Microsoft's annual shareholder meeting is coming up, and the proxy statements include five excellent shareholder resolutions.   One of them is on a topic I've written a lot about here: prohibiting sales of facial recognition technology to governments.  Unsurprisingly, I support it!  As Councilmember Jeanne Kohl-Welles and Jennifer Lee of ACLU of Washington said earlier this year in King County government must turn its back on facial recognition technology

The potential dangers inherent in government use of this technology are immense and far outweigh any potential benefit. Facial recognition technology must be banned, not only because it fuels discriminatory surveillance, but also because it jeopardizes everyone’s privacy and civil liberties. With this technology, government agencies can track individuals’ movements and contacts without their knowledge or consent, chilling free speech and free association, undermining press freedom and threatening the free exercise of religion.

It probably won't pass.  Microsoft's Board recommends voting against all the shareholder resolutions including this one, and large institutional investors usually follow the Board.  A similar Amazon resolution in 2019 won just 2% of shareholder vote and that's probably most likely the likely outcome here.  

UPDATE: As expected, the facial recognition resolution only got 4% of the vote.

Still, shareholder resolutions are an effective part of the multifront campaign to ban facial recognition.   The 2019 Amazon resolution was a key stepping stone in the multi-year fight to stop Amazon, IBM, and Microsoft from selling face recognition to law enforcement.  Just last month Microsoft agreed to human rights review in deals with law enforcement and government in response to another shareholder resolution, since withdrawn.   And Stanley Shikuma, Savannah Sly, and Jennifer Lee of the Tech Equity Coalition will have three minutes to speak in favor of this resolution at the board meeting on November 30, which is great!

I'll talk more about the facial recognition resolution below, but there are four other resolutions on the proxy statement so first let's look at the full list.

Five synergistic resolutions

I also support the other resolutions, all at the intersections of justice and equity with technology.   Each is very worthwhile in its own right, and the full slate  has a lot of synergies.

1. RESOLVED: Shareholders request Microsoft report on median pay gaps across race and gender, including associated policy, reputational, competitive, and operational risks, and risks related to recruiting and retaining diverse talent. The report should be prepared at reasonable cost, omitting proprietary information, litigation strategy and legal compliance information.
2. RESOLVED: Shareholders urge the Board of Directors to release a transparency report (at reasonable expense, omitting confidential or privileged information) to shareholders assessing the effectiveness of the company’s workplace sexual harassment policies, including the results of any comprehensive, independent audit/investigations, analysis of policies and practices, and commitments to create a safe, inclusive work environment.
3. RESOLVED: Shareholders request that the Board of Directors generally prohibit sales of facial recognition technology to all government entities, and to disclose any exceptions made, in the board and management’s discretion.
4. RESOLVED: Shareholders request that the Board of Directors prepare a report on how implementation of Microsoft’s commitment to the Fair Chance Business Pledge (“the Pledge”) has advanced progress toward eliminating racial discrimination at Microsoft. The report, prepared at reasonable cost and omitting proprietary information and published publicly within one year, should evaluate the risk of racial discrimination that may result from the use of criminal background checks in hiring and employment decisions.
5. RESOLVED: Shareholders request that the Board of Directors oversee an evaluation and issue a public report, at reasonable cost and omitting proprietary information, describing if, and how, Microsoft’s direct and indirect lobbying activities align with company policies and principles on artificial intelligence, public policy, human rights, and racial justice, and how the company plans to mitigate risks created by any misalignment.

UPDATE: #2 passed, with  78% of the vote.  #1 and #5 got 40% and 38% respectively, surprisingly good showings.  Microsoft shareholders approve resolution calling for new insights into sexual harassment cases, on Geekwire, has more.

The view from the board room?

Microsoft's Board of Directors (including their CEO Satya Nadella) recommends voting against all of these.   Huh.  Does this align with company policies and principles on artificial intelligence, public policy, human rights, and racial justice? Nope.  No wonder they're against #5!

The Board's recommendations also don't align with Microsoft's corporate values like "accountability." or their diversity and inclusion statement's claim that "we believe in the transformative power of engaging many different perspectives," or their corporate social responsibility (CSR) commitments like "unequivocally support the fundamental rights of people, from defending democracy, to addressing systemic racial injustice and inequity, to protecting human rights"  and  "earn trust".   Funny how that works.

The Board has their reasons of course.  A few themes come up in the company's responses to all of the resolutions

• Microsoft has made public "commitments" and disclosed some information (or at least plans to) although less than is being asked for, so all the resolutions asking for reporting are "unnecessary."   In their response to the Pay Equity resolution, for example, Microsoft admits they are "well aware significantly more work needs to be done" but "does not believe pay gap disclosure would further advance our commitment or ongoing efforts."    
• Microsoft does positive things in all these areas.   Which they do, but that's only part of the story, and not really what the resolutions are about.  With several of the resolutions though the list of "positive things Microsoft does" is the bulk of the response.
• The requests in each of the resolutions for plans to evaluate or mitigate risk aren't even worth responding to.  Seriously, look at the company's responses, they don't even discuss "risk" even though it's specifically mentioned in the resolution!

Personally, I don't find the Board's responses particularly persuasive.  As a Microsoft shareholder (I worked there from 1999-2007, first in Microsoft Research and then as GM of Strategy Development in MSN, and still own some stock) I'm voting YES of all of five them.  If you're a shareholder, I encourage you to vote YES on all five shareholder resolutions as well.

Hey wait a second!

Microsoft goes farthest in opposing the facial recognition resolution, which it bluntly says "does not advance the interests of Microsoft, its shareholders, or other stakeholders."   Why?  Well for one thing they've made public "commitments", and they've done a lot of positive things!  Also:

This proposal would impose a blunt prohibition that would deny public agencies the ability to deploy facial recognition technology in societally beneficial use cases.

Hey wait a second, that's not what the resolution says!  It explictly allows exceptions, it just asks the Board to disclose them.  Luke Stark's helpful analogy that facial recognition is like plutonium, incredibly toxic but with a few beneficial usages, is a good lens to look at this through. There may be exceptions, but tost of the time, spraying plutonium should be prohibited.  

Of course some of the exceptions may be lucrative, and the Board wants Microsoft to be able to make money helping governments spray people with plutonium in "societally beneficial use cases."  The resolution allows that; they just have to disclose what they're doing.  Given how toxic facial recognition is, and how strong the evidence is that it's harmful, that seems pretty reasonable to me!  

In the "societally beneficial use cases" where Microsoft's helping governments spray plutonium, the company should indeed disclose that they're doing it.  The human rights resolution They should also be ready to describe the "risk profiles," how the safeguards are "calibrated," and why it's in the interests of all the "stakeholders" – including the ones who are being sprayed with plutonium.

Stay tuned for more

All of these resolutions are part of longer-term battles.  In Arjuna Capital's statement for resolution #2 (sexual harassment), they talk about the 2012 class action lawsuit from almost 300 women employees.   #1, pay equity, has a history as well: Microsoft was sued by Black employees in a class action in the early 2000s, narrowly avoided a class action suit by women employees on gender inequity, and just last year settled with the Department of Labor over allegations of racial discrimination.  

Similarly, the facial recognition resolution is only the latest skirmish in the interlocking multi-year fights over facial recognition and privacy.  Resolution #5 (lobbying) has some of the backstory:

In 2020, Microsoft committed not to sell facial recognition to police “until there is a strong national law grounded in human rights,”⁷ and it has urged governments to consider “civilian oversight and accountability” of facial recognition.⁸ However, Microsoft lobbies for and testified in support of laws that enable police use of facial recognition and undermine such local accountability efforts.⁹ Last year, a Microsoft employee – who is also a Washington State Senator – prime sponsored¹⁰ a weak, industry-backed state facial recognition bill, which was strongly opposed by a large coalition of privacy advocates, racial justice advocates, and consumer rights organizations.¹¹ Contradicting Microsoft’s claim that the Washington bill “offers protections for civil liberties,”¹² privacy expert Jennifer Lee said Microsoft’s bill “purports to put safeguards...but does just the opposite.”

I was part of that large coalition opposing the 2020 facial recognition bill, and the bad privacy bill that Microsoft also supported but failed to pass.  In 2021, the Microsoft employee / State Senator opposed even holding a hearing on a facial recognition moratorium bill, and also once again co-sponsored the Bad Washington Privacy Act (which once again Microsoft supported and once again did not pass). Microsoft’s put a lot of energy into"direct and indirect lobbying activities" as part of these battles, in Washington and across the country.  As we get ready for the 2022 legislative session, and it's a very good question how well these activities align with the company's stated principles and policy commitments.  

So even though Microsoft's Board will almost certainly fend off the resolutions at this year's meeting, the issue isn't going away.  Once the legislative session ends, activist investors will start planning for next year's shareholder meeting; and if the legislature doesn't act, there's starting to be talk about a potential statewide initiative banning facial recognition.  Stay tuned for more!

Links

• Scrutiny mounts on Microsoft’s surveillance technology in The Hill and  Investors pressure Microsoft over surveillance tech policies  in Windows Central  have more on #3, #5, and the human rights review resolution.  
• Dina Bass' Microsoft Agrees to Human Rights Review in Deals With Law Enforcement, Government on Bloomberg Tech discusses the human rights resolution
• A bad day for a bad privacy bill, a good day for privacy has highlights from Stan Shikuma's and Jennifer Lee's testimony in 2020.  You can see the full video here.
• Arjuna Capital's Microsoft Needs Independent and Transparent Investigation of Gender Discrimination, Sexual Harassment has more about the background on #1 and #2
• Meet the Woman Who Convinced Apple, Starbucks, and Nike to Close Their Gender Pay Gaps has backstory about Arjuna's Natasha Lamb.  
• Bowing to investors, Microsoft will make its devices easier to fix describes another successful resolution, from right-to-repair activists.

Great news!  The King County Council Committee of the Whole voted 9-0 to advance ordinance 2021-0091, banning use of facial recognition by county government and administrative agencies – including by law enforcement.  

Update, June 2: the King County Council similarly passed it unanimously, 9-0!  Thanks to all the activists and researchers who have laid the groundwork for this over the years, all the King County residents who got involved, and to the King Council for the courageous vote!

Update, November 10: Bellingham Washington voters banned government use of facial recognition and predictive policing!  Initiative 2, brought to the ballot by People First Bellingham, won 57 percent of the vote.  Grassroots activism FTW! ACLU of Washington's press release has more

Kudos to Councilmember Jeanne Kohl-Welles for sponsoring, Councilmembers Rod Dembrowski and Dave Upthegrove for co-sponsoring.  Thanks as well to all the Councilmembers for the excellent discussions over the few weeks – and the very courageous vote!  And, extra thanks Councilmember Claudia Balducci, who represents my district and was extremely responsive during the discussions.  

Combined with yesterday's news that Amazon will extend their moratorium on selling facial recognition to law enforcement, and Monday's announcement that the Metropolitan Washington Council of Governments will end the use of the National Capital Region Facial Recognition Investigative Leads System ... quite a week!   As Kade Crockford and Carl Takei say on ACLU's site, when we fight, we win.

And for good reason.  As Councilmember Jeanne Kohl-Welles and Jennifer Lee of ACLU of Washington say in King County government must turn its back on facial recognition technology

The potential dangers inherent in government use of this technology are immense and far outweigh any potential benefit. Facial recognition technology must be banned, not only because it fuels discriminatory surveillance, but also because it jeopardizes everyone’s privacy and civil liberties. With this technology, government agencies can track individuals’ movements and contacts without their knowledge or consent, chilling free speech and free association, undermining press freedom and threatening the free exercise of religion.

The Council is expected to take a final vote on the ordinance at their June 2 meeting.   Since all Councilmembers are on the Committee of the Whole, it's looking good unless something changes significantly.  Still, it's never over until it's over, and I'm sure facial recognition vendors will keep lobbying against it.  So, if you're in King County, it's a great time to thank your Councilmember for today's vote today!

The King County Council Committee of the Whole is considering on ordinance 2021-0091, banning governmental use of facial recognition – including by law enforcement.  

Update, June 2: King County Council passed the ordinance unanimously, 9-0! Thanks to all the activists and researchers who have laid the groundwork for this over the years, all the King County residents who got involved, and to the King Council for the courageous vote!

As Councilmember Jeanne Kohl-Welles and Jennifer Lee of ACLU of Washington say in King County government must turn its back on facial recognition technology

The potential dangers inherent in government use of this technology are immense and far outweigh any potential benefit. Facial recognition technology must be banned, not only because it fuels discriminatory surveillance, but also because it jeopardizes everyone’s privacy and civil liberties. With this technology, government agencies can track individuals’ movements and contacts without their knowledge or consent, chilling free speech and free association, undermining press freedom and threatening the free exercise of religion.

Opposition to facial recognition often starts by focusing on the biases and inaccuracies in today's software.   It's very easy to see the injustice when Black men like  Robert Julian-Borchak Williams, Nijeer Parks, and Michael Oliver are arrested for crimes they didn't commit based on false matches by facial recognition software.  But as I said in my public comments at the May 5 Committee of the Whole meeting

[T]he issues with facial recognition go far beyond today’s bias and accuracy problems.   As Timnit Gebru of the Gender Shades project points out in A Case for Banning Facial Recognition, even completely accurate facial recognition can still be used in ways that are “detrimental to certain groups of people.”  Evan Selinger and Woodrow Herzog suggest accurate facial recognition might be even more dangerous “because those in power will find it irresistible and they’ll want to use it more often.”

Veena Dubal strikes a similar note in San Francisco was right to ban facial recognition:

The concerns that motivated the San Francisco ban are rooted not just in the potential inaccuracy of facial recognition technology, but in a long national history of politicized and racially-biased state surveillance.

There's growing momentum for banning facial recognition.  At least 20 cities - including Boston, New Orleans, and Portland have joined San Francisco in banning it. Vermont banned law enforcement use of facial recogntion last fall, and last month Virgina also banned local law enforcement use.  And just today, Amazon announced an indefinite extension the moratorium on selling their Rekognition facial recognition software to law enforcement.

Public comments in the King County Council discussions so far have been really outstanding.   Of course, with only two minutes for comments, there's a lot that hasn't been discussed in any detail yet.  One area worth highlighting is the implications of facial recognition on transgender, non-binary, and gender-variant people.   Os Keyes' 2019 Washington state legislature testiminony is a good starting point here.  An excerpt:

This technology is deeply threatening to trans existences, particularly the existences of trans people of colour. This is for a couple of reasons. The first is simply that the technology is often biased. It is less accurate with trans people; it is less accurate with people of colour. And so when you take it and deploy it, it is more likely to flag trans people as incongruent, unexpected; to falsely identify us as matches, or highlight us for attention.

If this happens – if someone is flagged, whether due to dataset bias or a simple error, and reported up to an operator – trans people are also more likely to face unpleasant and often violent outcomes. Because we are incongruent, because we are often unexpected, there is a long history of government entities, be it the police or the housing administration, discriminating against us.

The National Transgender Survey, in their 2015 report on Washington State, found that 60% of trans people who had interacted with the police experienced mistreatment. And this is without algorithms prompting the police to interact with us. 33% of us experienced discrimination in public accommodations – even without a facial recognition system prompting the administrative official weighing up our housing, healthcare or benefits to give us a second look.  These numbers are far worse for trans people of colour, particularly trans women of colour.

Of course, that's just one of the many problems with facial recognition technology. Ban Government use of Facial Recognition in King County (an open letter to King County Council signed by dozens of civil rights, civil liberties, racial equity, immigrant rights, workers rights, and progressive and libertarian organizations) and Malkia Cyril's Defund Facial Recognition Before It's Too Late have more details.  

So if you live or work in King County, please contact the Council and ask them to ban governmental use of facial recognition.

Image credit: originally from San Francisco passes city government ban on facial recognition tech on TechCrunch

Update, November 2021: most of the semi-regular "tech news roundups" I did in early 2021 are now hidden.  This top story on this one, though, relates to the the Washington privacy battle so I decided to leave it up.  

If the tweet embedding isn't working for you, it's my thoughts on a Sen. Carlyle's framing in a now-paywalled Wall Street Journal story  State Data Privacy Bills Stumble looking at the state privacy landscape after the back-to-back failure of the Bad Washington Privacy Act and Florida's privacy bill.  The landscape's changed a bit since then: Colorado passed the Colorado Privacy Act (ColoPA), and in New York SB 6701 (strong in many ways including opt-in) made it farther than people had expected.  

Sheikh Jarrah: Facebook and Twitter systematically silencing protests, deleting evidence

on Access Now (accessnow.org)

Facebook and Twitter are systematically silencing users protesting and documenting the evictions of Palestinian families from their homes.

‘I’m shocked that they need to have a smartphone’: System for unemployment benefits exposes digital divide

By Andrew Kenney on Associated Press (usatoday.com)

Like previous changes to the UI system during the pandemic, the new tech has caused a wave of confusion and complaints about overloaded help lines.

Tech service workers are essential. They want to be treated like it.

By Megan Rose Dickey on Protocol — The people, power and politics of tech (protocol.com)

Nora Morales, a janitor at Google, told Protocol tech offices would “fall apart” without service workers.

Foresight and Decolonial Humanitarian Tech Ethics

By Sabelo Mhlambi on Berkman Klein Center (cyber.harvard.edu)

Anasuya Sengupta, Sabelo Mhlambi, Andrew Zolli, and Aarathi Krishnan discuss if humanitarian actors can play a more intentional role in designing just and equitable digital futures

Perspective | Employers’ new tools to surveil and monitor workers are historically rooted

By Saima Akhtar on The Washington Post (washingtonpost.com)

Technology has just made century-old methods more efficient and widespread.

Fake net neutrality comment campaign a harbinger of automated disinformation to come - Justin Hendrix

By Justin Hendrix on Tech Policy Press (techpolicy.press)

Governments may not be prepared to contend with new mechanisms to automatically generate content and, indeed, online identities.

“The entire U.S. is built on algorithmic governance”

By Nancy Scola on Slow Build (slowbuild.substack.com)

A Q&A with Colgate’s Dan Bouk on the hidden formula binding Congress

WebAIM: Screen Reader User Survey #9

on webaim.org

Answering Europe’s Call: Storing and Processing EU Data in the EU

By Brad Smith - President and Chief Legal Officer on EU Policy Blog (blogs.microsoft.com)

Today we are announcing a new pledge for the European Union. If you are a commercial or public sector customer in the EU, we will go beyond our existing data storage commitments and enable you to process and store all your data in the EU. In other words, we will not need to move your data outside th…

Analytics Suggest 96% of Users Leave App Tracking Disabled in iOS 14.5

By Tim Hardwick on MacRumors (macrumors.com)

An early look at an ongoing analysis of Apple’s App Tracking Transparency suggests that the vast majority of iPhone users are leaving app...

Greek camps for asylum seekers to introduce partly automated surveillance systems

By Corina Petridi (Reporters United) on AlgorithmWatch (algorithmwatch.org)

An EU-funded surveillance system for “reception and identification centers” on five Greek islands raises questions about asylum seekers’ privacy and well-being. Despite assurances from European authorities, the Centaur system suggests that mass control, and not shelter, is the priority.

How can we resist surveillance advertising?

By Wednesday 19 May 2021, 18:00-19:30 on New Economics Foundation (neweconomics.org)

Join Heather Burns from the Open Rights Group, Duncan McCann from the New Economics Foundation and other guests TBA to discuss the growth of surveillance advertising

PSA: Twitter’s New Tip Jar Can Reveal Your Address

on vice.com

Twitter’s new feature to pay users is off to a rough start, as researchers find some issues that may reveal sender or recipient’s personal addresses.

I’m Jon Pincus, a technologist, entrepreneur, and long-time Bellevue resident. Following up on my comments from two weeks ago, I’d like to highlight a key difference between the proposed King County Ordinance 2021-0091 and the statewide facial recognition legislation SB 6280 that comes into effect on July 1.

Facial recognition is like plutonium: so toxic that its use needs to be restricted to a small number of highly specialized and tightly controlled situations.  That’s exactly what Ordinance 2021-0091 does.

SB 6280 takes a very different approach.  It allows virtually all uses of the technology, but introduces transparency and testing requirements.  For example, it requires government agencies to

• document how they’ll ensure that everybody’s sprayed with equal amounts of plutonium.
• test out plutonium on the communities most likely to be harmed, to see how toxic it is to them
• and produce reports on what happens when people are sprayed with plutonium.

Unsurprisingly, the communities most at risk from facial recognition strongly opposed the statewide legislation, instead favoring a moratorium or ban.

The legislature wasn’t ready to go that far, but they did remove a clause in the original version of the bill that would have prohibited stronger local legislation.  In other words, the legislature specifically allowed for exactly the kind of ordinance King County is currently considering.  Unsurprisingly, the communities most at risk from facial recognition support this ordinance.

As a software engineer, I strongly urge you not to get too focused on whether or not algorithms are improving.   Cherry-picked quotes and numbers typically make the technology look better than it really is, for example by ignoring real-world complexities like racialized policing and inexperienced users with limited training.

Besides, the issues with facial recognition go far beyond today’s bias and accuracy problems.   As Timnit Gebru of the Gender Shades project points out in A Case for Banning Facial Recognition, even completely accurate facial recognition can still be used in ways that are “detrimental to certain groups of people.”  Evan Selinger and Woodrow Herzog suggest accurate facial recognition might be even more dangerous “because those in power will find it irresistible and they’ll want to use it more often.”

Please protect King County residents and visitors, and vote to ban government agencies from spraying plutonium.

Last updated: April 21

There's less a week left in the Washington state legislative session.   A few months ago, the Bad Washington Privacy Act (SB 5062) seemed like it was sure to pass. Sen. Reuven Carlyle's weak, industry-backed bill had sailed through the Senate 48-1 – and House Civil Rights and Judiciary Committee Chair Drew Hansen had refused to give a hearing to Rep. Shelley Kloba's People's Privacy Act (HB 1433).  

But now, the Bad Washington Privacy Act is on the ropes, with its supporters' claims of "consensus" revealed as an illusion.

• House committees advanced Rep. Hansen's version of SB 5062 on straight party-line votes.  This version managed to displease almost everybody:  the Tech Equity Coalition, tech companies, privacy advocates, progressive grassroots activists, and Republicans all oppose it.
• Rep. Kloba has introduced amendments fixing many of the bill's problems, with broad support by immigrant rights, civil rights, and civil liberties groups
• Other amendments have been introduced as well, almost two dozen all together –

The House didn't vote on  SB 5062 before its "cutoff" on Sunday, April 11, but procedural shenanigans means it's still alive.  So the House still has a chance to pass something before the session ends this Sunday – the Senate version, Rep. Hansen's version, Rep. Kloba's amendments, or something else.   If the House passes something that's different than the Senate version, then there's a multi-step process to try to get to agreement.  That's what happened in 2019 and 2020  – and negotiations collapsed.

Especially since there's other critical legislation still to be resolved, I can certainly see why most people don't think the House will pass anything this session.  That would still be a huge victory for the Tech Equity Coalition and allies – the third time in a row they've stopped a bad bill from passing.  

But for the last several months we've been saying that the best outcome is meaningful privacy protection for Washingtonians this legislative session – and it's still achievable!  

So let's look in a little more detail at the pressures the legislators are under,  the various options on the table, and why the House can and should pass the Kloba amendments.  

• "We've got to pass something"
• Big tech says yes, legislators should sell out their constituents!
• The case for the Kloba amendments
• "Perfect is the enemy of good"
• The stakes are high!

"We've got to pass something"

Several of the legislators I've talked with have been quite candid about the pressure they're under to pass something this session.   And even though the Bad Washington Privacy Act won't actually protect Washingtonians' privacy, passing it at least lets lawmakers claim they've done something.  Big tech and their allies will continue to claim that the bill offers a "gold standard" with "robust enforcement" and "strong protections" of "unambiguous rights."   Legislators can point out that the bill they passed is stronger than the Even Worse Virginia Privacy Act.   Hooray!

Of course, the risk to legislators, is that their constituents might not believe those claims.  On email threads with the House Civil Rights and Judiciary committee, a handful of grassroots activists were quite blunt in their feedback that the Bad Washington Privacy Act is bad.  They also made it clear that they thought legislators who were supporting the Bad Washington Privacy Act were representing big tech's interest instead of their constituents.

So while in some ways voting to pass something weak seems like the path of least resistance – it keeps big tech happy, and lets legislators claim a win – there's a really high potential cost to it as well.   Do they want to be seen as selling their constituents out to big tech?  

And Republicans' party-line votes against Hansen's version of the bill, on the grounds that it doesn't go far enough to protect privacy, make it an even more fraught situation for Democrats.  With immigrant communities, civil rights groups, and progressive activists all opposing the extremely unpopular Bad Washington Privacy Act, will Democrats decide to hand Republicans a campaign issue and antagonize their base by pushing something through?  

Big tech says yes, legislators should sell out their constituents!

None of that's a problem from big tech's perspective.  They think the Sen. Carlye's "Classic" version of the Bad Washington Privacy Act is just fine.  It doesn't make them get consent before exploiting people's data, it doesn't let people sue them if they break the law, it's got all kinds of loopholes and exemptions that neuter enforcement.  What's not to like?  

And even though big tech opposes Rep. Hansen's version, which has some minor improvements such as a very limited private right of action that allows people to sue for injunctive relief (but no damages), that's probably just posturing for negotiation purposes.  Last year, they were willing to settle for a limited private right of action in the final negotiations.    As I said in the Appropriations hearing, they'll probably wind up describing the Hansen version as a "reasonable compromise" – especially if additional amendments to weaken it further.

Because what big tech really really doesn't like is the Kloba amendents – or the even stronger People's Privacy Act.   Both of these make tech companies get consent before exploiting people's data.  Both of these have much stronger enforcement.

So for the third year in a row big tech and Sen. Carlyle are demanding that legislators let them exploit our data and leaves Washingtonians unprotected.   The House said no in 2019 and 2020, but the message clearly hasn't been received.  

This is actually a good reason that the House should pass the Kloba amendments overwhelmingly.   It's a good way to respond to big tech's insistence that legislators sell out their constituents by saying NO much more loudly – and it also says YES to meaningful privacy protections and holding big tech accountable.

The case for the Kloba amendments

And there are other even better reasons to pass the Kloba amendmets.  Start with the policy case.  As 40+ Tech Equity Coalition organizations and allies write

Unlike other versions of SB 5062, Rep. Kloba’s striking amendment has a fully opt-in approach, contains a strong enforcement mechanism with a private right of action including a right to recover damages, allows local jurisdictions to pass stronger laws, and removes some loopholes. Although this amendment can still be improved, it is a big step forward and in line with HB 1433, the People’s Privacy Act, and addresses the four key changes we have recommended be made to SB 5062.

During the hearings and in written comments, experts from groups like Consumer Federation of America, La Resistencia, CAIR Washington, Future Ada, InterIm CDA, EFF, and ACLU of Washington have gone into detail on all of these.   On opt-in, for eample, the current bill's weaker opt-out framework fails to protect immigrants, survivors of stalking, harassment, and domestic violence, and disabled people using screenreader technology.  

And as well as being good policy, these are popular positions!   Opt-in – making companies should have to get informed consent before they collect, share, or sell your data – typically polls over 80%.   Most Washingtonians think they should be able to sue companies who break the law and (if they win) get compensated for the harms that have been done.

And from House legislators' perspective, a bipartisan attempt to pass good legislation is a much better outcome for both parties than just giving up now.  Even if the Senate once again refuses to negotiate, the House passing strong privacy protections would be a significant legislative success that builds even more momentum for the discussions next session.

"Perfect is the enemy of good"

But if the Senate once again refuses to negotiate, then the House has to choose between passing the Bad Washington Privacy Act and nothing.   After not getting their way in 2019 and 2020, tech lobbyists take advantage of this by warning legislatures they'll be seen as legislative failures if they don't pass something this year.  One of their favorite talking points in aid of this is "perfect is the enemy of good".

But the Bad Washington Privacy Act isn't good.  It's bad.  

Don't take my word for it.  Listen to groups like One America, La Resistencia, CAIR Washington, Future Ada, InterIm CDA, MAPS-AMEN (American Muslim Empowerment Network), Japanese American Citizens League Seattle Chapter, Black Lives Matter - Seattle King County, Puget Sound Sage, the John T. Williams Organizing Committee, Urban League of Metropolitan Seattle, Eastside for All, Real Change, and ACLU of Washington.  True, there are also some groups who once the non-profit exemption got added decided that the Bad Washington Privacy Act was good enough.  But none of them are looking at it from the perspective of people who are immigrants, people of color, or Muslims.

The Bad Washington Privacy Act is bad – and a bad bill is worse than no bill.  So in reality standing up to big tech for a third year in a row will be actually a huge legislative success.

Why is a bad bill worse than no bill?  One big reason is that passing the Bad Washington Privacy Act gives the legislature’s endorsement to allowing predatory and exploitative behavior with no real consequences – and lends credence to big tech's over-inflated claims for how much protection the bill gives people.    

In their Senate testimony, tech lobbyists were very candid that one of their goals in passing a privacy law is to reassure people that their data is safe so that they'll share more.  But people's data won't actually be safe if the Bad Washington Privacy Act passes.   So if legislators pass this bill, they're encouraging people to think they're safer than they are – and share more data, putting themselves even more risk.  

Another important reason a bad bill is worse than no bill is that once something is passed, it's very hard to change it.   Last year's legislation on governmental use of facial recognition is an excellent example of this.   Since then, the landscape has shifted significantly.  Cities including Boston, New Orleans, and Portland have joined San Francisco in banning governmental use.  Vermont became the first state to ban it.  There's potential federal legislation, with bipartisan support.  

But when this year's session rolled around, Sen. Carlyle refused to hold a hearing on Sen. Bob Hasegawa's facial recognition moratorium bill, telling Geekwire he did not feel a need to re-engage in that issue at this time:

“The legislation that we passed last year created a framework for how the public sector and the private sector can utilize facial recognition technology in responsible ways,” he said. “I feel like we made a material and meaningful policy step forward.”

Something similar's very likely to happen if the legislature passes a bad privacy bill this year.   After doing so much work, why not wait to see how it works out before changing it?   The illusion of protection today will become a further barrier to real protection tomorrow.

The stakes are high!

But then again, big tech's influence is strong here.  So really, anything can happen.

There's a lot of other critical legislation still to be resolved as well, and it's hard to know how much time and energy legislators have to work on the privacy bill.   On the one hand that makes it less likely that anything will happen ... on the other hand, this is exactly the kind of situation where big tech could try to sneak something through.

Whatever happens this year, the dynamics will be very different when the battle continues in next year's legislative session.   As we've been fighting the bad bill, we've also gotten a chance to do more advocacy for the good features of the People's Privacy Act.  

The People's Privacy Act protects people, not corporations, and  has bi-partisan sponsorship as well as broad support from immigrant rights, civil rights, civil liberties, consumer, and grassroots activism groups.   It's a much better starting point for next year's discussion than the Bad Washington Privacy Act was this year.

Another way the dynamics will hopefully be different next year would be if Senate Democrats will wake up and smell the coffee.  Sen. Carlyle's approach hasn't worked in the past and so is not likely to work in the future.  They really should put somebody else in charge next year.  

And whatever happens in Washington has ramifications in other states as well as with federal legislation.  If the Bad Washington Privacy Act passes here, it will reinforce the strategy Todd Feathers discusses in Big Tech Is Pushing States to Pass Privacy Laws, and Yes, You Should Be Suspicious – and be a shot in the arm for Rep. DelBene's very similar bad federal legislation.   But if big tech's plans once again get derailed here in Microsoft's and Amazon's home state ... that could cause some broader hiccups as well.

So the stakes are high as Washington's short legislative session wraps up.   Stay tuned for more!  

And, when you get a moment, please tell your legislators not to sell us out to big tech!   Ask them to SUPPORT the Kloba amendments - and OPPOSE the Bad Washington Privacy Act if the amendments don't pass.

UPDATE, after the session

It went down to the wire, and final "negotiations" reportedly included Sen. Carlyle holding another bill hostage unless members caved and passed the Bad Washington Privacy Act.  But at the end of the day, enough progressive House Democrats opposed the bill that there weren't quite enough votes to get it past united Republican opposition, and the legislature adjourned  "sine die" without taking any action on the Bad Washington Privacy Act.

It's another huge win for grassroots activism.  As Indivisible Plus Washington says in The Bad Washington Privacy Act has been defeated!

This is the third year in a row that the House has rejected tech lobbyists’ attempt to push through a weak, industry-backed “privacy” bill.  Thanks to all the legislators involved....

And thanks as well to everybody who got involved with the activism. Every phone call, email, and meeting helped make a difference.

At the start of the session everybody thought the Bad Washington Privacy Act was almost certain to pass, and after the Senate 48–1 vote it seemed like a done deal. But once again the Tech Equity Coalition took the lead, and lots of us joined in to help with creative and persistent activism. Now, we’ve now got a huge amount of momentum, and a great opportunity to build on this win to get something strong passed in 2022. Not only that, we’re likely to influence the debate in other states and nationally as well.

UPDATE, after the 2022 session

It’s time for Washington to pass strong privacy legislation!, Feb 14 💘 Update, The situation is … fluid, and It ain’t over till it’s over tell the story of the 2022 session. The new Foundational Data Privacy Act, sponsored by Representatives Slatter and Berg, got off to a promising start, tech lobbying kicked into overdrive, and there were once again missed deadines and shenanigans.  By the time it got HB 1850 got out of Appropriations it had been butchered and turned into a "compromise" vehicle to pass ... SB 5062, the Bad Washington Privacy Act!  Sen. Carlyle had announced that he'd be retiring after the session but his last try at the apple ended the same way the previous ones did.  The session adjourned "sine die", and the Bad Washington Privacy Act was 0-for-4.

The Washington state legislature is about to vote on the Bad Washington Privacy Act (SB 5062).  Defenders of this bill would like us believe that this bill is a "gold standard" with “strong protections” and “unambiguous rights”.  In reality, the current version of the bill codifies the status quo.  It protects tech industry’s rights, but leaves the privacy rights of the people almost completely unprotected.

The bill is a "full-on Monet." As Cher says in the 1995 movie Clueless, "It's like a painting, see? From far away, it's okay, but up close, it's a big old mess."

SB 5062 “right” to opt-out of having your data collected and sold to a data broker, or used for targeted advertising, is just one example of “a big old mess” found in the bill.  Opt-out means that companies can generally do what they want with your data (subject to their privacy policy) unless you tell them not to.   It’s the opposite of “opt-in,” where companies can’t collect or sell your data without getting your informed, affirmative consent.

With opt-out, the onus is on the individual to discover that personal information is being collected about them, and then figure out how to "opt-out" of that data collection.  The process is so convoluted that the risk is that people will give up trying to navigate the privacy policy and opt-out process and let corporations collect our data anyway. This is exactly what Google, Microsoft, and Amazon want - which is why they’re big supporters of the Bad Washington Privacy Act.

The types of data collected by tech companies, advertising companies and others isn’t limited to browser, device, and usage data, such as the type of computer you’re using, the software, or even your IP address.  As Norma Smith, a former Republican Washington state legislator notes in her op ed in the Everett Herald, data collected might include health information and your political views – in other words, very personal information.

Opting out can be a challenging process requiring technical skills and time not readily available to many people. For people who are not technically inclined, or who have low English proficiency, opt-out can present a significant barrier to meaningfully control one’s data.

Even after you’ve discovered how to opt out, the Bad Washington Privacy Act makes it difficult to actually make this happen. According to provisions in the bill, individuals are required to send a request to the "data controller". The data controller has 15 days to respond to you. They can extend that to 45 days if they feel they need to.  Then they can refuse to honor your request. You can appeal, but that's going to take another 30 days. That can lead to a full 90 days before, maybe, just maybe, you might be able to opt-out. No guarantees, of course.

Suppose that after full 90 days, you haven't heard back or your appeal has been denied?  You're angry, so you decide to sue them.   If you eventually win your lawsuit, then they finally have to let you opt-out, and maybe pay your attorney’s fees - but again, no guarantees.  They don’t have to pay any penalties or damages for the harm they’ve caused.

The Attorney General is allowed to sue for damages and penalties.  But the money allocated for enforcement is only is enough to hire 3.6 full-time employees. For the entire state. The budget is less than a quarter of what the tiny Grand Duchy of Luxembourg, a tenth the size of Washington, spends to enforce its privacy laws.

The legislature still has a chance to fix the Bad Washington Privacy Act and pass a strong privacy bill that really protects us.  Rep. Shelley Kloba has introduced an amendment that makes the bill fully-opt in.  It also give us all the right to sue for money damages — just like we can sue companies that harm us in other ways — and has penalties for companies that break the law.  So hopefully the legislature will pass the Kloba amendment, and take an important step to giving us strong privacy protections based on meaningful rights.

But the one thing they shouldn't do is pass the current version of the Bad Washington Privacy Act and settle for the illusion of rights, continuing to leave us all at risk.  Once a bad bill is passed it is very hard to change.  I know there's a temptation to feel like we must pass something, but waiting another year and truly protecting our privacy is much better than passing this bad, “full-on Monet” of a bill.

Image via Best Quotes From Clueless Movie, Refinery 29

Madame Chair, Mr. Ranking Member, and members of the committee,

I’m Jon Pincus from Bellevue, a technologist and entrepreneur.  I OPPOSE the Bad Washington Privacy Act in its current form.  Others have already discussed the issues I covered in my written testimony.  So instead ...

Lobbyists testifying CON tell you that even the very limited private right of action in the current version of the bill “with no chance for public input” will cause them a “burden”.  Anything stronger will surely cause the sky to fall!  Remember last year, when they talked about the “robust enforcement” of the Senate bill -- which lacked a per se clause, so even the AG couldn’t enforce it?

Of course industry prefers no liability when they break the law, and “robust enforcement” by 3.6 FTEs this year’s bill budgets.     So take what they say with a grain of salt.

Instead, strengthen the private right of action and remove the right to cure.  Or go further, and adopt the People’s Privacy Act as a striker.  It has bipartisan sponsorship and broad support from dozens of civil rights, immigrant rights, and grassroots organizations -- input that the Senate has ignored over the last three years.

A privacy bill without enforcement or deterrence will not protect Washingtonians.  So if you don’t strengthen it, please vote no, and don’t give the legislature’s endorsement  to allowing predatory and exploitative behavior with no real consequences.

Mr. Chair, Ranking Member, and members of the Appropriations committee,

I’m Jon Pincus from Bellevue, a technologist and entrepreneur, and former General Manager of Strategy Development at Microsoft.  I'm also one of the leaders of Indivisible Plus Washington, a grassroots activism group with more than 20,000 members across the state.  

I OPPOSE SB 5062 in its current form for a long list of reasons.  This testimony focuses on the fiscal aspects of SB 5062 and covers four points:

• The paltry $1.2 million budget allocated to the AG’s Office for 2021-2023, decreasing in future years, is insufficient for enforcement or deterrence
• Strengthening the very limited private right of action, and allowing cities and county attorneys to enforce the law as well, can improve enforcement and deterrence without incurring additional taxpayer cost
• The “right to cure” should be removed
• If those fixes are not made, the bill as budgeted will not protect Washingtonians’ privacy -- so please vote “no”

The budget is insufficient for enforcement or deterrence

Other than the very limited private right of action in Section 111, allowing individuals to sue for injunctive relief and costs, Section 112 of the bill limits enforcement “solely” to the AGO.  As a result, the AGOs paltry budget of $1.2 million for 2021-2023 (3.6 FTEs), decreasing in future years, is not sufficient to protect Washingtonians privacy.

Look at the evidence from elsewhere.  European budget allocations are much larger.  Ireland’s data protection commission, for example, has a $23 million annual budget despite having a population smaller than Washington state.  Even so, European data protection enforcement has been held back by lack of resources.   Just last week, the EU Parliament issued a resolution criticizing enforcement, noting that cases referred to the Irish DPA in 2018 still have not been heard and that the Irish DPA closes most cases with a settlement rather than a sanction.

California’s experience is also instructive here.  In the only case settled so far under their 2018 CCPA, the settlement gave $2 to each person who had been harmed, but did not impose any additional civil penalties.  California’s newer CPRA allocates an annual budget starting at $10 million / year, which must be increased by the legislature “as may be necessary to carry out the provisions of this title.”

With the current budget, the AGO estimates it can bring three investigations per year.  And what if a large company violates the law?  Joseph Jerome of Common Sense Media testified in the Ways & Means hearing that the average large company has 15 privacy lawyers.  Facebook has over 150.

The AG’s has not been able to prevent Facebook’s and Google’s ongoing violations of Washington political advertising transparency laws, which continued despite a lawsuit and settlement in 2018 and a second lawsuit in 2020.  With such minimal resources, it is hard to see them fairing better here.  Unless significant changes are made, SB 5062 will require substantial additional investment if we are to have any hope of holding companies who break the law accountable -- or deterring others.

Strengthen the private right of action and allow local enforcement

Appropriation can resolve this fiscal problem by some straightforward changes.

• Replace Section 111, the limited private right of action, with HB 1433’s Section 10 (1)
• Remove the word "solely" from Section 112 (1) to allow local enforcement

The much stronger private right of action in HB 1433 allows courts to award damages and civil penalties as well.  This allows private actions to act as enforcement action -- and the threat of a private action becomes much more of a deterrent.

In addition, SB 5062’s Section 113 already provides that moneys from civil penalties can be used to fund the recovery of the AGs attorney fees and costs.   If private actions can also lead to civil penalties, AG resources for enforcement can also increase over time -- without additional cost to the taxpayer.

Consumer groups such as WashPIRG and Consumer Federation of America generally support a stronger private right of action.  Even Consumer Reports, who backs the current version of the bill, said in their March 26 letter to Rep. Hansen that "We would prefer a private right that would also afford consumers monetary relief."

Remove the right to cure

The AG’s office has testified that “right to cure” will be a drain on their resources.  As Consumer Reports said in their March 26 letter, the right to cure is a ““get-out-of-jail-free” card” that “ties the AG’s hands and signals that a company won’t be punished for breaking the law”.

Again, the evidence from California is instructive here.  Their 2018 CCPA law had a right to cure, and the AG’s initial right-to-cure letters focused on sites missing either key privacy disclosures from their privacy notices or a clear opt-out link.

Why should taxpayers fund free testing that companies running the sites should do on their own?  Californians decided they shouldn’t, and removed the right-to-cure in 2020 CRPA, adopted by referendum.

The amendment adopted by CR&J last week introduces a one-year sunset for the right to cure.  But there’s no reason to do this for even a year.  Section 112 (4) should be removed.

If these fixes are not made, please vote “no”

A privacy bill without enforcement or deterrence will not protect Washingtonians.  Instead, it gives the cover of law -- and the legislature’s endorsement -- to the current situation where there are virtually no consequences for predatory and exploitative behavior.

So if these improvements are not made, I ask you to vote “no” on SB 5062, the Bad Washington Privacy Act.

Jon Pincus, Bellevue, 98005

The Washington state Senate's about to vote on a couple of key privacy-related bills:

• SB 5010, which originally would have prohibited insurers from using credit scores to set rates but now is "watered down to the point where its impact would be quite minimal" thanks to an  amendment written by the insurance industry that ‘gutted’ it.  

If you live in Washington state, please Tell your state Senator to support the original version of SB 5010.

• SB 5062, the weak, industry-backed Bad Washington Privacy Act.  Consumer Federation of America's  We Need Real Privacy Protection in the States, not the Washington Privacy Act’s Illusion of Privacy is a good run-down of the problems with this bill.  

If you live in Washington state, please Tell your state Senator that you want strong privacy legislation - and the Bad Washington Privacy Act isn't good enough

SB 5010 is a great example of how "surveillance capitalism" reinforces systemic racism.  As Clyde Ford writes in Crosscut:

If you want to understand systemic racism — how it began, who suffers from it and how it’s eliminated — the history that led to SB 5010 is a great place to start. Likewise, if you want to understand economic inequality — in short, why it’s expensive to be poor — SB 5010 offers a starting point as well.

And civil rights organizations have similarly pointed out who typically gets harmed the most from privacy abuses. As Stanley Shikuma of JACL Seattle Chapter pointed out in his riveting testimony last year, data abuse was core to the mass incarceration of Japanese-Americans during World War II.  In January, Brianna Auffray of CAIR WA, noted that SB 5062 won't even stop the ongoing non-consensual sharing of Muslim prayer app data with ICE and the military (The illusion of protection goes into more detail about this).  

But even in a "progressive" state like Washington, corporate Democrats are very deferential to insurance companies (on SB 5010) and big tech (on SB 5062).   The original version of SB 5010 has support from the state Insurance Commissioner and Gov. Inslee, but the Senate doesn't necessarily care about stuff like that – last year's version of the Bad Washington Privacy Act passed the Senate 47-1 even though the Attorney General said it was unenforceable.  

If and when the Senate passes the bills, they head to the House.   SB 5062 will go to the Civil Rights & Judiciary committee.   There are a couple of paths CJ&R can take:

• advancing the People's Privacy Act (H.R. 1433), which incorporates these and other improvements, instead (via a 'striking amendment').  This is the approach the civil rights groups in the Tech Equity Coalition support.
• starting with the Bad Washington Privacy Act, and strengthen it by adding a private right of action; making it opt-in only; removing loopholes, the "right to cure", pre-emption of stronger local legislation; and so on.   This is the approach the House took last year, where it passed a bill with many of these improvements.

But of course the big tech companies will be supporting the legislation, and they and their allies will be pushing to advance SB 5062 roughly as it is. In 2019 and 2020, the Senate passed weak industry-backed privacy bills overwhelmingly, and the House strengthened it significantly.  This year's Senate bill doesn't incorporate any of the House's improvements, or address most of the Attorney General Office's feedback; it clearly doesn't allocate enough money to be enforced effectively.  So the most likely outcome is the House will strengthen it at least somewhat.  We shall see.

From an activism perspective, the two Senate votes are the only key short-term actions – the House is currently focused on all the other legislation that has to get through by March 9.  If you, or your group, meet with legislators, now's a good time to think about trying getting on their schedule for sometime in mid-March.   Otherwise, we'll be cranking things up once SB 5062 starts to move through the House, so stay tuned for more.

And in the short term:

If you live in Washington state, please

• Tell your state Senator to support the original version of SB 5010.
• Tell your state Senator that you want strong privacy legislation - and the Bad Washington Privacy Act isn't good enough

Image credit: via TechRepublic

Disclosures of NYPD Surveillance Technologies Raise More Questions Than Answers

By Joël Carter on Tech Policy Press (techpolicy.press)

The POST Act requires NYPD to release information on its surveillance systems. But the first tranche of disclosures prompt serious concerns.

TikTok is being tapped by brands like Grammarly, which have found success through viral trends and free advertising on the app

By Grace Kay on Business Insider (businessinsider.com)

Companies advertise on TikTok differently than on any other platform — for many, users do more to promote the brands than the companies themselves.

What the 2020 Elections Taught Us About Disinformation

By Hermelinda Cortés on Tech Policy Press (techpolicy.press)

Any analysis of power in the current moment needs to incorporate disinformation as a form of soft, decentralized power and social control.

Sea of Surveillance: Christopher Gregory-Rivera Exposes Policing in Puerto Rico

By Ilana Novick on Hyperallergic (hyperallergic.com)

Las Carpetas takes a crucial step in exposing the surveillance of activists. But are pictures of folders the most effective way to tell the stories of people impacted?

Virginia lawmakers vote to tightly limit police use of facial-recognition technology

By Jonathan Edwards on Daily Press (dailypress.com)

The bill, which will ban apps like Clearview unless state lawmakers specifically give a police department permission, was sparked by a Virginian-Pilot investigation.

Taking on the tech giants: the lawyer fighting the power of algorithmic systems

By Ed Siddons on The Guardian (theguardian.com)

Whether it’s the CIA or Facebook, lawyer and activist Cori Crider is never one to shy away from a fight

Fixing Section 230 Without Breaking the Internet

on voxmediaevents.com

Twenty-five years after it was signed into law, Section 230 is more endangered than ever. Republicans blame it for censorship, Democrats blame it for misinformation, and nearly everyone thinks it needs reform. But if policymakers aren’t smart about structuring reform, there could be broad, unantici…

Los Altos Hills council set to test license plate surveillance

By Megan V. Winslow on Los Altos Town Crier (losaltosonline.com)

“We need to do it, and we need to do it now,” Councilmember Stanley Q. Mok said. “I don’t feel completely safe in my town, and I want to feel completely safe.”Mok told his colleagues he is “mortified” by the number of burglaries committed in recent months; burglars breached eight L

Covid-19 and Data Breach Litigation: An Interview of Daniel Raymond

By Follow on linkedin.com

The global pandemic has affected everything. COVID-19 is not just grinding trials to a halt and foreclosing live, in-person judicial proceedings, it has changed the class action litigation landscape, including data breach class actions.

How One State Managed to Actually Write Rules on Facial Recognition

By Kashmir Hill on NYTimes (nytimes.com)

Massachusetts is one of the first states to put legislative guardrails around the use of facial recognition technology in criminal investigations.

India Targets Climate Activists With the Help of Big Tech

By Naomi Klein on The Intercept (theintercept.com)

Tech giants like Google and Facebook appear to be aiding and abetting a vicious government campaign against Indian climate activists.

How safe is Clubhouse?

By Kate O’Flaherty on WIRED UK (wired.co.uk)

Despite its boom in popularity, the Clubhouse app has been found lacking in some basic privacy and security protections

How Anduril and other startups are building military ready, self-piloted drones, away from Silicon Valley, where such projects have become politically untenable

on Techmeme (techmeme.com)

By Cade Metz / New York Times. View the full context on Techmeme.

Our First Year: Auditing Algorithms

on Revue (getrevue.co)

Dispatches from Editor-in-Chief Julia Angwin

These 7 Black Women Are the Unsung Heroes of the COVID Pandemic

By Patrice Peck on Health.com (health.com)

In the health care and medical spaces critical to curbing COVID-19, seven Black women are playing both offense and defense against a crisis—stabilizing the same ground on which they blaze new trails.

Bias, disrespect, and demotions: Black employees say Amazon has a race problem

By Jason Del Rey on Vox (vox.com)

Interviews with diversity managers and internal data obtained by Recode find that Black Amazon employees are promoted less frequently and are rated more harshly than non-Black peers.

The Dolly Moment

By Tressie McMillan Cottom on essaying (tressie.substack.com)

Why We Stan A Post-Racism Queen. A new essay on my new project, essaying. Live now. If you are an OG tressiemc.com subscriber - you got this delivered to your inbox along with a free Substack subscription as a thank you.

AI Ethics Non-Profit Ecosystem: Where are the Black Folks?

By Mia Dand on Medium (miad.medium.com)

When Ian Moura and I first started compiling a list of non-profits in the space of AI Ethics, our intent was to map the ecosystem to…

Introducing #NoMoreDataWeapons

By Jamelle Watson-Daniels on Data for Black Lives Blog (blog.d4bl.org)

Data for Black Lives is launching #NoMoreDataWeapons. No more investing in Data Weapons, No more building new Data Weapons, No more disguising Data Weapons as legitimate and neutral.

Virginia’s Weak Privacy Bill Is Just What Big Tech Wants

By Hayley Tsukayama on Electronic Frontier Foundation (eff.org)

Virginia’s legislature has passed a bill meant to protect consumer privacy—but the bill, called the Virginia Consumer Data Protection Act, really protects the interests of business far more than the interests of everyday consumers.Take ActionVirginia: Speak Up for Real PrivacyThe bill, which both...

Zoom Pledges Provide Closed Captioning For All Free Users — A Win For Hearing Health Advocates

By Peter O’Dowd and and Jeannette Jones on WBUR (wbur.org)

Hearing health advocate Shari Eberts talks about her fight to make the service accessible to all.

‘This is bigger than just Timnit’: How Google tried to silence a critic and ignited a movement

By Katharine Schwab on Fast Company (fastcompany.com)

Big Tech has used its power to control the field of AI ethics and avoid accountability. Now, the ouster of Timnit Gebru is putting the movement for equitable tech in the spotlight.

ICE investigators used a private utility database covering millions to pursue immigration violations

By Drew Harwell on The Washington Post (washingtonpost.com)

ICE’s use of the vast database offers another example of how government agencies have targeted commercial sources to access information they are not authorized to compile on their own. One researcher called it “a massive betrayal of people’s trust”: “When you sign up for electricity, you don’t expec…

New York Times Columnist David Brooks Wrote A Blog Post For Facebook’s Corporate Website

By Craig Silverman on BuzzFeed News (buzzfeednews.com)

Brooks also appeared in a Facebook-produced video panel used to promote an NYU study of Facebook Groups funded by the social media giant.

Bias, disrespect, and demotions: Black employees say Amazon has a race problem

By Jason Del Rey on Vox (vox.com)

Interviews with diversity managers and internal data obtained by Recode find that Black Amazon employees are promoted less frequently and are rated more harshly than non-Black peers.

Schools Are Abandoning Invasive Proctoring Software After Student Backlash

on vice.com

Proctorio has cashed in on remote learning since the start of the pandemic. Now, some schools are abandoning the company’s controversial software.

What is an “algorithm”? It depends whom you ask

By Kristian Lum on MIT Technology Review (technologyreview.com)

For better accountability, we should shift the focus from the design of these systems to their impact.

The Best Law You’ve Never Heard Of

By Shira Ovide on NYTimes (nytimes.com)

Taking back control of our personal data can feel like a lost cause. But there’s hope!

Covid Vaccine Websites Violate Disability Laws, Create Inequity for the Blind

By Lauren Weber, Hannah Recht on Kaiser Health News (khn.org)

A KHN investigation found covid vaccine registration and information websites at the federal, state and local levels are flouting disability rights laws and limiting the ability of people who are b…

Stars, influencers get paid to boost Duterte propaganda, fake news

By Camille Elemia on Rappler (rappler.com)

Internal documents from Twinmark Media Enterprises, the agency banned by Facebook for coordinated fake behavior, show how the power of celebrities is used for money and disinformation

2020 Ranking Digital Rights Corporate Accountability Index

on Ranking Digital Rights (rankingdigitalrights.org)

A comprehensive ranking of top tech and telecom companies’ disclosed policies and practices affecting people’s rights to freedom of expression and privacy.

Michael Tubbs on disinformation, racism, and news deserts

By Akintunde Ahmad on Columbia Journalism Review (cjr.org)

In 2017, Michael Tubbs made history as the youngest and first Black mayor of Stockton, California, home to some three hundred thousand people and considered the most diverse city in America. A graduate of Stanford University, Tubbs began his political career on the city council of Stockton, his h…

CITP Seminar: Woodrow Hartzog - A Duty of Loyalty for Privacy Law

on Center for Information Technology Policy (citp.princeton.edu)

Data privacy law fails to stop companies from engaging in self-serving, opportunistic behavior at the expense of those who trust them with their data. Academics and policymakers have recently proposed a possible ...

The End Of Student Privacy? Remote Proctoring’s Invasiveness and Bias

on Mobilizon (mobilizon.fr)

On Saturday, March 6th, from 1:00 – 4:30 pm ET, please join the Surveillance Technology Oversight Project (S.T.O.P.) and Privacy Lab (an initiative of the Information Society Project at Yale Law School…

Meaningful Movies Everett watched The Social Dilemma over the weekend, and I was asked to speak briefly afterwards.    The movie makes an important point: you are the product that Facebook, Google and other big tech companies manipulate and exploit as part of their "surveillance capitalism" business model.   That said, as reviews like Flamethrowers and Fire Extinguishers point out, there's also a lot the movie doesn't discuss.  So of course that's what I talked about!  

It was a great discussion, and several other good topics came up as well, so I volunteered to do a follow-up post with more information and links.    

Things you can do on an individual level

Another good point The Social Dilemma made is that there are things you can do as an individual to reduce the harm these exploitative companies do.  It's important to highligh that this by itself isn't enough to change the systemic dynamics; still, it helps protect you, your friends, and your family.  There are some good suggestions in the movie, and even more powerful – and fairly straightforward – things you can do.  Here's a short list:

• Be intentional about how you're using the software.  As somebody said in The Social Dilemma, "you vote with your clicks."  Think about what you're liking, resharing, watching, and discussing.   Ignore recommended videos (which on YouTube and Facebook often suggest misogynist, racist, anti-LGBTQ, and/or conspiracy videos).   Later in this article I'll briefly discuss how similar approaches can also help with disinformation.
• Cut down the addictiveness by turning off notifications, and learning habits that work for you – for example, keep your phone out of your bedroom, carving out surfing-free times, and limiting your time online.
• As parents, help your children learn critical media literacy skills.  At the same time, be aware that there's a lot you can learn from them as well!
• Use less-invasive alterantives to surveillance capitalism companies.   Signal is great (instead WhatsApp or Messenger) for 1-1 and small group conversation. For search, I'm a fan of Duck Duck Go as an alternative to Google; Restore Privacy has a long list of alternatives to other Google products.  Avoid apps when possible – apps frequently have much more invasive tracking and can introduce malware risks.   Web interfaces are generally less intrusive, albeit less convenient.
• Use ad-blockers and other privacy-protective techonlogies on your computer.  I use Ad Blocker Ultimate and EFF's Privacy Badger; there are other good choices as well.

One of the inherent tensions that came up in several questions is the dilemma that especially during the pandemic we're very often connected to friends and family primarily through social networks that are owned by surveillance capitalism companies.   It'd be great if everybody ditched Facebook (etc) for a good free privacy-friendly alternatives but meanwhile back in the reality of early 2021, for many people Facebook, WhatsApp, Gmail, and so on are the best way to keep important friendships, connections, and relationships alive.  

The balance is different for different people, and there often aren't any easy answers here.   The key is to think about the choices your making, and look for ways to reduce your exposure to harmful stuff.

Washington state privacy legislation

One of the things The Social Dilemma didn't discuss is the potential role of legislative solutions in establishing accountability for the harms of surveillance capitalism (and interfering with its exploitative business models).  Washington state is on the front lines of this battle, with a pair of privacy bills in front of the state legislature.   The People's Privacy Act (HB 1433) has been developed working with civil rights and community groups, and offers strong protections ... but unfortunately hasn't even gotten a hearing yet.  

Meanwhile, SB 5062, also known as the Bad Washington Privacy Act, got sharp criticism from civil rights groups and community members in its hearings, but praise from Microsoft, Google, Amazon, and industry associations so has sailed through committees and is headed towards a Senate floor vote.    Even though the Bad Washington Privacy Act's protections love to talk bout how "strong" its protections supposedly are, it's an illusion.   Susan Grant of Consumer Federation of America has a great discussion of this in We Need Real Privacy Protection in the States, not the Washington Privacy Act’s Illusion of Privacy, and I also look at in some detail in The illusion of protection and SB 5062 (the Bad Washington Privacy Act) with some very groovy optical illusions if you are into that kind of thing.

So one very valuable thing you can do is tell your legislator that you want stronger protections.  Here are three things you can do right now:

• Tell representatives to protect your privacy, from CAIR Washington and ACLU of Washington, sends your legislators mail discussing the problems of SB 5062.
• The People's Privacy Act Letter to the Editor Kit on the ACLU of Washington's site has great sugestions about how to construct a letter to the editor as well as a link to the list of submission links for 90+ news sites and blogs around the state.
• Tell your Senators that you want privacy legislation to protect against Facebook and Google is an action item from Indivisible Plus Washington that focuses specifically on two of the companies discussed in The Social Dilemma.

Disinformation

The movie only mentions disinformation briefly, but it's an important enough topic that I wanted to provide some resources on this front as well.  Indivsible Plus Washington did several disinformation workshops last fall with Shireen Mitchell of Stop Online Violence Against Women.  The two-minute video above is a quick introduction; there's also a longer training course on Responding to Disinformation and Digital Voter Suppression.

There are a lot of other great disinformation resources out there as well, including PEN America's How to Talk to Friends and Family Who Share Misinformation, Jen Soriano’s Disinformation is like a virus, and ReFrame's infographics.

In terms of pressuring companies like Facebook and Google to do better on disinformation, there are several important active campaigns.   Two examples:

• The Real Facebook Advisory Board includes Shireen Mitchell, Safiya Noble (author of Algorithms of Oppression), Ruha Benjamin (Race after Technology and The New Jim Code), Jessica J. González of Free Press, Maria Ressa of Rappler and more as well as Roger McNamee, Tristan Harris, and Shoshanna Zuboff (all of whom prominently in the Social Dilemma)
• Stop Hate for Profit is a diverse and growing coalition that wants social media companies to take common-sense steps to address the rampant racism, disinformation and hate on its platform, and includes ADL, Color of Change, Common Sense, Free Press, LULAC, Mozilla, NAACP, National Hispanic Media Center, and Sleeping Giants.

What didn't get discussed in The Social Dilemma – and a short reading list

Before wrapping up I want to return to the topic of some things besides legislative solutions that didn't get discussed much in The Social Dilemma.   For example:

• Recognition of the the people and organizations who have been talking about these abuses for years.   The people the movie actually focused on spent their careers (and made a lot of money) not listening to warnings about what they were doing ... now that they're finally waking up, they're still saying "how could we have known?" and ignoring the folks who were right all along.
• Facebook’s track record of civil rights violations in the US -- or really anything about race and gender.  How many Black, Latinx, or Indigenous people did you see in the movie?  How much discussion of Facebook and Google's history of sexism, racism, and misogynoir was there?
• Tech companies well-documented history of lies and lawbreaking.  Washington state offers a great case study of this: Facebook and Google have been breaking Washington state law on election advertising since 2018.  The AG sued, they settled and promised to stop ... and they've kept doing it.
• Facebook's role in genocides, anti-Muslim riots and authoritarian governments taking power in countries like Brazil, the Phillipines, and India.
• Anything about solutions.

So while there were certainly some valid points in The Social Dilemma, it also reflects a lot of the problems of the underlying tech culture.  It's good that some of the people got rich by creating these problems are starting to feel bad about it, and they have some useful things to say.  

Still, instead of looking to them for a real critique of the systems (that made them rich) – or for solutions (that might reduce their influence) – it's far better to turn to people with a deeper understanding.   Here's a short reading list to find out more:

• Flamethrowers and Fire Extinguishers, on Librarian Shipwreck is an extended review of The Social Dilemma, going into more detail on the omissions I briefly discussed here.
• The Prodigal Techbro, by Maria Farrell, looks at tech executives who "experience a sort of religious awakening" and become critics.  As Ms. Farrell says, "The prodigal tech bro doesn’t want structural change. He is reassurance, not revolution. He’s invested in the status quo, if we can only restore the founders’ purity of intent. Sure, we got some things wrong, he says, but that’s because we were over-optimistic / moved too fast / have a growth mindset."
• Antisocial Media: How Facebook Disconnects Us and Undermines Democracy, by Siva Vaidhyanathan, is an excellent book-length exploration of Facebook's problems by somebody who's studied the tech and media industries for years.
• Race After Technology, by Ruha Benjamin, looks at how technology reinforces and magnifies racial hierarchies in our society.

It's been a busy few weeks in the Washington state legislature!   But before we get to the update, here are three actions you can take right now if you're a if you're a Washingtonian who wants to protect our privacy.

• Pass The People’s Privacy Act
• Ask Ways & Means to add a private right of action to SB 5062
• Stop SB 5062 (the weak, corporate-friendly Washington Privacy Act)

The People’s Privacy Act, not the Washington Privacy Act, is the better bill to protect consumers’ civil rights and civil liberties, a Seattle Times op-ed by Jennifer Lee of ACLU of Washington, is a great short summary of the differences between the two privay bills.  

The People’s Privacy Act: How you can help protect Washingtonians’ privacy , on the Indivisible Plus Washington blog, has a lot more information for activists, including the video and slides from a webinar Jennifer and ACLU of Washington organizer  Savannah Sly did with Indi+ and Washington Indivisible Network.

And now, on to the update!

Automated Decision Systems regulation advances!

Let's start with some very good news is that the Senate State Government and Elections committee gave a "do pass" recommendation to SB 5116 (Accountability and Transparency Standards for Automated Decision Systems).

As I discussed in A good hearing on Automated Decision Systems, there's a lot of support for this groundbreaking legislation.  Since the hearing, state and local government agencies have been working with the bill's sponsor to resolve some very valid concerns.   During the executive session, Sen. Hasegawa suggested that another amendment was on its way that would get it into final form.  So far, it's all very encouraging!

Next step for SB 5116: the Senate Ways & Means Committee, which looks at the bill's fiscal impact.

Hot Ways & Means Action on SB 5062

And speaking of Ways & Means, SB 5062 (the Bad Washington Privacy Act) had a hearing there on Monday.   Tech Equity Coalition members and others had some sharp criticisms of the weak, industry-backed bill's paltry enforcement budget – $1.4 million over the next two years, only enough for 3.6 full-time equivalent (FTE) employees.  The Attorney General's Office (AGO) projects that they'll be bringing 3 investigations per year. Good luck to the 1.2 FTEs taking on Facebook or Google!

As I pointed out in my testimony, Ireland has a population smaller than Washington, and it's Data Protection Commission's budget is $23 million per year. Jennifer Lee noted that even with their much larger budgets, European data protection enforcement has been held back by lack of resources.   Joseph Jerome noted that Facebook has 150 privacy lawyers, and that large companies average 15.

Given the budget pressures here due to the pandemic, there's no way they'll budget anywhere near that much ... so we didn't even ask for that.  Instead, we focused on adding a private right of action, as the AGO has repeatedly requested.  

I thought we made a strong case, but then again Ryan Harkins of Microsoft praised the bill's "robust" enforcement.   So we'll see what happens.

Here's the video.  (My testimony's at 23:15.  The Chair said she appreciated that I focused on fiscal issues ... I feel like I got an A on a presentation!)   I also live-tweeted it, and Joseph Jerome has some reflections on the hearing here.

And whenever I hear "Ways & Means" I think of the Concrete Blonde song Bloodletting.  So here's the video.  We got a lot to think about ... oh yeah.

No hearing for SB 5104 (the Facial Recognition Moratorium)

The news is not so good with the Facial Recognition Moratorium.  Senate Energy, Environment, and Technology (ENET) Committee Chair Sen. Carlyle decided not to give a hearing to the bill.  

Last year, there was a lot of support for a moratorium, but the legislature wound up passing a compromise bill written by Sen. Joseph Nguyen of Microsoft.  Since then, Microsoft and Amazon have both announced voluntary partial moratoriums on facial recognition, the Seattle Police Department has been caught secretly using Clearview AI, cities including Portland, Boston, and New Orleans have passed moratoriums and bans, and there have been several more reports of facial recognition systems leading to Black people getting arrested for crimes they didn't commit.  

But as I predicted in my testimony last year, once a weak bill is passed, it becomes a lot harder to pass a strong bill.  My guess is that Sen. Carlyle and Sen. Nguyen convinced their colleagues on the committee that since the legislature had just acted last year, passing legislation that Microsoft described as "robust", they didn't need to do anything.  

Facial recognition is an automated decision system, so SB 5116 will provide some regulation – although not a complete moratorium.

The People's Privacy Act must be heard!

The People's Privacy Act, HB 1433, also has some limitations on facial recognition. It's got a lot of other good stuff too.  Here's Jennifer Lee's quick summary:

The People’s Privacy Act is founded on the assumption that everyone’s privacy should be protected by default and that people’s data should not be used without their affirmative, opt-in consent. It gives people the right to know what data companies have about them and the right to correct and delete their information. It prohibits companies from using, selling or sharing data without people  meaningfully given consent, which is the true gold standard for privacy.

HB 1433 also makes it unlawful for companies and government agencies to use people’s personal information to discriminate and bans use or installation of facial recognition technology or equipment incorporating artificial intelligence-enabled profiling in any place of public accommodation (like restaurants, hotels, theaters, pharmacies, parks, schools and stores). The People’s Privacy Act ensures local jurisdictions can advance stronger privacy laws if they wish, protecting community voices. Finally, it provides meaningful enforcement through a private right of action that empowers people to take companies to court for privacy violations.

Rep. Shelley Kloba is sponsoring the Peoples Privacy Act, which was created by ACLU of Washington with input and support from the Tech Equity Coalition, a group of civil liberties and civil rights-focused organizations and individuals working to lift up the voices of historically marginalized and disproportionately surveilled communities in decisions about technology.  

Alas, the People's Privacy Act hasn't been scheduled for a hearing yet either.   Dozens of groups around the state signed on to the Tech Equity Coalition's letter asking for the bill to get heard.   Indivisible Plus Washington sent a letter to House Civil Rights & Judiciary (CR&J) Chair Rep.  Drew Hansen and the rest of the committee requesting a hearing.  

But with the "policy cutoff" deadline on February 15, it looks like CR&J is going to punt for now and instead wait for the Senate to send over the Bad Washington Privacy Act as a starting point.  It's disappointing, although not particularly surprising, because this is the same strategy that didn't work the last couple of years.  

Activism is hard.

No worries, though.  As we discussed at The People’s Privacy Act: How you can help protect Washingtonians’ privacy,  we've got an activism plan B and plan C as well!

Take action!

If you've made it all the way to the bottom of this post, you probably care a lot about privacy!  So if you're a Washingtonian who wants to support the People's Privacy Act and oppose the Bad Washington Privacy Act, here's three things you can do today!

• Pass The People’s Privacy Act
• Ask Ways & Means to add a private right of action to SB 5062
• Stop SB 5062 (the weak, corporate-friendly Washington Privacy Act)