In a post I wrote about a month ago, I promised a series on Big Data, focused on Firmin DeBrabander’s book, Life After Privacy. Here’s part (2), a response to what I regard as DeBrabander’s excessively victim-blaming account of Big Data’s hold over us. 

A quick recap of the relevant part of DeBrabander’s argument: 

The book begins with a well-documented fact that by now should be common knowledge: Big Data, meaning the data-harvesting and data-mining branches of the modern corporation and modern state, have within just a few decades subverted almost all of the norms of privacy that preceded the rise of the Internet, and have created a surveillance state of unprecedented scope and power.

How did this happen? On DeBrabander’s account, our predicament might be likened to that of the Biblical Esau: we sold our privacy for the digital equivalent of a mess of pottage. In other words, Big Data gave us an iterated series of trade-offs, over decades, of convenience or self-expression over privacy. We cultivated societies of unbridled preference-satisfaction subject to the imperatives of immediate gratification. So we chose convenience and self-expression over privacy, iterated across billions of mouseclicks, and divested ourselves by our own hands, of our birthright.

In this post, I accept DeBrabander’s account of what happened, but contest his account of how it did. Yes, it’s true: our privacy is, through data-harvesting and data-mining, at death’s door. But at a basic level, it’s not true that we did this to ourselves by our own voluntary and culpable apathy or self-indulgence. Big Data did it to us through its exercise of asymmetric, indeed monopolistic power: through deceit, manipulation, trespass, and theft that it exercised with impunity, and that we could not possibly have foreseen or successfully resisted even if we had. The diagnosis is important not just for clarity of understanding, but for getting clear on how to conceptualize a practical response.*  

As a first approach, consider four causal models for understanding how Big Data managed to undermine privacy. The taxonomy is intended to be a rough, first approximation toward carving up logical space, neither mutually exclusive nor jointly exhaustive: 

1. Unilateral seizure: Big Data unilaterally acted to take our privacy; we played little or no voluntary role.
2. Voluntary relinquishment: we voluntarily consented to give Big Data our privacy; it played little or no coercive role.
3. Symmetrical co-causation: we acted in concert with Big Data, each party making co-equal contributions to the outcome.
4. Asymmetrical co-causation: we acted in concert with Big Data, each party making unequal contributions to the outcome. 

As I read him, DeBrabander oscillates between (2), (3), and (4). Sometimes he writes as though our loss of privacy is all our doing. Sometimes he writes as through our loss of privacy is partially our doing. And sometimes he acknowledges that while we voluntarily and culpably gave our own privacy away, Big Data, being the asymmetric player, played the larger causal role in producing the privacy-diminishing outcome. 

My own view is a variant on (1). As I see it, Big Data acted unilaterally and coercively to take our privacy, and the role it played was sufficient to produce the outcome. It’s no doubt true that through apathy, indifference, and self-indulgence, we, its victims, made our own little contribution to the outcome, but I regard this as explanatorily irrelevant: the role we played was over-determined by the role Big Data played. Our role was epiphenomenal. Given the asymmetries of power involved, the informational constraints placed on us, and the sheer technical sophistication of the techniques deployed, there’s almost nothing we could have done to forestall the outcome and save our privacy. Once the Big Data juggernaut began, it was fated to win, at least as far as it has won. 

To understand the actions involved, we have to understand the nature of the actors–the modern corporation and modern state. The essential feature of both–to understate things–is asymmetric power vis-a-vis the rest of us. Both the corporation and the state are, in slightly different ways, mutually reinforcing monopolies. And whatever the moral tone of the rhetoric they use, both are fundamentally amoral, unscrupulous agents of power, unconstrained by the sorts of norms that constrain the average person acting in something other than an ex officio role. 

The state has a monopoly on the initiation, use, distribution, and authorization of force: it decides when force is to be used, what force is to be used, against whom, to what degree, and with what consequences. In part for this very reason, it enjoys immunity for abuses of its authority: formally, the state enjoys sovereign immunity; informally, it enjoys a sense of practical impunity. What this means is that states are authorized, both de jure and de facto, to lie, cheat, steal, trespass, assault, torture, and murder without having to answer for it in any way that compares to the accountability demanded of the governed. Their doing so is the exception, not the rule. Paradoxically, the state enjoys a presumption of moral authority on top of all of this: regardless of its actual moral status, states demand that the governed acknowledge their legitimacy, and go to remarkable lengths to ensure that they do. Being a state actor not only means almost never having to say “sorry,” but by the terms of conventional moral and legal logic, means almost never having anything to say “sorry” for. 

One implication of the state’s monopoly on force is its exclusive prerogative to define, through the rule of law, how force is to be used. A further, nearly trivial implication is that it gets to define the nature of property and contract rights and their enforcement, including how, where, and when resources are legitimately to be extracted from the sources of initial appropriation, and how they’re to be transferred from there on. Because it enjoys this monopoly, the state has the option either to regulate appropriation and transfer directly, or outsource the task to others. 

The modern corporation is in essence the relevant outsourcing operation. The state grants to the corporation a permission–once upon a time a charter, now a permit, license, or registration–to exercise a mini-monopoly on resource extraction, defined by the state, including limitations on liability for torts, and guarantees of protection and favored treatment. So where the state concerns itself with the governance of territory, the corporation concerns itself with the extraction of resources from those territories, protected by state authority. In doing so, the state rigs the rules so as to facilitate corporate resource-extraction at the expense of non-state and non-corporate actors: the tax code, property law, contract law, tort law, and criminal law are all structured to corporate advantage. The state has the incentive to do this because the revenue stream generated by the corporation is ultimately the revenue stream that pays for the state itself. And the employment it generates serves to regulate the population, usually without the need for direct state intervention. 

So the two institutions both mirror each other and exist in a symbiotic relationship with each other. The state monopolizes force; the corporation monopolizes resource extraction, protected by the state’s monopoly on force. The state enjoys immunity from prosecution for the way it deploys force; the corporation enjoys near-immunity from accountability for how it extracts resources from the commons. The state protects the corporation; the corporation feeds the state. 

In the Second Treatise, Locke defines “political power” as 

a RIGHT of making laws with penalties of death, and consequently all less penalties, for the regulating and preserving of property, and of employing the force of the community, in the execution of such laws, and in the defence of the commonwealth from foreign injury; and all this only for the public good. 

It’s common to identify Lockean political power with the state, but it’s more accurate to identify it with the union of state and corporation. It’s the union of the two institutions that enjoys a right of “making laws with penalties of death and consequently all less penalties.” States monopolize force through the rule of law, but over the centuries, have reluctantly come to discover that they aren’t quite up to the task of governing and presiding over whole economies by law. Doing so requires a degree of micro-management that intelligent states tend to avoid. When you can’t do something on your own, but know that it has to be done, you outsource it. And so we get the role of the modern corporation: an economy governed by the state remains in a state of nature until the state outsources the work of resource-extraction to the corporation. 

In short, the modern corporation governs us at precisely the point at which the state relinquishes control, and precisely because it does. Counter-intuitive as this may seem to some, the modern corporation, like the state, wields the power of life and death over us.  This should be obvious in the case of the health care corporation, the private prison, or the mercenary security outfit, but as Bruce Schneier as persuasively argued, it’s increasingly true of the rest of the world as well. Just as the state outsources its power to corporations, the corporation, in turn, outsources its power to the computer-driven algorithm. Everything nowadays either is, or is driven by, such algorithms. So computerization becomes an expression of corporate power. And while the corporation’s main concern is the monetization of the world, not its destruction, its risk calculus is its own, not ours. It doesn’t wantonly have to kill us to possess the right to impose its risk calculus on us, however ultimately lethal. And thanks to limited liability, it doesn’t have to apologize when it’s wrong, either. 

That brings us more directly to Big Data. Because both the state and the corporation increasingly govern us through data, there is a real sense in which it’s Big Data that enjoys Lockean political power in the modern world. And as with real-world Lockean political power,  Big Data talks a big game about “consent,” but doesn’t really mean it. With that fact as background, I think we’re in a position to understand the mechanics of data extraction, and see why our voluntary relinquishments of privacy, however ill-informed or self-indulgent, are irrelevant to the larger picture.

Personal data is a resource to be extracted from the circumstances of private life. To understand how it’s extracted, we have to focus on the right or relevant circumstances. The relevant ones are not (pace DeBrabander) those of retail commerce or private self-expression, but of genuine human necessity, those junctures in our lives where we appear to face options, but where one option bears down on our needs, crowding out the possibility or feasibility of choosing any of the others. 

“OK”

Birth is the unchosen point of entry into data harvesting, followed in (very) roughly chronological order by health care, education, employment, finance, housing, insurance, and law. There is little or no way of avoiding these institutions in modern life, and no way to avoid the relevant institutions’ demands for personal data. Once engaged with them, and typically at the first encounter, an individual is deprived of any choice about whether to surrender her data, the purposes for which that data will be used, the methods that will be used in mining it, or the risks involved at any point in the process of harvesting, mining, sale, or exploitation. 

The same mechanism is deployed in every case. An asymmetrically powerful actor, often a corporation but sometimes the state, exploits the necessity of a weaker actor, a person, demanding data as the price of meeting the weaker party’s unavoidable human needs. Nominal consent is obtained for the transaction, but the consent in no plausible way qualifies as informed, and is often given (for instance, in health care or law enforcement) under duress, even extreme, terrifying duress. 

The transaction itself has no defined boundaries. The terms of service keep changing. The terms are often themselves incomprehensible and incoherent. And many uses of the data are not captured by the terms of the “contract” at all: they’re simply faits accompli. Beyond this, the stronger parties to any interaction enjoy almost complete immunity in cases of breach. Indeed, most cases of breach go undetected. Contracts today are breached so often by the stronger party that the phenomenon becomes a kind of parody of Kant’s example of the lying promise in the Groundwork: the world literally becomes the one in which the maxim of the lying promise has become universalized, and universalized by the most powerful agents in the world.

And beyond this, the socio-political world is organized so as to reward innovation in ways of getting around the terms, because the terms are themselves conceived as irritating side-constraints on the imperatives of unbounded optimization (think HIPAA in health care, FERPA in higher education). In many contexts, “innovation” just means: finding ways to maximize revenue by exploiting the ambiguities of contract or regulation. Innovation so conceived is rewarded with far greater enthusiasm than adherence to humdrum moral norms. 

Consider what it would mean to resist what I’ve described as the necessity-based demands of the modern world. One can hardly resist the state’s demand to register one’s birth. Nor can one realistically resist the health care system’s demands for personal health information; the price would be illness, injury, and premature mortality. Nor can one resist the demands of the educational system; the price would be lifelong ignorance and its further consequences. Nor can one resist the demands of one’s employers, would-be employers, and anyone associated with either; the penalty would be unemployment, followed by penury, ill-health, homelessness, and premature mortality. Between them, health care, education, and employment swallow the average person’s privacy whole. 

But they’re the tip of the iceberg. One can’t realistically go without housing, or by implication resist the housing sector’s demands for tranches of personal data: either you part with your data in order to get housing, or you go homeless. Not that going homeless will help. If you’re homeless, you either go to a shelter, or you try some other desperate expedient. Either way, your data will be harvested. The same dynamic applies to insurance and finance, and indeed, to any set of economic, physical, or psychological goods you care to name. 

Let’s not forget the role of the state itself. Even the most peaceable, compliant, law-abiding, law-avoiding, Stoically self-controlled and ascetic individual has to deal with the legal system, if only to pay taxes. You can’t without penalty refuse to pay taxes, but you can’t file a tax form without submitting to data harvesting. (You have to file whether you owe or not, and you can owe whether you’re at home or abroad, dead or alive.) Of course, given the over-criminalizations of our legal system, one-fourth of American adults has criminal records.** So the privacy of that fourth tends toward zero. And I doubt that even one American in ten has any idea how to exercise her Fifth Amendment rights during an ordinary police stop. Since a large proportion of Americans drive, all of them are likely candidates for police stops, and since a very large proportion drink and drive, all of them are likely candidates for arrest.

You don’t need a conviction record, of course, to be part of the system. You just need to encounter the system. Resistance at the point of encounter with law enforcement is probably one of the dumbest things a person can do. And few do. But that’s why few enjoy privacy. Indeed, according to the assumptions of modern American law enforcement–aka “predictive policing”–algorithm-driven suspicion by association is a fundamental methodological dictum, not the defamation or false accusation it appears to be to the uninitiated. 

The surrender of personal data is part of the price of the ticket for just about anything we want in the modern world, be it a necessity, a luxury, or anything in between. Once surrendered, the data enters a cycle of mining, monetization, regulation, and punishment–in short, external control–far beyond the control of the individual consumer. Your personal sense of decorum, prudence, or reserve are utterly beside the point in this context. Even the dead are harvested, catalogued, investigated, and administered. 

Given this, DeBrabander’s focus on voluntary disclosure via the frivolities of online commerce and online acts of self-expression strikes me as misplaced. Even if we took those things entirely out of the equation, we’d be left with a Data Leviathan staring down its subjects. 

But I wouldn’t stop there. Suppose we put those frivolities back into the equation. It still seems to me misleading to treat disclosures of data in those contexts as exercises in voluntary, consenting imprudence or self-indulgence. There is some of that, to be sure, but ultimately its role seems trivial by comparison with the calculated bait and switch by which data is harvested online even when it comes to online commerce and voluntary self-expression. 

Fundamentally, online shoppers and online exhibitionists are manipulated, deceived, and (I would say) flat-out coerced into handing over their data, and giving up unwanted features of privacy. They are asked to “consent,” but the terms of consent are absurdly unreasonable. The terms of service are too long, too wordy, too confusing, too ambiguous, and too changeable to function as requests for genuine consent. There is no way to know whether the terms are being observed on the corporate end, and no real way of pursuing corporate actors’ breaches of the terms. There is no way to regulate or know anything about what is simply omitted by the terms. There is no feasible way to negotiate over the terms. And there is no way, even in a notional negotiation, to compete with entities that spend millions or billions of dollars and millions of person-hours on research devoted to manipulating the unwary and exploiting the vulnerable. 

It may be foolish for the unwary or self-indulgent to feed the beast with the insouciance they seem to have about it, but they can hardly be held responsible for the beast’s presence, power, or appetite. Nor can they really be held responsible for being deceived or out-maneuvered by it. Nor, ultimately, would it matter if they were wise to it. Since Big Data holds the cards in all of the important cases–the cases of brute necessity I mentioned before–the cards it holds in these other, more frivolous cases are really just breath off a blade. It’s the blade that matters, not what comes off it.     

Imagine a world of prim, privacy-conscious teenagers who refuse the temptations of online preening; Stoically ascetic consumers who never click “yes” to cookies; and people who spend their free time scrutinizing the Terms of Service of every app they ever download, etc. etc. What result do you get? You get a slightly smaller version of Big Data–i.e., Big Data minus Fun. So while your moral mileage may vary here, it’s beside the explanatory point that we’re all shopping online until we drop, or posting our selfies, nudes, and private confessions on social media, or a little of both. Private self-indulgence doesn’t really explain very much about our collective loss of privacy, which is another way of saying that contrary to DeBrabander, the desire for individual privacy (or self-expression) is not the problem, and never was. 

In my next post, I’ll explain why I think the right diagnosis matters when it comes to offering a prescription.

---

*I rely for my account of Big Data largely on the work of Shoshana Zuboff and Bruce Schneier. See Zuboff’s Age of Surveillance Capitalism, and Schneier’s Data and Goliath, and Click Here to Kill Everybody. See also Cathy O’Neill’s Weapons of Math Destruction, Zeynep Tufecki’s Twitter and Teargas, and Edward Tenner’s The Efficiency Paradox. Meta Brown’s Data Mining for Dummies gives a useful primer account of what data analysts do for a living; John Doerr’s Measure What Matters gives a useful (sometimes unintentionally candid) sense of the normative priorities involved. For a sense of the nitty gritty in health care administration, see Debra Ferenc, Understanding Hospital Billing and Coding, and Michael Nowicki, Introduction to the Financial Management of Healthcare Organizations.

**Cited in Schneier, Data and Goliath, p. 128.