How to Stop Your City From Spying on You (ep. 55)
Surveillance technology is slowly encroaching on every part of our lives. With regulation at the federal level slow to materialize, local governments are taking action. Two American cities — San Francisco, Calif. and Somerville, Mass. — recently passed local laws to ban the use of facial recognition technology by police and other government agencies. Is local advocacy our best bet for keeping the surveillance state at bay? Kade Crockford, director of the Technology for Liberty Program at the ACLU of Massachusetts, discusses a growing local movement to protect privacy.
[00:00:05] From the ACLU, this is At Liberty. I'm Emerson Sykes, a staff attorney here at the ACLU, and your host.
From so-called “aggression detectors” in public schools, to license plate scanners on our streets, surveillance technology is encroaching on every part of our lives. Regulations at the federal level have been slow to materialize, but local governments are increasingly taking action. Two American cities, Somerville, Massachusetts, and San Francisco, recently passed local laws to ban the use of facial recognition technology. So is local advocacy our best bet for keeping the surveillance state at bay?
Today we're talking to Kade Crockford, Director of the Technology for Liberty Program at the ACLU of Massachusetts, and a leading voice in the movement to rein in surveillance technology. Kade, incidentally, is also my main competitor for biggest soccer fan at the ACLU.
Kade, thanks very much for joining us. Welcome to the podcast.
Thanks for having me.
So I want to start off by talking about the major victory that you and your colleagues at the ACLU of Massachusetts won recently. Can you start out by telling us what happened in Somerville and why it's important?
[00:01:41] Sure. At the end of June in Somerville, Massachusetts, which is a city right outside of Cambridge, near Boston, the city council unanimously voted to ban the municipal government’s use of face surveillance technology and we became the second city, Somerville did, after San Francisco to take this pretty awesome step.
We had a champion at the Somerville City Council in city councilor Ben Ewen-Campen who actually reached out to us at the ACLU after he heard news about what had happened in San Francisco, and said “Hey, I want to do this here.” And we were able, miraculously in municipal government years, to pass this in just a few short weeks. And I think that actually speaks to the fact that there's a pretty broad consensus among ordinary people in the United States about the dangers that this technology poses to our core civil rights and civil liberties. And that really cuts across party lines. It’s also an interesting place for the second municipal ban on face surveillance to happen, Somerville, because like San Francisco it's a place where a lot of people who work in the high-tech industry live.
Somerville is actually a bedroom community of the nearby city of Cambridge, which is of course home to the Massachusetts Institute of Technology, one of the most prestigious technical schools in the world. And a lot of people who went to M.I.T. and started tech firms or work at big tech firms like Google and Microsoft in Cambridge, live in Somerville. So like San Francisco, it is home to a lot of the people who are actually developing and implementing these technologies in their workplaces. And I think that is really important, you know. Some people may look at San Francisco and Somerville and say “Oh well, those are just two progressive liberal cities.” And while that's true, it is also the case that the people who live in those particular places have a uniquely close relationship with the types of technologies that are at issue here. So I don't think it's a surprise that the people who are building this stuff say, “Wait a second. I don't actually want this used in my town.”
That's a really fascinating point about what Cambridge or Somerville have in common with Silicon Valley and San Francisco. Can you tell us a little bit more about what kinds of technologies are implicated by this ban?
[00:03:37] Sure, so the ban covers Somerville government agencies, including the police, acquiring face recognition technologies, and so that might include things like algorithms, like the one that Amazon sells, a product called Rekognition with a “K” that allows any person with access to images of any kind to perform facial analysis. So, it would prohibit for example Sommerville government agencies from adopting a product like Rekognition to use to either compare one image to another to see if the two images were of the same person or to say, I don't know, take a picture of a protest outside of Somerville city hall and try to run that image against a database that, you know, the Somerville city government possesses of people who have applied for certain types of permits, or whatever.
It prohibits the use of facial recognition algorithms and systems on body cameras, on dashboard cameras that law enforcement may use or could possibly use in the future. It prevents the use of facial recognition technologies on any of the dozens of networks surveillance cameras that the police department maintains.
It also crucially prohibits them from using, accessing, obtaining or retaining any information obtained from a face surveillance system, meaning they can't merely ask the state police or the FBI or any other external entity to perform a facial recognition search on their behalf and then use that information against someone. So it's it's fairly comprehensive.
That's an amazing victory and quite a comprehensive bill. And you described a little bit the unconventional way that this bill came about, with council person approaching the ACLU, and then a relatively quick turnaround. Can you tell us more about this strategy that was used by activists to push this victory through?
Yeah. You know I have to say that on this particular issue, in this particular community, it was kind of a no brainer. Surprisingly, we didn't actually have to push city councillors or the mayor on this issue very hard. People really got it. So we had support from organizations including the Electronic Frontier Foundation and Fight for the Future, Data for Black Lives is a part of our statewide movement here in Massachusetts to put a stop to the government's use of this unregulated technology.
[00:05:58] But for the most part lawmakers at the city council level and at the Mayor’s Office in Somerville just got it. You know, we had some conversations with folks about why we think it's urgent for Somerville particularly to take action. But on the substance of the bill, on the merits of what we were trying to accomplish, to ban the municipal government's use of this completely dangerous and unregulated technology, there was pretty widespread agreement and we actually frankly didn't really have to convince people of the value
One of the things that always comes to mind when we talk about local solutions is that sometimes it can be relatively low hanging fruit and you can push through change quickly. But for individual consumers, how much are they actually protected if there are all these other types of government agencies outside of the municipality that can still access this type of information?
I think the victory in Somerville and the victory in San Francisco are important overall for one reason which is this: we have been fed a lie by technology companies, by Hollywood frankly, and to some extent by government agencies like the FBI that the widespread adoption of dystopian surveillance technologies like face surveillance is inevitable, that there's nothing that we can do to stop it and that we all might as well just sit back and wait for us to live in a kind of Minority Report-style world.
Well, the communities of Somerville and San Francisco, together representing millions of people, said “no” actually and threw a wrench in that notion of technological determinism, I think striking a really clear, different path for not just those particular communities but for the whole country and kind of waking us up out of the slumber that you know, assumes that merely because a technology company in Silicon Valley or in Cambridge, Massachusetts designs and builds and produces a product it will be and must be used in a widespread manner across the United States and across the world.
[00:07:56] So I would say to anybody listening to this podcast anywhere in the country, it is actually an incredibly powerful thing for you to take an issue like this to your local government and to make sure that at the local level, your community, your government, is acting in accordance with your community's values. I think the impact that that's going to have and has already had frankly on the politics related to this issue is substantial and that as more communities across the country follow Somerville and San Francisco's lead, we're just going to see the power of that movement grow.
I think that it's absolutely clear that Somerville and San Francisco have sent a message to Congress. It's clear to me that you know, San Francisco and Somerville have sent a message to state legislators around the country, that they ought to be seriously looking at this. If a city of sixty thousand people in Somerville that frankly a lot of people outside of Massachusetts haven't even heard of, can do something like this, it kind of puts to shame the United States Congress and state legislators who have been sitting on their hands and sleeping while tech companies are pushing these dangerous untested, unreliable and if they are reliable, dystopian technologies on our government agencies in secret behind closed doors without any kind of regulation. So you know if Somerville, Massachusetts can do it, anybody can.
It's certainly an inspiring message for local organizers, and has there been any effort already to build on the momentum at the municipal level towards state level, or even federal level, action?
There absolutely is. We are pushing a series of municipal bans on government use of face around technology at the local level and approaching the issue at the state legislature with a moratorium proposal. There is not much that a city or town can do except flip the binary on and off switch. Are we going to be using this technology or not? And so we are encouraging municipalities, not only all across Massachusetts but all across the country, to turn that switch off and say “No.”
[00:09:56] At the state level, we think that the appropriate approach is to press pause, that states including Massachusetts ought to stop all current government use of the technology so that we can have the kind of robust conversation we need to have about the error rates, about the bias in the technology itself, and then also about what kind of future we want to live in, and what, if any, uses of this technology we think are appropriate in government, under what types of really restrictive checks and balances and regulations.
And I know that facial recognition technology is only one part of your work.
Can you talk about some of the other types of technologies that you think we need to keep an eye on as well, even as we continue to push forward on this effort to ban facial recognition at the at the local level?
So we have done a lot of work at the ACLU of Massachusetts in collaboration with our colleagues in places like California and Washington State and at the national ACLU to highlight the dangers of technologies like automatic license plate readers. License plate readers are a form of dragnet surveillance. They are cameras that police departments and other government agencies attached to police cars, to bridges, to traffic intersections, traffic lights. They take pictures of every single car that passes by them. They extract from those images, automatically, the license plate number and the time and date and location where that image was taken. So effectively, these are systems that are creating massive databases containing the location movements of all drivers who pass by these camera systems.
[00:11:33] We don't have any regulatory body at the federal level that actually pays attention to what state and local law enforcement are doing with these technologies. We have heard a lot, thankfully, thanks in part to the ACLU is work and to Edward Snowden's disclosures about what the FBI and the National Security Agency have been doing since 9/11: conducting dragnet surveillance of Americans’ communications. We hear a lot less actually about the growth of a national security state that has now permeated down to the state and local level. Thanks in part to copious amounts of funding from the Department of Homeland Security and the Department of Justice through grant programs established after 9/11 for the purchase of things like license plate readers, for the creation of these effectively spy centers called “Fusion Centers” that the Department of Homeland Security helped to establish in every state: there are over 70 of these now throughout the United States. Massachusetts actually has two.
And in these places state and local law enforcement sit in front of computers with access to untold numbers of databases both commercial and government and they share information, much of it junk, a lot of it actually about political protesters and people engaged in First Amendment protected speech, and they share that information not only with other state and local officials but with federal agencies like DHS and the FBI.
You know, you think about it like this: like the FBI has some number of thousands of agents nationwide. I think CBP is the largest law enforcement agency in the country, has tens of thousands of agents. Well, there are a million state and local police officers in the United States, a figure that just far surpasses what the federal government can do in terms of their numbers nationwide. I think the federal government has realized this and after 9/11 realized that one of the best ways to actually keep track of what everybody in the United States is doing across the country is to fund state and local law enforcement, to allow them to buy things like license plate readers, electronic fingerprint readers, surveillance cameras that have blanketed the downtown areas of most major cities and even small towns in the United States over the past 20 or so years. And all of this massive transfer of literally billions of dollars of wealth from the federal government to state and local law enforcement nationwide has enabled law enforcement at the local level to really catch up. And in many ways you know become equals especially in places like New York, Los Angeles, even Boston, with entities like the FBI.
[00:14:04] So, license plate readers, again, electronic fingerprint readers, surveillance cameras, social media monitoring software, they have StingRay devices which enable law enforcement agencies to directly track cell phones, both the location of cell phones and even to wiretap private communications that people are having over cell phones, without going to the cell phone companies, so cutting out the middleman. All of this stuff used to be sort of sci fi, even 20 years ago. And now, the types of technologies that even 20 years ago were mostly in use by the US military are now being deployed right here in our communities across the United States and with basically no oversight.
The challenge of regulating law enforcement's use of these technologies are really serious one, especially in an environment where Congress is, you know, I would argue, broken. And if you don't like the term “broken” then at least most people would agree, I think, that it is very, very difficult to accomplish something in this Congress and has been for a number of years. So the real action on digital privacy law that we've seen over the past 10 years has unfolded in the States.
A number of states have taken action to for example implement a warrant requirement across the board for law enforcement access to our stored communications. We've seen state lawmakers pass laws regulating how long law enforcement agencies and other government agencies can retain license plate reader data so that they can't create this never ending dragnet containing the movements of every person with a car going back, decades. We've seen some states pass laws that restrict law enforcement's use of those StingRay devices that track people's cell phones. So that's really where the action has taken place thus far. And at the local level.
[00:15:48] The final thing that the ACLU has been doing over the past few years which has been really successful is push these ordinances in cities across the United States that kind of flip the script on the problem I just described of law enforcement agencies getting grants from the federal government to buy all these expensive surveillance technologies and then deploying them in secret behind the scenes, without any legislative oversight, without any appropriate privacy policies in place.
And it's clear why we're so concerned about government surveillance, in particular. You talked about the fusion centers in Massachusetts. I know they've come under fire for social media monitoring of groups like Mass Action Against Police Brutality and other sort of left-wing activist groups. But what about the companies, also? Because there are all sorts of private hands where our data, whether it's facial recognition data or other types of data, are stored and used in all kinds of ways that we might find concerning. So, what are your tactics in terms of responding to privacy issues as they relate to private companies as opposed to just the government?
[00:18:18] So a couple of things here. The Federal Communications Commission, the FCC. under the Obama administration implemented really important privacy guidelines that were extremely common-sense and would have protected Americans’ internet activities from being monetized by internet service providers like Comcast, Time Warner, Charter Communications, etc., the way that our phone calls -- our private phone calls -- are protected under long-standing federal law. So basically under federal law for many decades now, the FCC has prevented telephone companies from listening into the content of our phone calls and then monetizing that information.
So here’s an example: I call a pizza place and order a couple of pizzas, and my phone company -- in an unregulated world--listens to my phone call and maybe sells that information to a diabetes clinic because, you know, I eat a lot of pizza and maybe this diabetes clinic wants to know that. Federal law prevents phone companies from doing that. It says the content of your communications -- what you're saying on the phone to somebody is no business of anybody else's besides yours.
This law that the Obama-era FCC tried to implement these regulations would have basically taken that model and applied it to the internet: to say that an Internet service provider like Comcast, or Charter, or Time Warner is not allowed to monitor what you're doing on the internet--maybe you're visiting a substance-use website, maybe you spend a lot of time on PornHub.com--and then monetize/sell that information, or package that information to advertisers, to make money off of your internet habits.
[00:20:03] Well, when the Trump administration came into power, one of the first things that he and the GOP Congress did was get rid of that. So now we have no protections -- the way that we were going to if the FCC rules had actually gone into effect.
So, one thing that we had the Massachusetts ACLU have tried to do is to reinstate those ISP privacy rules at the state level. So while we were not successful in the last legislative session here, Maine actually just passed the nation's strongest ISP privacy law a couple of weeks ago. So that's one example of some work that we're doing in the area of consumer protections. There's another really important consumer law on the books protecting our privacy. This one is in Illinois. The Biometric Information Privacy Act in Illinois essentially says, if a company wants to collect your biometric information, they have to get your permission first, they have to get your opt-in consent before collecting your face-print, or your fingerprint, or your iris-print, or anything like that. And we think that's really important because we also don't want to live in a world where you walk into a Wal-Mart and you know some machines says to you, “Hello, Emerson. Welcome back. How did you like the size six underwear you bought last time?” or whatever -- you know, that type of Minority Report world. So BIPA is an incredibly important law. And then crucially, we are lobbying in D.C. to make sure that whatever data privacy law passes there does not include what's known as a “preemption clause,” which restricts states from passing stronger privacy laws. That is really, really important because again, whether it's in the context of the state legislature in Maine passing the nation's strongest ISP privacy law, or whether it's in the context of California having passed a pretty good consumer privacy law on the data side, you know regulating companies like Google and Microsoft, we want to make sure that states have the power to innovate here -- and that if a state government, motivated by the will of its people, wants to pass a law that's even more restrictive on the companies and more protective of our privacy than what Congress ultimately does, that they have the power to do that.
[00:22:11] Well, one of the things that we hear time and time again is that you know we can be active in terms of supporting local organizations, like the ACLU and others who are trying to push back against these things in the local legislatures or in the state legislatures or even on the federal level. But what can consumers do themselves? Do you have any tips for how someone can actually take proactive steps in their own personal lives to protect their data security?
There are a couple of things people can do. One is to use Signal, which is an encrypted communications app that is completely free. It works on Androids and iPhones -- unfortunately it doesn't work on Microsoft phones. But if you install Signal, and you ask all your friends and colleagues to do the same, you can communicate with them in a secure manner where not even the police, not even your telephone company, will be able to determine who you're talking to, how long you talk to them for, or any other facts about your communications patterns -- and certainly not know what you're saying in those text messages or your phone calls. So definitely download Signal.
And then you should use either Tor, which is at a free internet browser that oddly enough is partially funded by the State Department -- and it's partially funded by the State Department because the State Department wants CIA and other covert American personnel overseas to be able to use the Internet anonymously. Tor is an open source service that allows you to browse the internet without sending details of all of your internet activities to your Internet service provider or to the government. So Tor is super easy to use, again free, you can download the Tor browser, that's T-O-R, just by looking it up on your favorite search engine.
[00:24:03] And then if you don't like the idea of using Tor for some reason, or you find it a little bit clunky-- sometimes it's a little slower than a normal browser-- you can use what's called a Virtual Private Network, a VPN. And VPN basically do the same thing that Tor does: they encrypt your communications over the Internet so that your ISP, your Internet service provider, the government, can't see what websites you're accessing. The major asterisk I would place there is that your--you have to place a lot of trust in the VPN provider that you select because, while your ISP can't see what websites you're visiting while you're using a VPN, the VPN provider can. So you want to make sure that you do a significant amount of research to find somebody who you think you can trust.
So download Signal, use it on your phone; download Tor; if you, if you feel it's necessary, use a virtual private network of VPN to secure all of your Internet traffic. And then finally I would say, the most important thing that folks can do is to reject the notion that privacy is dead, that all is lost, that there's nothing that we can do, that tech companies and government agencies have won, and that we might as well just forget about it and start accepting a life where corporations and government agencies know everything about us at all times.
What we really need to do is to change our government so that it acts in a more democratic fashion so that the desires of big tech lobbyists, like Amazon, and Google, and Facebook, and the rest of them, do not outweigh the desires of ordinary people in the halls of Congress or in our state legislatures -- and the way to do that is to get politically engaged. So you should definitely be voting. You should definitely be pressuring your existing members, both at the state level and at the federal level, to take action on these issues. And I guess lastly I would just say, do not buy the idea, that both corporations and the government are going to try to sell you, that somehow you are safer in a world where unaccountable corporations and government agencies know everything about you. It's simply not true.
[00:26:11] That’s really helpful, practical advice, as well as an inspirational call to action. I want to finish with a very difficult question: who do you think is going to win the 2023 Women's World Cup?
I think that's a really hard question actually, because I had the US winning this cup, but there’s some really, really good competition in this one, and I imagine that the rest of the world is already chomping at the bit to take the title from the Americans, so I don't know what to say to that Emerson other than I cannot wait.
Well, I look forward to watching it with you next time around. Thanks very much, Kade, for your time and for all of your great work on behalf of the ACLU of Massachusetts. We look forward to hearing more about your work in the future.
Thanks a lot, man.
Thanks very much for listening. If you enjoyed this conversation, please be sure to share At Liberty with a friend, and rate and review the show. For more information on Kade and her colleagues work, go to privacysos.org.
‘Til next week, peace.