Week 3: Peeking, Prosecuting, and P3P: The Regulation of Internet Privacy
September 17, 1998
Z: And I assure you there's no sinister purpose to it. It will not be graded. Either by the amount of food you consume or not or by the witticisms of various participants. It's just an opportunity to actually meet the guests in a way that you didn't have to remember three weeks ago to sign up for a dinner that turns out to be miles away with bad food. So we'll be having the bad food right out in the hall courtesy of sodexho (?) immediately following our session today. And I hope that you all can stick around for it, at least for a few minutes.

Also, I've established office hours Wednesdays 2:00 to 4:00. Delighted to make appointment at any other time or even feel free to drop by and take your chances. If you have paper issues you want to talk about, particularly if you want to do a third year paper with the course, I'm delighted to work with you on that. And also have access to a trove of papers from last year. We're going to cover plagiarism in the Moot Court. But short of that it's actually great to be able to build upon something somebody similarly situated has done a year ago and be that much more ahead when you start writing the paper for this course, if that's what you elect to do.

The paper requirement is not particularly onerous. It's only 15 to 20 pages. There's also the take home exam option if you want that. As it turns out, I think the answers to the questions that are getting posed each week are really good and making a nice portfolio for each person on different views as the course unfolds. And that is a lot of the work of the course right there. I'm mindful that the questions still have a few bugs in them.

If you're suffering from some kind of outrage because either the dog of Netscape ate your homework or there's been some other issue with the question generator please complain lustily to Alex and Wendy. I understand it has been largely fixed. And if for some reason you didn't get to get a question in this week by the time the portcullis (?) closed, you can do so by just e-mailing either me or them and get that right in there.

Also we have a discussion area. I urge you to visit it. And you can even click on subscribe and it will send you an e-mail every time somebody posts to the area which gives you the convenience of push rather than pull. I know there's been some trouble accessing the area. I think we have that solved. If you use your user name and password -- if you have a Harvard law account that gets you in. Or if you don't, your user name and password for the site should get you in as of today. Yes?
Q: As of 20 minutes ago the link is broken.
Z: I think I fixed it in most of the places. This of course is always risky to do but I'm feeling lucky today. IS98. It's a ridiculous link. There's no way to know it without clicking on it. But you go by the exploding megaphone here. And it asks for a user name and password. I suppose I'll provide mine. What is my password? And there it is. So the link has been fixed as of very recently. And there are a few messages there.

And I'll tend to be posting announcements there as well as e-mailing them out to what I understand to be the course list. Any other administrative questions before we get on with the day's events? Scott, you got in just in time.
Q: I'll ask later.
Z: OK. We're lucky to have with us four distinguished guests today. I'll ask them to introduce themselves in just a moment. And it's good to think, particularly when we have so many guests and it's hard to just have discussion among the class, questions always in the back of our minds. What if anything makes the Internet different here with respect to the issue we're talking about? And maybe look at the three themes we had at the very beginning as possible hypotheses about what makes the Net different.

In that case it's distinct problems of governance, problems or opportunities with respect to being able do modify the code to get things done instead of having to worry about traditional forms of governance. A lot of the readings for today got into that a little bit. And also the distinction between the big guy and the little guy and what possibilities there may be to be a player on the Net in addition to just being a consumer even if you aren't the biggest company in the world.

And again, alternative hypotheses are welcome for the question “What makes the Net any different?” Is that a thought over there? No, OK. So that being said, maybe I can just ask, starting down here, for our guests to each just introduce themselves a little bit.
TL: I'm Tobey Levin (?). I'm a senior attorney on the Federal Trade Commission. The FTC is an independent regulatory agency. Probably not as well known to many of you as the SEC or the FCC. However, we are congressionally created. We are not part of the executive branch. The president does nominate five commissioners. Each one serves seven year terms. We have one vacancy right now. If any of you have any suggestions you could refer them to the White House. The nominations are then approved by the senate.

And we basically are a law enforcement agency. We enforce the Federal Trade Commission Act which prohibits deceptive or unfair business practices and unfair methods of competition. We have Intel; Justice Department has Microsoft. Major Internet cases ongoing right now. I'm in the bureau of consumer protection. And for the last 15 years, 12 of which was focused on food and drug law -- which is another interesting area of law. But the past three I've been focusing on privacy matters and in particular, children's privacy.

And I know a lot of you have looked at some of the material that we've produced and have looked at it on the Web. And how different law school is today than it was when I went. It's quite a shock. So you have at your hands the resources that we've developed and I look forward to hearing your questions and comments as we proceed.
JR: My name is Joseph Reagle. I have a number of affiliations I can go through. I was formerly, though I'm still associated with the organization, a research engineer at the Lab for Computer Science at MIT where I was also a project manager and policy analyst for the World Wide Web Consortium which is hosted at MIT and two other research institutes. In that capacity I was one of the principal designers of P3P, which is one of the technologies we're going to talk about today.

Beginning of September I actually took a leave of absence for a sabbatical from MIT and I'm actually a fellow at the Harvard Law School at the Berkman Center for Internet and Society which Jonathan is the executive director of.
DS: I'm David Sobel (?). I'm general counsel of the Electronic Privacy Information Center in Washington. EPIC is a nonprofit research and advocacy group that deals with civil liberties and privacy issues on the Internet. Obviously, as our name indicates, privacy is a major focus of what we do. But we're also involved in first amendment issues on the Internet. In that capacity we were involved, for instance, in the litigation of the ACLU v. Reno case against the Communication Decency Act. We continue to have an interest in the new legislative proposals to regulate content on the Internet.

And I guess generally, for purposes of this discussion, what's probably important to know about what we do is, I think, get engaged in a balancing exercise to basically find what the appropriate role for the government and for the law with respect to the Internet. We don't, as some groups do, have this orthodoxy about that the Internet should never be regulated. We think that there are appropriate areas in which regulation is a good idea. And we take each issue as it comes without any preconceived ideas about that.
JC: And I'm Jory Clark (?), president of Circle One Network, which is the publisher of Kidscom (?). It's one of the longest running sites for kids. Been live since February of '95. And we are a small independently owned publisher. We have six, now seven, full time people, two part time people and some monitors who help us watch the kids on line. And Jonathan wasn't exactly accurate with you when he said that the food afterwards came without strings. Because I believe Tobey and I will be actually soliciting any of you for unpaid internships next summer if you truly have a desire to be in the trenches.

But I think that we're here today to actually give you a realistic viewpoint about taking theories and ideas and actually trying to meld those into practices.
Z: Thanks. So maybe the best place to start is just to figure out what's at stake. Before we even get into rights and policy discussions, what's the harm online that we're trying to avoid by talking about privacy and worrying about particular solutions? What are these solutions solving? Tobey, you've thought about it a lot given that report.
TL: The harms that we are addressing at the commission basically are divided into two areas. First is privacy. And specifically there we're looking at how the question of personal identifying information -- how that process online produces potential harms for consumers. This is not a situation where you can find dead bodies on the street. This is not like harmful drugs being put into the market place. It's not as easy to quantify. I think it's difficult to put an economic dollar sign on measuring what the harm is.

But I think there's a general sense, and actually documented by empirical research, that consumers care about their privacy. Several very good studies, one by Business Week, another by Alan Weston (?) for Lou Harris, have shown that remarkably high levels, anywhere between 60 to -- in the case of children, 97% of Net parents care about the fact that information is collected from their children on the Internet and how it's used.
Z: And 3% are like, "Take my kids please."
TL: Perhaps. But it's rare to see that level of interest from our research that we've done in many other areas. When we first learned of this data it basically gave us a tool to say in terms of our efforts, "There really is concern out here." This is an issue that in legal terms is referred to as material to consumers. It affects their decision making in the market place.

So our first concern is that consumers want to protect their identity, their information. There is an economic value to that information. If there wasn't, businesses wouldn't be asking for it. One of the things that is very different about the Internet from previous media, certainly is that it makes the collection of information so easy. And particularly from children who love to share and talk about their favorite subject, themselves.

The analogy, I think, is that information fuels the online market place. It's what enables the online market place to customize the marketing to the individual in a way that we've never seen before. And as a result this is a great boon to business and potential to consumers, too. Because you can get products and services that you really want because it reflects your interests and your needs better than any other market place in the past. And probably more efficiently and more rapidly you can get the book from amazon.com perhaps than you can from your local book store.

But that raises some questions about the implications, particularly in the future, for our society where private businesses have a great deal of information about you and how that information will be used. So privacy -- and I haven't even referred to it as a right specifically, but just the concept of privacy -- we feel, is very important to preserve. And we think it's important at the early stages of the development of this medium to examine how privacy can be secured. We don't want to get down the road 20 years from now and find out it's too late.

The other big important area with regard to children is safety issues. And you only have to sit in a room and talk with some of the FBI agents that are--

Z: In the room. Sit in the chat room talking to the FBI agents (simultaneous conversation).
TL: -- to see the reality of that safety issue. There have been several hundred arrests and many, many more instances of inappropriate interaction between adults and children. And that, while it's not the primary issue for the FTC, privacy really is -- is an important issue with regard to children. We want the Internet, which offers a lot of resources to kids and I'm sure Jory will show later -- there's a wonderful opportunity for kids to learn and to bring a great deal of information to children. But we want it to be (simultaneous conversation) provides safe interaction, one that the parents can set the kids loose in to some degree. I mean monitoring is--
Z: So what I hear you saying is first we have, almost working backwards, we have one issue where if a kid goes into a chat room and meets some random person who says, "I'm eight as well. Fancy that, we're the same age." And the kid then is enticed in the course of this online chat to give away personal identifying information. Says I live at such and such a place and no, my parents aren't here right now. That's a safety issue because the kid -- gullible that kid may be. Technically adept but gullible, the kid is online and then giving information that could endanger the child's safety because you don't know who the kid is talking to.

So that's one issue and let's set that aside for a moment. That's the security issue. Then the other issue we had was the collection and use of information that consumers may part with while they're surfing around the Web. And two things I heard from you. One is it has economic value and therefore maybe we shouldn't just assume that the businesses should collect it. I mean it's something that may not seem of value to the person whether they prefer Pringles or Lays. But since it is of value to the other side maybe there should be some kind of negotiation going back and forth to capture that surplus between the two of them.

And then the first reason you seemed to give was we value privacy because we value privacy. Which is to say, polling data reflects that Americans in large markets say they're concerned when asked the proper questions about whether they're concerned. Dave, is there anything you want to add to that?
DS: I mean yes, privacy is a difficult concept to grasp, as Tobey said. And very difficult when you're asked, "What are the cases where someone's privacy has been violated to their detriment?" It's very difficult to come up with the concrete examples of that. But I think part of what is going on here, at least from the perspective of privacy advocates, is that this is a very new media and we're just starting to understand the ways in which it can be used and abused.

I think one of the things that makes the Internet different, because you had asked that initially, is the interactivity. It does create the ability to gather an incredible amount of information about a person's habits and their thought patterns and how they go from one piece of information to another piece of information.
Z: And this is stuff that's collected latently. It's not as if you're asked to fill out a form and then you click submit. You're referring to information that just by dint of your clicking and typing, so-called mouse droppings, people can (simultaneous conversation).
DS: Yeah, I think the technical capability exists to gather that information surreptitiously. So that brings us into the other thing that's different about the Internet which is that most people have the illusion of doing what they're doing anonymously. And I think that's a lot of what makes the Internet so popular and why it's grown so explosively. It’s that people see this as a way to anonymously do things and collect information that they might have second thoughts about if they were on notice that a record was being kept.

If it was the equivalent of subscribing to a magazine that's being mailed to your home a lot of people wouldn't go that route but they will avail themselves to that kind of information on the Internet. So I think that's the other thing makes it different. There is a state of mind when people are collecting information on the Internet and doing whatever they're doing online that this is anonymous. So in that way the collection of information is really an abuse of the expectation that people have when they do what they do online.

In terms of harms, as I said, we're at the early stages of this medium. Some people make the distinction between the private sector on the one hand and the government on the other. And they say, "I have a problem with the government collecting information," and for that reason, for instance, we have statutes like the Privacy Act that restricts the ability of the government to collect and maintain certain information about people. But I think part of what's new is that the more that the private sector collects and maintains private information the more that becomes a source of information for the government.

I think actually that's one aspect of the Starr investigation that's relevant here. That the more there's this pool of privately held information the more there is available to governmental law enforcement agencies and investigators. I guess it would be the equivalent of the Starr subpoena to the book stores for Lewinsky's book purchases. I think that the more there's this store house of privately held information about people's activities and interests and online activities, the more that information is going to become a target of governmental interest.

So those two areas that have traditionally been distinct are starting to meld together. And I think that raises the level of concern.
Z: So we're starting to develop here a little bit of a taxonomy of problems, loosely under the rubric of privacy, that come about online. We've set aside the security problem of children identifying themselves and then getting themselves into trouble as a result. And then we see that there are explicit ways that you might part with information. You fill out a form; you do something. You get asked and then you answer. And the unexpected things may happen with that data later.

From what we read in the FTC report the primary terrible thing to have happen is that somebody knows, generally a company, about your preferences in a way that will allow them to more nefariously target advertisements to you that you're likely to relate to. So that an example might be that I say on the hub's peanut company site that I enjoy peanuts. Hub sells this to Skippy and suddenly I get a coupon not just for some random product like a Saturn but instead for Skippy peanut butter in my mailbox. This is one kind of harm.

Another kind of harm is possibly that data that I give explicitly may get used for any particular purpose. You point out that once it's collected, Ken Starr could come around, issue a subpoena, and if for some reason my preference in peanuts were relevant to an investigation the company that has that data could end up parting with it and now it's in, say, the government's hands. And you say that's a bad thing. Or I suppose it could be in any private investigator's hands. A potential employer. An airline wanting to know where to seat me on the plane.

__: An insurance company that is concerned about the amount of peanut butter you're consuming because of the cholesterol.
Z: That could be. Unlikely, but it could be. So you get into a whole range of things that we're still somewhat categorizing as prospective threats rather than actual harms. There are certainly plenty of things that might relate to junk mail and targeted advertisements as a result of what you may answer. We don't, I'm hearing from you, yet have the kind of great or terrible examples of data mining, short of the Starr investigation, used by companies. Yes?
__: I think data mining is being done to quite a great extent already. The technology for data mining -- if you read the direct marketing trade press there are advertisements, there are articles in every issue about data mining. And directing direct marketers to be aware of the importance of data mining and the databases that are out there. Keep in mind, the Internet is new but collecting data is not new. There have been mailing lists.

I have a directory on my desk of list brokers and lists of every type. Whether it's lists of households with children, lists of college students, lists of women ages 18 to 22. The directory is this thick. It's on telephone book paper so it's paper thin. So there are many, many lists that are available. They're marketed and sold. Largely rented because you don't really want to sell the database, it's too valuable. So this is quite a big business out there.

And what has changed is that now the Internet -- these databases are much richer. Whereas before they might have five pieces of information about you or maybe ten or 20 pieces, we're talking about the ability now to collect from -- one company I know of has technology has a database of 800 fields of information. So that it can be refined to describe not only that you like sports but that you like baseball and that you particularly like a particular baseball player. Not being a baseball fan myself I -- let's say McGwire. And that you may have signed up for a McGwire fan club. And so it can get that refined. So that's new.
Z: These lists, to be sure, you can imagine them in at least two formats. One format would be males age 18 to 22 who love McGwire. So you've got a list that high with paper thin things, all those people in it. And we suppose that the common use of that list, the reason somebody would rent it and pay top dollar for it, is so that they can offer them the Franklin Mint pewter commemorative baseball, home run number 72. Now that's a different problem perhaps. Maybe even one that is, you might deem, lesser or greater than me being able to say, "I don't want just a bunch of people 18 to 22 who like Mark McGwire. I just need to throw a baseball into the air and it'll hit somebody that's that way. I want to know about this particular person."

And you point and you get a name and a social security number. How many companies are there out there where as a resourceful person I can actually ask about Tobey Levin and get those 33 fields back.
TL: There are quite a few. We did a study on what we call the lookup services. And that's the term to describe these businesses where you could just punch in someone's name and for a certain fee learn a lot about what mortgages -- a lot of it is governmental information that's public. Deed records, motor vehicle records.
Z: Stuff that people in this room can get to thanks to their Lexus accounts.
TL: Oh, exactly. So there's certainly that opportunity. As we see with the computer, we're able to mix these databases. And offline data collection and online data collection. So that the technology enables these databases to be quite rich. And I think that's of concern as to how this information will be used in the future. We're at the beginning stages, in a sense, of seeing both the establishment of the databases and what kinds of business practices will then follow. And I think the question that businesses and industry is trying to address, too, is what are the good business practices that should be implemented to make sure that in fact businesses don't go awry.

Because this market place won't work if consumers don't have confidence and trust in it. So there's a mutual interest here for business and consumers to get together and make it work.
__: I wanted to posit an interesting twist. One ... (inaudible) you pulled out of this is like wouldn't it be terrible if you've got an advertisement for some product you don't really care about? It's very weak. There's other good reasons like ... (inaudible) privacy. But that as a justification seems kind of very odd. And I've had direct marketers tell me where actually that actually motivates them to collect more information from you.
Z: So that we can better target advertising to you.
__: Because the goal is we don't want to waste your time. We don't want to be putting you in categories where you don't belong.
Z: Do you have reason to disbelieve this motive?
__: No, I think that's a fair enough motive. It doesn't serve a -- there is this concept of prospecting where sometimes direct marketers feel by accident they'll hit you with something you like but they didn't have ... (inaudible). But generally they're not interested in wasting advertisement that your ... (inaudible). I think the issue here is OK, maybe it actually can be served by people having profiles of information about me. But I think the thing that concerns me is somehow that it could be used against my own detriment. It could be used against my self interest at some point. And in a sense I'm being prejudicially judged.
Z: Give me your best horror story.
__: My best horror story? OK, my hair color today.
Z: Well, this morning it appeared to be white. This afternoon it looks to be a shade of red. Where's the horror story?
__: Are you asking for a hypothetical one?
Z: He's just saying that the hair is the horror story. Yes, yes, a hypothetical.
__: I think there's one that is probably not for very long going to be hypothetical. And I wouldn't be surprised if this kind of situation has already arisen. Which is it seems to me that any smart domestic relations attorney these days when there's a custody fight would for instance -- let's say the husband has an AOL account. Go to AOL -- say we want any reference you have about the areas on AOL that this man goes to. Does he go to gay chat areas? I mean I think you can come up with any number of examples.
Z: And you're worrying that AOL would part with that perhaps? Say give us $20 and we'll tell you, or that they would have to respond to a subpoena?
__: That now gets us into the question of what is the legal protection for that information. At the moment AOL in its privacy policy says they will not part with that information unless they receive a subpoena. So at least there's some process involved. Conceivably the subject of the request would have an ability to challenge the release. But it's not clear to me what the grounds would be. It's not clear that the husband would prevail in quashing such a subpoena.
Z: Of course they could ask the husband in a deposition on pain of contempt, "Have you been to any gay chat rooms on AOL?"
__: That's true.
Z: But the husband would have, if not the right, the ability to say, "No?"
__: He doesn't remember.
Z: And put them to their proof.
__: He looked at once of those chat areas two years ago out of curiosity. Or maybe he clicked on a Web site. If most people were asked to give us a list of all the Web sites they've ever visited I don't think --
Z: You'd refer them to your computer's history file.
__: But the online systems that are capable of collecting this information will in fact remember that. So I think that we're soon going to see a lot of real world applications of on line information coming back to haunt you.
__: You would agree to the ... (inaudible) that basically it's that information maybe used against my own interests in a prejudicial way and I'd rather--
Z: Truthful information about you.
__: Or non truthful. I mean is that the crux of it, sir?
__: I don't know that truthful -- the fact that it might be truthful really solves the problem.
Z: No, it's only the economists who actually write papers called the Problem of Blackmail. When they say the problem of blackmail they mean why is blackmail a problem. It's just a barter transaction for valid information.
__: That issue has come into this debate in terms of this claimed first amendment right on the part of the collector of the information to do what they want with information about you. And as long as it's true that you as the subject should have no recourse. I don't think that's what it's about. I think it's about the individual's ability to control information about themselves.
Z: So we've developed a little bit of a taxonomy of potential problems and horror stories both from explicit collection of information that then gets stored up and is a treasure chest to be raided either by other companies, by people curious about individuals, working its way into lists perhaps. Maybe even accessible to the government. And this data could be explicitly gathered -- or the kinds of things that we're referring to as mouse droppings.

And actually at some point it would be worthwhile to go through and see at least as of this date in 1998 just how much does get collected when you go onto the Web. And what means exist to possibly shield that. But let me ask you, Jory, to tell us a story. You started Kidscom or somebody started Kidscom. You threw up a Web site. How many people when you started?
JC: I'll back up and I'll give you those details. I think one of the things that really fascinates us about this dialogue that's been going on the last few years is not that it is not an important dialogue to have. But the fact that there are so many people who are speaking so much about something they know so little about. And I think part of that is the --
Z: You're not referring to anybody here, are you?
JC: Not to anybody here and I'm very careful to -- it's because I think that this Internet thing is so new that it has the same sort of fear as the first time that someone struck fire and all of a sudden they had something else, new technology--
Z: There were regulatory commissions then to make sure.
JC: Now having said that, I don't want to belittle this issue because it is a very important issue. And I think one of the things that we've seen is that it is more than just debate about safety. It's really a debate about global communication. And some of the viewpoints that we try to bring are based on some of the reality you were just asking me about. Kidscom was started in '94. We did it as a test project. And it was originally a test project that we did for Kraft to find out if kids indeed were on the Internet.
Z: For Kraft foods? Cheese?
JC: Right, Kraft cheese. Because at that time we were a research company and we still are but they wondered if it was more than just white males at university campuses that were online but if it went further than that. And in this process what we learned is that this is actually a generational shift in communication. And to us that's one of the vital things to know about.
Z: So to go about answering this question, when you say you're a research firm, did you poll people or did you build a site?
JC: What we did is we built a site. We built this site called Kidscom. At that time they just basically said, like many large corporations, "It's the end of the year, we have some budget money left over. Here's a little pile of money, go off and do something and find out if kids are online."
Z: I love America.
JC: So we gladly took that little pile of money and we developed a site called Kidscom.
Z: So it's like the way to find whether there are fish in the pond is to bait a hook and drop it in.
JC: Yes. I'm not sure I like the term hook. But we developed a very simple site. And at that time it was cutting edge technology. It's now amusing to look back at it. And we gave kids a way to have a voice to the world because we knew that that's one of the largest problems for kids is that no one is home to listen to them and when they are home very few people take the time. So we developed this place, a playground. An electronic playground for them to communicate with each other and with the world.

Interestingly enough, at the end of the test -- the test had been if you can find 1,000 kids in three months online then we'll consider that a successful test. And then we'll decide whether or not this is a medium we want to go into. At the end of six weeks we had 1,500 kids and we said now what do you want us to do for the rest of the time?
Z: And the site was designed such that the only people who would to subscribe would tend to be kids.
JC: Yes.
__: How did you know there weren't any FBI agents in that group?
Z: They adjusted for that.
JC: I refuse to answer that question because... And what we learned at that time was fascinating in that we found that it was a powerful medium for kids to be able to communicate. And we found ourselves in many ways becoming an online babysitting service for children. And we weren't very happy about that because we didn't want--
Z: Now at this point the research funding from Kraft has run out and now you're just doing this for fun?
JC: And now we did this for fun. As a company we had actually evolved because we had originally gotten into the Internet as a way to do market research. But at that in '94 most companies didn't even understand what Internet was, let alone anything else. So we began to develop Web sites as a way for them to understand these two-way communications. So we held onto Kidscom. First of all to show off our Web development skills, in order to be able to do more work.
J: So you might do other Web sites for hire?
JC: So we might do other Web sites for hire.
Z: It's an amazing story of Internet entrepreneurship where you start out working for Kraft doing a site to see how many kids are online. And then you end up, “Wait, we're in the Web site development business.” And say, “No, we're in the kids business.”
JC: And it also became for us -- part of my training, my educational background, had been in sociology. So I was very interested in how groups of people communicate and share information. And as I said, we found ourselves a babysitting playground. We found that there were a lot of kids who didn't have anybody to listen to them. And one of the fascinating things for us and one of the things that got us through the whole FTC investigation originally was our absolute love and passion for this experience.

For example, we had a grandmother in Colorado who sent us an e-mail who told us about the experience they had had. Her grandson was very physically handicapped, had gone to school. The ridicule and reactions he found from other kids, as kids generally are at younger ages and older ages, made him depressed and he refused to go to school. So they had put him on a computer, he had found the Kidscom site. In that process he had started to develop friends online. He started receiving e-mail, he was able to get on a chat with them, talk about what he was interested in, his hobbies, his life and so on. And it raised him out of his depression and sent him off back to school again.

Some of when I say this stuff, it makes it sound very idealistic and very pie in the sky. But part of what we were trying to do is have an impact in changing the world. And it's possible to do that with kids; it's possible to do it with the Internet. The bad thing about the Internet is it has potentially the danger of spreading western culture. (simultaneous conversation)

The good thing about the Internet is it allows people to find each other who might not find support in communities in their physical environment.
Z: So the primary thing you're saying your site was offering was a room where kids could meet other kids. It wasn't necessarily content coming from you?
JC: No, it was a combination of that. We had some games. We had a geography game. Because the point of the site was to deliver educational content in an entertaining format. So we had a geography game where kids could learn about capitals of the world and so on. We had a chat area where they could talk with each other. We had a key pal program. Where they could type in, "I want to find a ten year old boy who likes baseball who lives in France" and up would come a single delivery of a child in that database. That's one of the things that we then learned was something we needed to correct as we went through the FTC process. But that was basically the --
Z: So how did the process start? How did you first find out you had run afoul of the Federal Trade Commission?
JC: I was driving and I happened to have a car phone. I was driving back from a client and I got a phone call from NPR wondering how we felt about being listed in a report as being manipulative and deceiving and trying to sell out children.
Z: And how did you feel?
TL: That was not the FTC's description. That was the Center for Media Education.
Z: Which had written, just to get the process down, they had written a letter to the FTC fingering Kidscom for this. I guess they didn't cc: Kidscom, they just wrote it to the FTC?
JC: It was a report that was released to the press without any contact with us first. And they had spent some time on the site and they assumed by what they saw that we were amassing a large database of personally identifiable information in tracking kids and turning around and selling that to marketers. This is what I mean about people not understanding the technology. If they had indeed known at all about a chat wall and the technology involved in it, they would have known that we would have had hundreds of megabytes per day of information generated off of a chat wall. Which then to go in and sort and associate to one particular individual, that would have been close to needing the resources of the government in order to maintain that kind of data.
Z: It's like the Chinese government would have to be doing this.
JC: Right.
Z: So when we think about collecting information you said at one point somebody could specify a pen pal in France with certain characteristics so at some point that must have been entered into a database with fields, right?
JC: Correct. And the way that we had done this was that we had our Oracle database and in the registration form -- at that time we were having the kids register on the site. Now what we did in the process of evolving is we have content that is free to anyone to view. And then if a user wants to post content or in effect they want to interact or publish themselves, then we ask for their identity as a way for us to be able to track the activity on the playground. So it's a way for us to divide the bullies (?) between those using it correctly. We needed some way to try to track them back to identify that.

Much to what you were saying. If an adult was either trying to solicit a child or so on we wanted to have some way to begin to figure out who that was.
Z: So you got a call from NPR?
JC: I managed not to drive off the road. I immediately stopped at the closest phone that I could, called up the office and tried to figure out. And at that time they were getting calls from CNN and NBC and ABC and everyone else wondering what we were doing to manipulate and deceive children.
Z: This is a test of the maxim that any coverage is good coverage.
JC: Yes, it was.
Z: Did the hits on Kidscom go up?
JC: The traffic went up but interestingly enough I think that it was more a curiosity about what it all was. And again, the heartening thing for us that kept us going during this time period, because as a small company to get pulled into an experience where it was taking us into a draining of resources in looking all these things up and trying to educate as to what was technologically possible or not, what encouraged was, again, the ongoing support from the families and the kids themselves.
Z: So how did you get in touch with the commission? This is still the media beating down your door. And then at some point --
JC: The second part which happened was after this report was released, and there were about 20 some other companies, I don't remember the exact amount, and they all happened to be much larger than we were --
Z: And this is the CME report?
JC: This is the CME report. Sony and Disney and Kellogg's and so on. Then the advocacy group filed a formal complaint against Kidscom exclusively with the FTC. Our personal theory was we were a small guy and they were hoping that we would roll over and play dead. Whether that's true or not I don't know. But we happened to be the only ones who did not have corporate lawyers on staff.
Z: And in this instance what would playing dead mean? Were they looking for damages for money? Or they were just looking for a particular set of stipulated behaviors or changes to the Web site?
JC: I think that a lot of their intentions are very well meaning. Because it certainly is an issue that it's important to be aware of. And I think the good news was it brought it to the forefront of what people needed to be aware of. I think the bad news was that they really didn't do their homework well enough to really know what it was they were accusing us of. So I guess one of the things that always was a conundrum to us was why the press always happened to get the complaints before we did. Which didn't really, to us, show a spirit of trying to correct something as much as a spirit to grab headlines.
Z: So how does this work? As long as we've got people that have been involved in the practical process I just would love to explore it for a bit. How does this actually work? Do you sit down with FTC lawyers and review the facts and talk about it?
TL: I can't discuss the investigation at all. So whatever Jory is willing to talk about is fine. But I can't discuss it.
Z: And you can't talk in general just about how an FTC investigation might happen?
TL: I can certainly do that.
Z: So, please.
TL: One of the questions we often get from the press when we issue an action is did you do it because you got a complaint or was it a competitor or your own monitoring or another agency? And our answer to that is it could be any one of the above and we never reveal the source of a complaint. And in the case of Kidscom it's easier to say because, as Jory said --
TL: -- education advocacy group filed a petition with the Federal Trade Commission. And when a petition is filed we have a responsibility to respond so long as it's not asking for rule making in the general way. If it's a broad petition asking us to conduct rule making, we have the discretion to basically make a decision ... (inaudible) don't necessarily have to formally respond. But if it's a petition with regard to particular deceptive practices, we are obligated to respond to the specific petition.

What we do in the case of a petition is conduct a very thorough investigation of the issues presented and decide whether or not it requires that we bring law enforcement action or --

Z: An investigation might entail calling people on the phone, writing letters, meeting with them. Do you have (simultaneous conversation).
TL: We do have subpoena power. We rarely have to use it. Only sometimes against folks like RJR Reynolds or companies that decide that they want to use --
Z: They're doing an experiment on how many kids can smoke.
TL: But typically companies provide us information on a voluntary basis and we assure them confidentiality. We don't disclose -- most cases when we conduct an investigation, outside of a case like this where there is a petition, we do not disclose the existence of an investigation. Because it may result in there not being any action and we want to protect the identity of the company. The mere existence of investigation could have very strong detrimental effects on a company's stock. So we have to be very careful about that.

But we generally send a letter, what we call an access letter, to the company setting forth that we're conducting an inquiry into whether or not there have been deceptive or unfair practices. And that we at this point (simultaneous conversation) collecting information and we work with the company over a period of time to review the facts involved. We contact experts as necessary. It can be quite a lengthy process. And most companies do, on a voluntary basis, work with us to resolution.

In the case of a petition, and in this case with Kidscom, we issued a staff opinion letter. The commission released the staff opinion letter in response to the petition outlining the specific concerns raised by CME regarding the site and the practices involved. And we basically said that this was a new area, that Kidscom's practices were not uncommon. A lot of Web sites were doing very similar things. And that the company had been very cooperative from the very earliest stages and had made a number of appropriate changes to its information practices. And therefore did not recommend bringing a law enforcement action.

Through this letter we were able to basically give some guidance to industry in similar Web sites or Web sites that were targeted to children with regard to what we would interpret to be a deceptive practice or likely to be an unfair practice. But recognize that this is a staff opinion letter so it doesn't mean that the commission itself had adopted this guidance. It is not guidelines. For those of you who have taken administrative law, doing rule making is a lengthy process. This was basically a staff interpretation of (simultaneous conversation).

Z: As a point of administrative law, does the FTC actually engage in rule makings?
TL: We used to and we rarely do. Rule making during the 70s, the heydays of rule making in government. There are still occasions where we do rule making. And in fact, as we speak my colleagues at the FTC are engaged in a dialogue with representatives from industry and consumer groups about federal legislation that's been proposed on children's privacy. Bill S2326 to protect children's privacy which would authorize the Federal Trade Commission to conduct rule making. And that bill is going to be supposedly worked up in committee on this coming Tuesday. There is some possibility it may be appended to fast moving legislation and possibly pass this session.
Z: Which is to say you need congressional authorization to do the rule making, unlike some of the other standing commissions which -- the FCC wants to have a rule making, they have a rule making.
TL: We can do rule making if it's within a section five jurisdiction. We're not confident that we could do that under current section five analysis.
Z: So it is interesting to note that given the FTC's position, that they can't discuss an ongoing investigation. I mean that certainly shouldn't come as a surprise that that has to be the government position. And yet there is some private right or habit of action by which a given group can levy an accusation, perhaps trigger an investigation for which the government agency can't say anything. In that case the poles of the debate are defined by CME, the interest group, and the somewhat beleaguered company as to what's going on.
JC: And if I can comment on that, one of the most frustrating things for us was that while many of the media actually did their homework, looked at our site, called us, asked us our opinion and so on, there were quite a few who basically picked up the press release and ran with it without really doing the other side of the story. So for example, the New York Times magazine and the Los Angeles ran stories based solely on the press release that had many inaccuracies in it.

And as a result we were constantly trying to respond to things that weren't true. And interestingly enough, when the FTC actually published the letter stating that they weren't prosecuting us there were very few bylines in newspapers stating that fact.
Z: Tobey, how many of these investigations can you run simultaneously? Generally what's the capacity of the commission to do this?
TL: I don't know that I have a figure. But in terms of the privacy itself as a subset, there's a limited number of investigations you can conduct.
Z: And then online privacy is but a narrow slice of that.
TL: We bring hundreds of cases at the Federal Trade Commission a year but that doesn't reflect the hundreds of additional investigations. We have 900 employees. There are law firms larger than we are. There are certainly brokerage firms larger than we are. It's a relatively small federal agency. So we do have limitations in terms of the number of cases we can bring.
Z: So it's valuable to see this. If you think of Boyle's article that was assigned for today on Foucault in cyberspace -- First the idea that instead of just a simple sovereign and regulated entity model where the sovereign just comes out and goes after those it finds to be not doing the right thing in its definition, you actually end up with a more multifaceted model where CME is empowered to go after somebody thanks to a vehicle that eventually will pan out with a government view as to whether CME's letter is or is not grounded in fact. But it's just a lot more nuanced than the typical rule and sanction model we may have been thinking of when we're thinking of government.

The other thing is that you may have seen Boyle talk about the panopticon (?), the idea that you don't have to be looking everywhere at any time as long as somebody somewhere thinks that you might be looking at them at a given time and that causes them to conform their behavior just on the risk they may be being looked at at any given time. And that there is some sense that perhaps on the Net the prospect, suggested in this Lex Infomatica (?) article, of being able to send out the FTC bot that could go through and see which sites are or are not in compliance with particular standards, that offers a real difference than walking down the street and going merchant by merchant with a hidden camera and seeing who's listening to what and who's abiding by what particular rule.

So I guess I just want that to set the stage for the next phase of the discussion here. Which is -- if we define the problem as this particular case study has, as one of disclosure -- are sites disclosing a particular set of policies? Are the policies offering the right kinds of choice, access, the other principles you saw in the FTC paper? And then the last question might be enforcement. How do we know that they're actually hewing (?) to their policies? That might be a lot harder to decide. But if you define that as the problem of privacy there are some technological solutions offered to get at that. And that will bring Joe and David back into the discussion.

So why don't we have our break, reconvene in seven minutes and pick up with that. So let's get cooking again. Someone has conveniently -- I had nothing to do with this -- gone onto the Kidscom site. And they have a wonderful section that lays out the legalese for kids and then lays it out again for adults. The kid's version is actually much longer than the adult version. Somebody has highlighted, "Anything you send to us, whether it's an idea, a picture or a suggestion becomes our property. We won't be able to return it to you. If we do post something you send to us only your first name, country, and age will be shown to help keep personal information about you safe. We might not be able to post or use everything we get."

There's something else here that actually I would have highlighted if I were seeing it. Here we are. "Everything that you read or see on Kidscom is owned by Circle One Network. That means you can't copy and transmit any of it, even just a little bit, for any reason." Which also wonders if the kid writes the great American novel, sends it to Kidscom, it gets posted, he can no longer send it to somebody else. I'm sure that wasn't the intention.
JC: No. Actually we have a very enthusiastic 12 year old boy in Juneau, Alaska who regularly copies all of Kidscom and runs it as a separate mirror site until we trace him back to his ISP, we send a letter to the ISP, they shut him down. I don't know where his parents are. And then for a couple of weeks nothing happens. And then somehow he finds some other access. He recopies the whole site. And part of the reason why we have to shut him down is because he does not monitor his graffiti wall. So it looks like Kidscom and yet the kinds of dialogue that's going on that wall is nothing that we would want associated with our brand.
Z: So maybe he'll do hard time for copyright infringement if we can help it. And I saw actually this week's question is, “Who do you think should be this year's major league baseball home run king? Slamming Sammy Sosa or Mark big Mac McGwire?” I would have thought it should be the person who hits the most home runs. And then you have a way of actually looking at the results. And it looks like McGwire is ahead 59 to 40. "Mark McGwire rocks. If you think he stinks you're stupid." That's just wonderful. That's clearly a kid, right?
JC: We were thinking of selling this information to the baseball association.
Z: But they weren't necessarily that interested. So we have a potential problem identified which is sites that haven't been shown the light through a flurry of NPR calls or even a nice letter from the Federal Trade Commission or a not so nice letter from the Center for Media Education. They throw up a site, they don't particularly dwell, at least not yet, on having a privacy policy and a disclosure statement and a bunch of legalese. In fact, I don't know if anybody did this. If you go to some of the different sites mentioned, including Geocities which was the subject of one of the letters, you'll see that they do have now these big privacy statements and you click on it.

Although I saw one of the terms of the settlement agreement -- was that Geocities would maintain a prominent link to the Federal Trade Commission. And at least my browser did not pick up on that.
TL: The order -- it's in a public comment period for 60 days. I think its third week in October it goes back to the commission for final review based on comments that we receive, which I won't be surprised if we get many. So it won't be until the order is finally approved that it's effective. So the company is not violating the order as yet.
Z: And they've got engineers working around the clock to put in that link. It could come right down to the wire. So thinking about possible solutions to the narrow problem we've identified, the one that says you want to have some kind of disclosure on the site about the practices used there. What kind of information is collected, what's being done with it, etc, etc. One possible answer is the self regulation answer we've seen.

And it might be worthwhile to say suppose a site has as its privacy statement the following: "We will collect whatever we can from you. Anything you offered us we will happily sell to the highest bidder and publish elsewhere on our site as we see fit." So there you go. That would be disclosure. And if you imagine a site that doesn't disclose anything, has no particular policy, why shouldn't the consumer simply assume that the policy I just stated is the site's policy? And if that's the case, caveat emptor. Tobey is the enforcement person here. What's your thought on that?

TL: From that perspective at this point in time there's no legal requirement that a site post its privacy policy. There are a lot of sites that are not saying anything because they're afraid that if they do say something and it doesn't meet the FTC's standards -- whatever they think that might be at this point in time -- then they might be subject to some type of action. Unfortunately the result is now that you have a majority of sites not posting privacy policies. You have a number of sites, though, more so from the large corporations that have identified privacy as in their economic interest, taking the lead and posting privacy policies. AT&T, IBM, McGraw-Hill, a number of larger companies.

And they basically have decided that privacy is important enough to consumers and to their business to do so. But in the current framework where there is no statutory requirement, basically most sites are laying low.
Z: And is this such a bad thing, I guess is my question.
TL: I think consumers don't know what a site's practices are. And if you're saying shouldn't they assume it's the worst, the result is that consumers won't engage in commerce on line. And there has been at least some studies that show consumer purchases are up on those sites that do have privacy policies. Like 59% of consumers report that they make purchases online where sites have privacy policies.
Z: But that alone isn't enough to convince the rational site builder, “Gee, I guess I should have a privacy policy if I want somebody to visit my site.”
TL: Basically what you're saying is for most sites they don't view it in their economic interest to do so. So will self regulation work on that model? And the commission is waiting until the end of the year to revisit that issue. Our first step in surveying in March was that a very inadequate response through self regulatory efforts. And we've already told Congress that we would review it again at the end of the year. And if there wasn't a substantial improvement, and by that I mean the overwhelming majority, in the 90 percentile, providing notice -- and that's not even addressing whether they're providing privacy protection -- then we would recommend a legislative model.
Z: And this is with the goal of helping Net commerce get really cooking and solving what appears to be this odd market failure where consumers are wary because the policies aren't posted. And yet sites don't seem to be getting the message and posting the policies.
TL: Correct.
Z: So how do we bring P3P into this? Joseph, we have some sense that there's a possible technical solution. So that instead of just having to state your policy and then have a consumer visit the site, read the policy, scratch the head, go back and then use the site, P3P somehow makes this a lot easier. How does it work?
JR: Even if you were to assume sites want to put the privacy practices up full scale, there's really a user education and user interface question. Do we expect that most users will then go and read the most substantive fine print at the sites that actually are willing to make very specific disclosures about the privacy practices? It's a difficult question because in general people don't like to read fine print as they're just clicking around the Web, even though their clicking around the Web has an impact on their privacy.

And that when you create mechanisms that say if anyone's ever turned on a cookie warning ... (inaudible) prompted a lot of you just turn it off. So the P3P tactic basically is to take substantive privacy disclosures, encode the disclosures in a way that's understandable by a machine. And we often call it like an agent technology. And there's two parts of this. One is meta data. And that is a way of doing structured information such that computer agents can understand that information. And then you figure that agent such that it can make decisions on the basis of that information.
Z: So what you're saying is invisible in a given document when you look at it, invisible to your eye -- there may be transmitted information to your computer that it can then use to make judgements about the contents of the document?
JR: Right. And the scenario there is I may set my user agent to say if they're not collecting any personal identifiable information, if they're not using it for direct marketing, maybe it's ... (inaudible) information, it's good enough for me to know that you know that that's what they're saying. And you don't have to prompt it. If I go to a site that doesn't have a privacy practice or if I go to a site that has an exceptional practice, like they actually want my information, then you should prompt me and I can make a decision.
Z: So what you're saying is somebody first configures Netscape or Internet Explorer. They've just gotten the latest version and they're setting it up. And it says, "In addition to filling out these other things that help you specify where different servers are, etc, etc, please fill out the following form and you're only going to have to fill it out once." And this form will ask for a bunch of personal information perhaps in a way that I see it's just wonderful.

You've got a harmonized vocabulary working group. So the harmonized vocabulary working group sits down and say, "What are the people that use browsers, what words do they understand?" And, "How can we ask them once and for all first for a bunch of personal information that goes into the browser and second, questions that try to meaningfully have them answer under what circumstances they'd like to release the information." Is that right?
JR: There's a couple bits that when you're saying “ask about information”, there's kind of two pieces of personal information there. One is your privacy preferences. And the others are pieces of information like your name and such. So yes, you don't necessarily have to type all your name and financial information into your P3P agent. But you do have to configure it with respect to how you feel about privacy in general. There's two ways that preferences accrue. We certainly understand, and this is not uncommon, that configuring things is a pain. We have some mechanisms by which I hope we can make that configuration easier.
Z: The privacy wizard.
JR: Right. But the other alternative is when we think about the interactions and the way we build trust relationships in the real world is we don't come preconfigured out of the womb. What you do is you build those relationships. So in my scenario you're browsing the Web and most of the time you're OK. I hit LL Bean site, I order something, they want my name and address. In that instance I can say, "OK, for LL Bean, for this purpose, yes." And just through natural interactions on the Web I can grow a whole set of sophisticated relationships about where I feel OK about releasing particular types of information.
Z: And with that you'd have participating sites sign on to P3P as a standard. LL Bean, their Web developers would go to the trouble of including this meta data that is P3P-like, that responds to the browser properly. And people then in their browser would, when they hit such sites, know that they're P3P compliant and would ask them the right kinds of questions should they be collecting information.
JR: And the question you ask, why would a ... (inaudible) ever do that if they're putting it up there naturally in their privacy statements? And one, you could say there's a policy push to have that happen. The ... (inaudible) is taking advantage of that. Also there's a carrot here in that typed in information or managing your ... (inaudible) information is often very difficult. So sites feel that if they're going to have access to higher integrity information, not necessarily identifiable, because a number of our members are very keen on having information that's purely anonymous but --
Z: When you say your members, this is the members of W3C. And the members of W3C are?
JR: Are Web companies.
Z: Such as?
JR: Netscape, Microsoft, IBM, AT&T. I'm ... (inaudible) W3C though I'm not ... (inaudible) right now. But when I talk about this --
Z: It's like Charlton Heston parting the water.
JR: Because I talk about it so much. One of the motivations there, and also a slight danger, is that this is facilitating exchange of information. My personal view has been that the information is really being exchanged now and it's generally going to happen a lot more in the future. And I'd rather cast it in the context of a privacy centric mechanism that will allow the current technology like ... (inaudible) to continue developing off site of that context.
Z: So instead of there being just a kind of inertia, you're saying there will be a system that won't necessarily guarantee privacy in the sense of anonymity for everybody but instead will have people make decisions about just how private or public they want to be, either in general or in specific instances. And then the software will as easily as possible make it possible to conform to that view?
JR: That's the goal. When you talk about disclosures, that's one of the few mechanisms you have to make that meaningful because people aren't going to read the fine print.
Z: So David, how does this sound?
DS: I don't think that this approach is privacy centric. I think that it's data collection centric. It grows out of the premise that the collection of personal information is necessary and that people want to do it. They just want some assurance that they know how it's going to be used. And I don't buy that. As I said initially, I think the thing that a lot of people have found attractive about the Internet is the ability to collect information and conduct your online activities anonymously.

So I think that what this really comes down to is these two competing models, business models of the Internet. One is based on the collection of personal information and the reuse of that information to generate revenues. And in support of that model you might need technologies like P3P. But I think we have to look at the other model which is anonymity, which a lot of sites today operate on. They've been very successful. I think it is the case that some of the most heavily trafficked sites are anonymous. They don't require the provision of any personal information.

They seem to be doing well in terms of advertising revenue that they're able to bring in. And I think that we need to keep sight of that model. And certainly to the extent that a technology like P3P is being offered as a substitute or an alternative to legal protections established by law, I don't think that that's the way to go. I think that there needs to be accountability. And these self regulatory and technological proposals really don't provide for any legal accountability. That's my basic reaction to it.
JR: My response is, and I knew exactly what David was going to say -- I was trying to set him up, and he knows exactly what I'm going to say.
Z: That's lovely. It's a road show.
JR: But I personally don't feel that something like P3P is a substitute to anonymity. ... (inaudible) I'd like to see some aspects of P3P ... (inaudible) junk buster (?). A lot of our members are interested in basically, as you're saying the most heavily trafficked sites -- it's not personal information. Actually one of my own insights is that most of the Web savvy companies have been most progressive with respect to privacy, in contrast to their real world counterpart. Because in the real world they are very, very personal identifying information centric. And you can do lots of very cool things without any --
Z: And you're saying that Web companies -- this is don't ask, don't tell? The Web company is not even going to ask you to give the information because --
JR: No. They just know that this particular person with some token likes the Oreo. So when they go to the new site ... (inaudible) Oreos. So I would say this is not offered as a replacement for anonymity. ... (inaudible) work with anonymity.

And the other issue was, again -- it's the repositioning of ... (inaudible) self regulatory mechanism. In the United States most of the supporters of P3P certainly have voiced self regulatory concerns. But the P3P can work in a regulatory or self regulatory environment. I personally believe there needs to be regulation in the United States beyond what we have today.
Z: You're familiar with the European situation, is that right? Why don't you just tell us a little bit about the European directive.
JR: Actually I guess I would defer to David or ask you to be a little more specific in your question.
Z: Let's defer to David.
DS: I can generally talk about it. Which is that the European data protection directive -- which will go into effect in about a month, it might actually be a month from today as a matter of fact -- will basically require companies doing business in the European community to either comply with their European laws, which insures the subject of information certain rights with respect to the collection of information. Being informed of the fact that it's being collected, how it's going to be used, giving them the right to inspect the information, some rights to delete the information.

And any foreign companies, non EU companies, that are doing business and attempting to collect information in Europe will have to be able to show that their own national laws are similarly protective of consumer privacy rights before those companies are permitted to collect personal information from European citizens.
Z: So let's say little Bettina from Finland, recent EU member, wants to log onto Kidscom and specify that she enjoys, I don't know, she prefers Mark to Sammy. Under your reading of the directive is that data not allowed to be collected by Kidscom?
__: I think that's a question that we don't yet really know the answer to because the territoriality of the directive remains to be determined.
Z: Kidscom is clearly an American company, right?
DS: If Kidscom wanted to set up an affiliate in Frankfurt and run the site there they would probably have problems in terms of making representations concerning US law. But this is one of the problems we have on the Internet. There is no practical way that the EU or the Finnish government could really have any say or any recourse with respect to what Kidscom was doing in Milwaukee.
Z: If you got a nasty letter from the Finnish government that said, "Stop registering people like Bettina," would you tear it up and throw it away or would you listen to it?
JC: I think part of this whole regulatory issue, and I agree -- first of all it's really a question of ethics. Because regulations are always necessary when there are no ethics present. So it really comes down to each one of us individually to continue again to move in that direction. However, I do think that regulation is necessary for the bad boys. There needs to be some sort of sign. However, having said that, I think that it is a very complex issue. It is not simply yes, no, black, white. And I'll bring up one of the things that I started to talk about more publicly.

Because the site doesn't target just middle or upper class white children we have kids that get in from socioeconomically deprived neighborhoods, whether that's through a boys and girls club in their area, whether it's through a library, whether it's through a school. And if a regulation was put into effect that said kids could only come to Kidscom of 12 and under if they had their parental permission, a signed parents permission slip, the immediate question becomes what do you do for children whose parents either don't understand English, don't know how to write, or don't even understand what the Internet is all about? And then have you driven a wedge in the haves and have nots debate towards information?

DS: Can I just back you up for a minute? Why is it necessary to know the identity of the children that are using the site? I mean why do we even get into this question of should the parents be involved or not? Why is it necessary for you to have personally identifiable information?
JC: There's two reasons. One is the security of the playground. If we were only publishing content for children to read, it wouldn't really matter to us. But because of the fact that this is a forum for children to publish content themselves, we need to determine where and who and if that is a child or not.
Z: Do you verify that information?
JC: So we have some sort of tag in order to be able to follow things back. What we do currently is through the process of registration there is a bounce e-mail that goes to what the child has identified as their parents' e-mail address and notifies that someone in your household has just recently signed a registration form on Kidscom. And it gives details about what activities go on there. It tells them how to get the information withdrawn and so on. Which is one of the ways that we try to get someone to be aware of the (simultaneous conversation).
Z: Did this come out of the FTC agreement, this system? I guess I shouldn't ask you.
TL: There wasn't an agreement.
Z: There was simply a letter.
DS: But if this isn't a child and there's somebody who is attempting to masquerade as a child to gain entry, then I give my e-mail address. I say this is my father's e-mail address, I get the e-mail, and I say, "Yeah, Johnny can use the site." And I'm now Johnnie.
JC: If you now come on to the chat wall and you start posting content, trying to find a child that you're interested in as a pedophile, we are able to -- because you have to register, you have to put in your registration information in order to access that area, we're able to track back and find out through that some sort of effort to find out who you are. (simultaneous conversation)
DS: -- personally identifiable information neither I nor any other pedophile could find real children.
JC: Then you're saying that all Web sites should only post content and then not allow users to respond.
DS: I think there can be arrangements for pseudonymous interaction. In other words, I could be--
JC: -- the playground and by using a fake name and a disguise you can come on and do whatever you want. And we can't control (simultaneous conversation).
DS: -- that's the case now./font>
JC: No. At least by having some sort of peg, whether it's an e-mail address or an IP address, etc, we can at least start the process of going back or we can shut that person down. It can be an arduous task because someone who's very determined can continually try to re-register and so on. But at least it begins to give us some sort of control over who we allow on our playground.
DS: And what if it was, say, a Hotmail e-mail address that is totally anonymous?
JC: They have the ability to know that so we can at least contact them and identify. Or else we can say to Hotmail, "Unless you better patrol who is using your address, we will shut off all Hotmail addresses coming in."
Q: I just want to characterize this debate because I think it's very salient to the issue of privacy. My own observation of privacy has been that unfortunately the right to privacy rarely exists without contention with respect to other concerns. ... (inaudible) fights the very good fight and a difficult fight of saying privacy is important in light of these other concerns. But often privacy is cast as opposing something with respect to free speech or law enforcement or safety. It's just one of those observations about this whole issue and I think one of the reasons why we haven't moved further. I was just wondering if David had anything to say on that. It's a hard job, right? Because safety issues are always raised, law enforcement issues are always raised.
DS: But I think the safety issue can be addressed through anonymity. I don't understand (simultaneous conversation). But who is the pedophile soliciting if everyone is anonymous?
JR: Maybe the child gave the information up or something like that in the actual interaction.
Z: I suggest you have two polar extremes that may actually -- if you don't pursue the middle course, each get in the direction you want. One polar extreme, suggested by the Brin piece that was in the optional reading, is everybody knows everything. So anybody going onto the site is identifiable. And that way if somebody misbehaves on the site, you can't even have the older person masquerading as a kid because they're known. You have some technology that actually prohibits anonymity on the site, successfully does so. Some kind of digital signature technology, certificates. The kind of world that Epic (?) is fighting against.

But in that world if you're worried about kids' safety you're in good shape because you can reach anybody who misbehaves limited only by the efficacy of the technical system designed to identify people. You've pointed out, obviously the person most wanting to make trouble on the site is going to be least interested in putting their real parents' e-mail address in. It does seem like an easy enough loophole to discover and then exploit.
DS: There's another question I wanted to ask. Which is, is the information used for any other purpose?
JC: We do not now and never have rented or sold the personally identifiable information of the kids on the site. So we don't do mailing lists. We don't sell our list to someone else, etc. For us, part of the issue was it's a non debate if you're using this medium as a one way medium. But then you are missing part of the power of the medium in that there's a two way exchange possible.
Z: In the world of complete anonymity you can still have two way exchanges and kids are protected because they are anonymous or pseudonymous. Unless they break the code and give out their real name in the course of being in a chat room or something, where the static information that people gave in order to get into the chat room does not trace back to them. And that's again a function of how well you could devise the chat room so that it guaranteed anonymity even against the wishes of the kid who'd be in the room.

So it's odd that total anonymity is safe, total identifiability is safe. It's the middle zone that's actually causing the trouble. (simultaneous conversation)
JR: It could be possible, for instance -- they certainly have chat rooms by which they select to censor dirty words or something like that. And one of our prototype ... (inaudible) of P3P, it actually watches your stream and make sure that -- you have a heuristic that says, "This looks like an address. See an address on that wire, get rid of it."
Z: Is that right? Your browser would save you from the mistake of putting in your e-mail address?
JR: Potentially, yeah. We're playing around with it. They do it for content.
JC: I would challenge that and I hope ... (inaudible) because I think using technology to (simultaneous conversation) is very much where we want to go. But as a site that has been working with kids for four years, I can tell you we have a list of over 6,000 bad words and every time -- and we have to continually add to them.
Z: Are they all in English?
JC: When we first banned, for example, the word “hell” then all of a sudden we had kids doing h*ll. So then we had to ban that sort of a word.
Z: Did you ban ****? (simultaneous conversation)
JR: -- to the same effort probably to conceal their address and ... (inaudible) or something like that.
JC: The biggest complaint that we get on the site is that we don't allow private chat rooms where they can talk with one on one on each other. And the problem is -- and we tell them that they'll be banned or kicked off if they release their e-mail address. We also put in a code where the ... (inaudible) doesn't accept that message and so on. They write it all out. They use code words in terms to be able to try to break the system in order to find each other.
Z: Anything to identify themselves to the person who wants to come kill them.
JC: It's very much like ... (inaudible).
TL: I think that demonstrates one of the problems, particularly with kids. Anonymity is not what kids are about, unfortunately. Children don't have a sense of privacy in some respects. And particularly on line I think they really want to tell it all and they want their name and the contact information there. Unfortunately perhaps to their own detriment.

There are two strengths of the Internet. And that's anonymity and interactivity. There are two major issues raised by the Internet. And that's anonymity and interactivity. And what you see happening here is the attempt to try and develop some rules, perhaps some good practices, to allow both interactivity and anonymity in a way that doesn't harm consumers and particularly children. And we're still sorting out how that can work. And what Joe's work involved very much is one tool.

And I think Joe made a very important point earlier. They're not inconsistent. The notion that there will be a role for self regulation, for businesses to regulate themselves, establish good practices, a role for government to perhaps provide a level playing field that legitimate businesses want. They don't want to have burdens put upon them because they're good actors that bad actors can take advantage of. And a role for the technology to play as a tool.

And I think initially when we first started out at the FTC to look at these issues, there seemed to be some tension. The answer is self regulation or the answer is the technology or the answer is the government. And I think what we see happening is more a sense of there are different roles for each to play. We're fine tuning what the roles should be. And this is happening very, very fast.

For those of you who go on to do policy research and want to look at models and policy making, this Internet policy area is just beautiful to look at. Because in a very short period of time you have a confluence of major changes in industry, in government, and private sector consumer groups. Changes that we're seeing happening in our own life styles.

I mean I look around and I look at all these laptops up here. I look at how Jonathan is conducting his course and the way this is all happening. Step back and think if this was like TV and you were just starting out and there was this little box and you're looking at the screen. And what the implications of that are. You are in a very ideal situation to look at the implications of this technology, look at what the roles of the various institutions should be in coming up with a mix of responses to make sure that this amazing new market place or information source or entertainment source, make sure that it reflects the social values that you want it to have.

DS: Can I just add one quick thing to that? Which is that I agree with all of that except to the extent that I want to point out that we're not necessarily writing on a completely clean slate. And this is something that we talk about in terms of advocating privacy laws for the Internet. In at least two other media type areas where the consumer of information is identifiable there are federal privacy laws protecting the individual's privacy.

And they are video rental records. There is a federal privacy law that protects that information. And cable television subscription information. So the pay-per-view programming, for instance, that you order and are therefore identified with, is protected by federal law. So there are some precedents that we could look at. And it's interesting. I don't think the argument has ever been made that the video rental law or the cable television privacy law have in any way impeded the development of those industries.
TL: In fact, I think a very important model to look at, a real example, is the 900 number industry. When that emerged back in the early 90s I brought the first cases against 900 services that were marketing to kids and telling kids directly to call 900 numbers. Dial a Santa, Dial Easter Bunny, Dial Halloween. It was really crazy. And as a result this industry, and there were a lot of new entrepreneurs out there who decided the technology was there to reap some money without really looking at the ethics ... (inaudible) involved. The end result was the 900 industry almost died.

Because it brought down not only FTC, not only industry folks as well, but then Congress came in and enacted a statute that basically did away with 900 numbers directed to kids and set out some very strong regulatory framework which the FTC enforces about how 900 number marketing should occur. It almost died. This industry, the Internet industry, I think, has taken to heart that the leaders in the industry want it to operate in a way that will not have Congress brought down on its head. And the only way to do that is to act responsibly.

And you have leadership from within the industry, the Microsofts, the Netscapes, the Hewlett-Packards. But the problem here is we have so many more players on the Internet. Everybody is a publisher. My son has a Web site. And he's only 13 and a half years old. So anybody can go on line and be a publisher and be a business person. And so the --

JR: Does your son have a privacy policy?
TL: He's not collecting data. But (simultaneous conversation).
Z: I'm sorry the time has gone by so quickly. But let's open it up, to the extent we can just in the next few minutes, to thoughts, comments, quick thoughts. Scott.
Q: I'm having trouble discerning what exactly the bottom line is. I'm enough of a skeptic that I just assume if I type in, I assume that if I go to any site then they know my e-mail address and maybe they know more. That's my question. And if I type in any form I assume it's going to be used against me.
Z: And you don't lose sleep over this?
Q: Yeah, I do. I mean the same thing happens with --
Z: You go to the most twisted sites on the Net and it doesn't bother you?
Q: I keep that in mind and that's what keeps me off of them.
Z: But should there be that chilling effect? I think that is part of what we're talking about.
Q: The analogy that I would make is like credit card sales over the phone. That's an accepted form of commerce. I mean I understand there's a risk that whoever is answering the phone is about to get fired and they're keeping a list of everybody that called that day. That would be ... (inaudible) it would take a long time for me to correct. And I have that attitude toward the Web. And I wonder if what I don't type in can be learned about me without my knowledge?
DS: Credit card information over the phone is a good example. I mean the fact of the matter is that you're giving that information for a specific purchase that you're talking about and everyone understands that if that credit card number was then used for some other purpose there's a problem with that. So why don't we have --
Z: Does it bother you that Dominos, when you pay by credit card, the next time you call says, "Will it be another pepperoni for you, sir?" Because they actually used the credit card number as a token to say it's the same person calling.
DS: I think that's indicative of the problem.
Z: This is a problem? (simultaneous conversation)
__: Some would say it's a feature.
DS: When you overlay all of the information that's going to become available through the Internet into the information industry and the information economy that we're already dealing with, then I think that is a problem. But my point was that with respect to the use of a credit card number on the phone, you know that any unauthorized secondary use of your number is prohibited by law. But do you have the same sense of security when you provide information to a Web site? Aside from your credit card number. I mean anything else. That information could then be used for any other purpose without your consent and there isn't any legal standard that says no, there's a problem with that.
Q: Are you saying that if my credit card goes over the Web then it's not--
DS: No, I'm not talking about credit card number. I'm just using that as an example. That's one area where we all know that that's information that cannot be used without your authorization.
Q: My base assumption is that if I give somebody my address, they can give it to other people as far as I know. If I do it over mail order or (simultaneous conversation).
Z: So you turn out to be not somebody who cares a -- you're one of the people that in Tobey's survey is not going to be that concerned.
Q: Right. But I do want to know if I don't fill something out, what can be learned about me? Just through the Internet without saying, "His address is .harvard.edu and we know that Harvard-- " without doing extra research.
Z: Can you give an answer to that, Joe, in about ten seconds?
JR: There are services that are able to -- based on your identifier, like your e-mail, they have profiles associated with it. So you ... (inaudible) that. So one of the things with cookies and the whole issue of cookies is that sometimes sites are able to share cookies. My example is maybe you go to Playboy and you think you're browsing Playboy semi anonymously ... (inaudible) didn't even use a cookie but how are they going to tie that back to you? But if they use the same third party cookie provider maybe LL Bean also happens to be in that network ... (inaudible). Now actually they do have the fact that you like Miss December and your name and address.
Z: You want a sleeping bag and they keep selling you skimpy underwear. What's wrong with this thing? James and then Greg.
Q: My question has to do with the P3P technology. Will it allow me -- I go to a Web site and before I enter the Web site it lets me know this site is going to collect information or add a cookie or whatever it is. That it's going to be doing something to provide information to give me the option to say, "I'm not going to go into this Web site." Which in essence gets to your issue, I have my choice. I know going into the site you're going to collect information, maybe even so far as how they're going to use it. And then thus the market will control itself because if they start finding that people won't go into those Web sites because information is being collected and used in a way they don't want it, they'll switch over to a different policy. So my question is will the technology do that and will that answer your concern then?
JR: Basically yes. And I think Mark Rotenburg (?) at the Department of Commerce ... (inaudible) kind of interesting. That if you have a transparent view of policy practices maybe the market will be able to push on this towards something that is more ... (inaudible).
DS -- have to be something mandatory about the use of the technology. I mean otherwise there might be the 20 major sites are using the technology and you know what they're doing. But then what about the rest of the sites? So we come back to this problem of self regulation is only as good as the companies that are interested in regulating themselves.
Q: In contrast to a different assumption when Tobey spoke of her child, oh, he doesn't have a privacy policy because he doesn't collect data. And your assumption that if they don't have a privacy policy, they're collecting all data. And it's kind of odd.
Z: Greg.
Q: I guess my question -- I was just thinking about kind of what Scott was saying. Like I don't understand -- I guess I just don't understand how it's all so different. Like it seems to me that so much of what goes on over the Net is free. Like it's completely free. So if the price that you have to pay is just you've got to tell somebody your name, I just don't really understand what exactly is the problem.
DS: I think when you consciously make that choice that's fine. For instance, I've made the decision that it's worth my getting access to the New York Times site so I have agreed that they can have my e-mail address. But then we get into the issue that Joseph raised. Which is what if New York Times is involved in a cookie consortium where other sites that I have not made that conscious decision to provide my information in exchange for theirs are nonetheless getting my information.
Q: That's exactly my point. Is that what goes on -- I understand like we were talking about before that it's on such a larger scale. But that's exactly what goes on in the real world every day. I mean I made a decision a little while ago that I liked Victoria's Secrets catalogs. So I get the catalog but I also get the pottery barn catalog, I get --
Z: You think this is a result of the Victoria's Secret catalog?
Q: They sell mailing lists. I mean the Victoria's Secret catalog is an extremely expensive mailing list and they rent it out to people. And so when people share cookies, that's all that's going on is that it's just mailing lists. And I understand the problem of scale and that's what the Internet does. But --
TL: The issue is not just mailing lists. I think for many people, mailing lists are a very important issue. And that alone might drive people to feel that there needs to be privacy protection whether through technology or government. But the issue is, and I think as David's saying, the issue is that let's say you've been involved in a car accident and the insurance investigator finds out that you, on a monthly or a biweekly basis, get so much liquor from Virtual Vineyards. And in fact uses that information, your purchase information, which Virtual Vineyards -- you're right, could just as well be a neighborhood liquor store and they could have gone to find out information.

But there's more anonymity perhaps in the liquor store around the corner in some respects because you just pay by a credit card. They don't keep a record necessarily of what you purchase. Virtual Vineyards probably does keep -- I don't know, I haven't looked at their site. You may be registered; they have a database about you that has more information in it that might be useful in another context. So it's not so much that they're using information that you gave them. You say, "If I give them the information that's fine." It's how that information may be used in another context, one that was not one that you considered when you gave up that information.
DS: There's also a lot more specificity. In the non Internet world the fact that I subscribe to the New York Times is known to the New York Times and whoever they decide to sell their list to. But the fact that the first thing I do is go to the sports section or I'm interested in particular types of financial information in the New York Times or that I tend to log on at 3:00 in the morning. I mean that level of detail is not known offline.
JC: But the problem is, they don't know necessarily you and your eyeballs (?). They know your computer's behavior. And how do they know it's not your wife going on and logging on at 3:00 in the morning? Or that it's not your son who's going to the sports section within the Wall Street Journal? I mean there's some sense with this technology that they know everything and everywhere where you're going. And the technology doesn't always reach that far.
JR: But that would probably be easily remedied.
Z: And the person who's going to bring it to you is MIT.
JR: You want to log onto your site because -- I mean people log into their operating system ... (inaudible) the e-mail file is private. ... (inaudible).
DS: Fingerprint recognition.
Z: So what we've tried to do today -- and I'm sorry for remaining questions. At least we've got the reception soon to commence. What we tried to do is figure out what exactly is the problem, how big a problem is it, can you come up with a taxonomy of privacy issues? When you're on the Net, is it any different than the kinds of privacy issues you're encountering in the so-called physical world? And we've been left lingering with basically some technical questions just about the state of play right now. How much can really be found out about you? Answer, probably less than you think if you read scary stories in the New York Times. More than you think if you haven't thought about it.

And also a thought, inspired if you read the robot article about fourth amendment search and seizure. An idea that at least when you're thinking about the fourth amendment and the privacy that's imputed there -- the most recent conception of the fourth amendment, it's shifted a little bit from what it used to be. And it's actually saying, "The harm done by a government search at least is a so-called collateral damage." The humiliation while you sit there and the cop goes through your suitcase. Or somebody barges into your house and goes through all the rooms and looks around. That that's actually the harm that the fourth amendment is designed to protect against.

That article then hypothesized an incredibly efficient minimal collateral damage and yet amazingly thorough search of your hard drive. The FBI worm comes over the Net, goes through all of your files. Of course it's not a real worm, it's just a piece of software, so there's no homunculus (?) actually looking at your files and imagining you with your files and doing things with them. But instead it's just looking for a particular piece of contraband which, if you have it, you really are in trouble because you're not supposed to. It's some particular copyrighted program or something.

And that article at least concluded that wow, under current fourth amendment doctrine that amazingly intrusive search, due to its lack of collateral damage wouldn't be such a big deal under the values of the fourth amendment as it's currently understood by the Supreme Court.
JR: The UK Customs Authority is actually ... (inaudible). As you walk through the airport they stop you and scan your ... (inaudible).
Z: Exactly. And they have the dog that sniffs your various suitcases and things. So it's worth thinking about. If you can imagine that kind of search done by third parties, not just the government, as you're going around the Net and leaving these mouse droppings, is it no harm, no foul until actually they actually build something out of it and then use it to do the collateral things of humiliation, pain, loss? In that case it's the use of the data, not the collection, that matters so much.

As we wrap up, if you'll indulge me I'd like to -- talk about buying everybody off. The reception is supposed to start at 6:15 so we've got a few minutes yet. I'd love to do just a feedback memo. This is the blank sheet of paper for which you can just put your name if you choose, your biggest thought, your biggest question and anything you want to say directly. That would be quite helpful. About how you think things are going and what you have on your mind after today.

Next week you'll notice we have no panel. There is reading. And we will take up a little bit from ideas from today before getting into next week with it. If you have questions you want to suggest for that question process, please feel free to e-mail me, including any kind of survey you'd want to run. We have the software now. We might as well use it. Most of the bugs are out. If you have any trouble with it, Wendy at seltzer.com can get your answer in there.
JR: John? My survey?
Z: Did anybody bring back poor Joseph's survey that he distributed last week? Wonderful. So if you can actually leave that at the front on your way out, that would be great.
Q: Could you repeat ... (inaudible).
Z: Three things. Your biggest thought. It doesn't need to be anything particularly special. What kind of chicken is at the reception is OK. Your biggest question coming out of today. And anything you want to say directly. Before we lose critical mass why don't you help me thank our guests for coming over.