Journal of Free Speech Law: "Brokered Abuse," by Prof. Thomas Kadri

Just published as part of the symposium on Media and Society After Technological Disruption, edited by Profs. Justin "Gus" Hurwitz & Kyle Langvardt.

The article is here; here are the Introduction and Part I:

"It's accually obsene what you can find out about a person on the internet."

To some, this typo-ridden remark might sound banal. We know that our data drifts around online, with digital flotsam and jetsam washing up sporadically on different websites across the internet. Surveillance has been so normalized that, these days, many people aren't distressed when their information appears in a Google search, even if they sometimes fret about their privacy in other settings.

But this remark isn't a throwaway line by a disgruntled netizen. No. It's a boast by a stalker, Liam Youens, who went online to find his victim, Amy Boyer. Youens traced Boyer after buying her work address from a data broker—a company that traffics information about people for profit. Youens documented his search for Boyer's whereabouts on his personal website: "I found an internet site to do that, and to my surprize everything else under the Sun. Most importantly: her current employment." After he asked the broker for more information, he just had to bide his time. "I'm waiting for the results," he wrote ominously, not long before shooting Boyer dead at work.

Data brokers fuel abuse by sharing people's information and thwarting their obscurity. The value of obscurity, though sometimes overlooked in privacy discourse, rests on the idea that "information is safe—at least to some degree—when it is hard to obtain or understand." Brokers hinder obscurity by making it easier and likelier to find or fathom information about people. This act of foiling obscurity, in turn, facilitates interpersonal abuse. The physical violence suffered by Amy Boyer is but one kind of abuse; people also face stalking, harassment, doxing, defamation, fraud, sextortion, and nonconsensual sharing of their intimate images.

This chapter explores the phenomenon of brokered abuse: the ways that data brokerage enables and exacerbates interpersonal abuse. The harms of brokered abuse go beyond the fact that brokers make it easier to surveil people and expose them to physical, psychological, financial, and reputational harms. In addition, people must beg every single broker to conceal their information from thousands of separate databases, over and over again, with little or no legal recourse if brokers reject their efforts to regain some obscurity. Due partly to existing laws, this whack-a-mole burden of repeatedly pleading to obscure data can trigger trauma and distress. Only by grasping this fuller scope of brokered abuse can we begin to regulate it.

This chapter splits into three parts. Part I introduces the broker industry before Part II reveals how the law largely fails to address, and is even complicit in, key features of brokered abuse. Part III then explores the harms stemming from brokered abuse in order to lay some foundations for regulating them.

[I]. Data Brokers as Information Traffickers

Data brokerage is a multibillion-dollar industry. Thousands of companies form a sprawling network of brokers that buy, sell, trade, and license gigabytes of human information. Though brokers' business models vary, their power and profit fundamentally stem from trafficking information about people.

For the most part, brokers buy information from other companies and gather it from government records and public websites. From there, brokers build profiles including data like a person's name, aliases, photos, gender, birthdate, citizenship, religion, addresses, phone numbers, social-media accounts, email addresses, Social Security number, employers, schools, families, cohabitants, purchases, health conditions, and hobbies. These data dossiers are then sold for a fee or even shared for "free" thanks to the ads adorning broker websites.

There are, to be fair, some benefits tied to the broker industry. Transparency and accessibility come from publicizing information online, including data drawn from public records. Journalists, activists, academics, and the general public can garner insights from this information. Indeed, a person might even evade interpersonal abuse or other ills after discovering an acquaintance's restraining order or criminal record through a broker. Though this kind of data is often accessible in other ways, a Google search is easier, faster, and cheaper than a trip to the county courthouse.

Some people also use brokers to locate heirs or reconnect with long-lost friends and family. Others might rely on brokered data to inform their hiring decisions. Some companies rely on brokers in order to collect debts or discover fraud, corroborating information given to them by a customer or client. And brokers can even assist the legal system, such as when class-action awards are being distributed. These perks can't be ignored, but we should be wary of their value being exaggerated.

Another set of purported benefits relate to consumers, largely stemming from how businesses use brokered data. In particular, human information fuels the datasets and algorithms that help companies target ads and develop products. The resulting corporate revenue could, at least theoretically, yield cheaper or better services for consumers. I'm skeptical that this species of informational capitalism is in the public's interest, but debunking this defense of data brokerage isn't essential. Even if the commercial benefits are substantial, we shouldn't scoff at the serious harms tied to the broker industry.

Though there are many harmful facets of data brokerage, I'll focus here on only one: how brokers enable and exacerbate interpersonal abuse. Most directly, brokers' dossiers can be treasure troves for abusers, who can plunder them for information with just a few clicks and bucks. In Amy Boyer's case, Youens paid a broker $45 for her Social Security number, $30 for her home address, and $109 for her work address. $184 might already seem like a trifling sum given the vile result, but many brokers offer much more for far less. In 2013, for instance, a stalker bought Judge Timothy Corrigan's home address for less than $2 and later shot bullets at his house, missing the judge's head by a mere 1.6 inches.

These jarring anecdotes tell part of the story of how brokers enable and exacerbate abuse, but the phenomenon needs more interrogation to show its full scope. To do so, we must unpack how the law can be ineffective and even injurious when responding to brokered abuse.

Comments

[John F. Carr]

I am confident in my government's ability to ensure that the personal data business stays healthy enough to supply the government with data.

[Longtobefree]

But they are private companies!

(as was/is the Pinkertons)

[Sarcastr0]

ODNI SENIOR ADVISORY GROUP PANEL DECLASSIFIED REPORT ON COMMERCIALLY AVAILABLE INFORMATION
https://www.dni.gov/index.php/newsroom/reports-publications/reports-publications-2023/item/2389-odni-senior-advisory-group-panel-declassified-report-on-commercially-available-information

2.6.4. (U) [Commercially Available Information] Increases the Power of the Government. The government would never have been
permitted to compel billions of people to carry location tracking devices on their persons at all times, to log and track most of their social interactions, or to keep flawless records of all their
reading habits. Yet smartphones, connected cars, web tracking technologies, the Internet of Things, and other innovations have had this effect without government participation. While the
IC cannot willingly blind itself to this information, it must appreciate how unfettered access to CAI increases its power in ways that may exceed our constitutional traditions or other societal expectations.

(U) CAI also implicates civil liberties. CAI can disclose, for example, the detailed movements and associations of individuals and groups, revealing political, religious, travel, and speech activities.
CAI could be used, for example, to identify every person who attended a protest or rally based on their smartphone location or ad-tracking records. Civil liberties concerns such as these are
examples of how large quantities of nominally “public” information can result in sensitive aggregations.

[Stephen Lathrop]

Private data brokering seems to work in ways somewhat analogous to the long-familiar credit reporting industry. That business in turn, has sought and received special legal protections against liability for defamation. Credit reporting industry managers assert that without such protections their business would not be viable.

That may point toward a solution to data brokerage abuses. Pass laws which suspend online liability protection for defamation, and for other torts. Make sure victims of data brokers specifically are free to sue under state laws for any harms they suffer because of inaccurate or recklessly provided information, including defamation, but also other causes. Maybe that will chill data brokerage abuses.

And by the way, do the same for the credit reporting industry. Apparently that was already done by Congress, but the provision to preserve defamation liability under state law was stripped from the law by the courts, which cited federal preemption by the FTC as the reason.

[SRG]

I am surprised that the credit reporting companies' exemption has not been challenged on Equal Protection grounds (or perhaps it has but the challenger lost).

[CindyF]

Someone that will search for personal information on another, much less pay for it, in order to facilitate causing that person harm, has serious mental issues. Once they have been found guilty of stalking or whatever other criminal charges can be brought against them, they should be locked away from society for an extended period of time.

I've had some random person at another site apparently go to a bit of trouble to track down my identity. They let me know they had done so and portrayed themselves as a federal agent. I doubt that is so and therefore that doesn't concern me. I'm retired so they can't threaten my job. I live on a very isolated property in a rural area and have a security system that notifies me if something more than a deer or fox crosses onto my property. If they are intent on causing harm, the repercussions will be on them.

[tkamenick]

Ugh, don't go down this road. Don't grab a handful of anecdotes and then claim policy changes are needed. Information brokers don't just have "some" value, they are incredibly valuable and used constantly by huge numbers of people for valid purposes every day. Crap like this is how we got the DPPA, which just makes life hard for millions of people and does little to no good.