fourth Amendment perspective in part because he feared if it does count, then that will actually eliminate our expectation of privacy. That is, to the extent we have a lot of robots looking at email to scan it for spam or scan it for viruses or to allow many travel violations or service ads or whatever, if that counts, and weve agreed to that or otherwise have allowed that, that that could mean we have given up our overall expectation of privacy in those communications. I fear that tokeson was killing the Fourth Amendment to save it. I think that im more concerned about the horribles that come from government surveillance than private surveillance and i think there are plenty of extension interceptions and ways to play with the law that our allowing that kind of behavior does not eliminate a ream expectation of privacy and we have enough cases saying that that i feel pretty comfortable but its not an easy issue and it gets to the question of the automation rationale which he points to in