The Lawfare Podcast: The Hidden Alliance Between Tech and Government

[Intro]

Byron Tau: Well, you're not supposed to look up your spouse or your lover or your neighbors, not pursuant to some lawful government mission, but generally speaking, unclassified open-source information has a lot fewer restrictions than the classified information that the government uses in more targeted surveillance.

And so, it has become easier to use inside government, easier to give to people who don't necessarily have clearances and easier to share with American partners and allies that we potentially don't have a deep and long intelligence sharing history with. And so, it's become in some ways the easy button for government agencies to be able to purchase large amounts of this data and share it with people like police officers, who don't necessarily have security clearances, or other countries in some cases.

Jack Goldsmith: I'm Jack Goldsmith, and this is the Lawfare Podcast, March eighth, 2024. The practice of surveillance capitalism, the widespread private collection, and commodification of personal data is well understood. Less well understood is the extent to which the U.S. government purchases this data in the commercial marketplace to use it for intelligence and law enforcement purposes.

Byron Tau, when he was a reporter with the Wall Street Journal, did more than anyone to bring this practice to public light. I sat down recently with Tau to discuss his new book on the topic, “Means of Control: How the Hidden Alliance of Tech and Government is Creating a New American Surveillance State.”

We discussed how the private broker market works, why the government is able to purchase bulk private data with relatively few legal restrictions, and the threat to privacy and civil liberties that adheres in the practice. We also discussed why this form of data is so important to the government and the prospects for reform of the relatively unregulated practice.

It is the Lawfare Podcast, March eighth, “The Hidden Alliance between Tech and Government.”

[Main Episode]

Byron, the thrust of your book is about how the U.S. government skirts legal and policy limits on its electronic surveillance powers by piggybacking on the massive surveillance done by the private sector and then purchasing the data that the private sector collects.

Is that a fair general summary?

Byron Tau: I think that's a fair summary of the book. I would say the book is an examination of the ways in which governments, I primarily focus on the United States government, but the reporting applies to governments broadly, are increasingly purchasing data rather than obtaining it through some sort of lawful process or through some sort of computer intrusion.

And I also look at the consequences for our civil liberties and privacy in a world in which so much information is available for either sale or in some cases for the taking. Governments have always been hungry for information, but the amount of data that's now commercially available is increasing dramatically, and governments have moved to take advantage of that phenomenon.

And in my view, that has put a lot more power and information in the hands of the government and it’s starting to challenge our notion of the proper balance between government power and citizen privacy.

Jack Goldsmith: That's a great summary. Better than mine. Let's begin with what I think of as the beginning, which is surveillance by the private sector.

And mainly you build upon the idea of surveillance capitalism, the massive data collected and commodified by businesses for their business purposes. But it seems like the surveillance, the private surveillance you have in mind is even broader than that. Can you just describe the ecosystem of data collection that the government's piggybacking on, that the government is purchasing?

Byron Tau: Sure. So at the center of this story are not the big tech companies that I think most Americans think of when they think of technology.

So the book is primarily not about companies like Apple and Google and Meta. It's in fact about data brokers, which are companies that do not have much of a consumer to business relationship, rather they're business-to-business companies.

Not all of the companies in this book would call themselves data brokers, but they're broadly in the business of taking either raw data and selling it, or selling insights derived or products derived from raw data. And these are data brokers that originally, you know, in the early days, in the 1960s and 1970s and the early days of data brokers, they sprung up to collect things like consumer addresses and stuff you could get down at the public courthouse, like marriage records and licenses and stuff like that.

But as the amount of data in society increased, the amount of data that brokers sprung up to collect has also increased. So today, there are brokers out there that sell everything from bulk social media data, from various social sites to the geolocation of devices, or in some cases automobiles.

You have data brokers that sell things like license plate scans and make that available to public safety and government entities. And then increasingly you have data brokers that are brokering very strange and esoteric data sets, like the scans of the signal environment that produce information about what wireless base stations or what Bluetooth headphones are being seen in the world.

There are data brokers that collect this data and sell it, and in many cases to governments.

Jack Goldsmith: Why would the private sector, why would they collect information about Bluetooth usage for the private sector, for example?

Byron Tau: So, that was one particular broker that I identified called Signal Frame that had created this product that was running inside mobile phone apps and was scanning the signal environment around phones.

And their commercial purpose was ostensibly to try to measure the number of devices in the world, and that could potentially say something about market share. So if you could accurately get a sampling of all the smart watches in the world, maybe you could see if the number of Fitbits was going up or going down, or if the number of Apple watches was going up or going down.

But of course, this is also valuable cyber data. And of course, governments began to be interested in acquiring it and looking at it for what they could do with it.

Jack Goldsmith: And so I tried once, about four or five years ago to understand this world of data brokers, and after a couple of days of trying to figure it out, I just hit a dead end.

There's just very, very little in the public realm about some of the big in institutions are known, but most of the operators I think aren't known and how these work how these markets work aren't very well known. Is that true or was I just a bad researcher? And if it's true, how did you figure it out?

Byron Tau: Yeah, so I think penetrating this world is difficult. I think both the data brokers, especially those that specialize in selling to governments, don't necessarily wanna talk about their offerings, especially not to reporters or those in civil society who might be critics, like yourself.

And the government agencies don't necessarily wanna talk about it because they believe that, you know, these are important tools and that, potentially, adversaries or criminals might change their behavior if they fully understood how governments were exploiting this kind of data.

And so it's not a very transparent world, and it took almost six years of reporting from the time where I initially got this tip that the Pentagon was buying large amounts of movement data of phones, to now when I've been able to publish a book, and I still don't have a complete picture of exactly all of the ways in which commercial data is flowing to government.

So it's a very difficult world to report on and to penetrate as an outsider.

Jack Goldsmith: Well, you did a very good job of it. Let's turn to the government purchase side. Just tell us what the government buys, to the extent you know it and why it buys it.

What data does it buy and why does it buy it?

Byron Tau: Sure. So, governments buy everything from basic demographic and address information that are sold by traditional data brokers all the way up through some very invasive data sets like geolocation data. These are data sets that are generated by automobiles or by mobile phone apps, are collected by data aggregators or data resellers, and get sold through this byzantine ecosystem and eventually makes its way to government.

Governments are also buying social media data, often from closed forums or semi-closed forums where people are communicating behind paywalls or in forums that require logins. And then of course the big social media companies, there are ways to extract data from them as well, and data brokers are there.

And as I said, increasingly there are, there is interest in acquiring these data sets about wireless base stations or Bluetooth headphones or many other internet of things or other devices that generate logs. There are data brokers that exist to collect them and there are data brokers that exist to sell them to state actors.

Jack Goldsmith: So I couldn't tell from that list. Is all of this stuff metadata or is it both metadata and content? Is it mostly metadata? What—how would you characterize the information?

Byron Tau: I think when you're talking about most of these data sets. I would say they're metadata, with the exception of potentially the social data sets, which obviously include a lot of public content.

Now, most social media sites are not selling their private user messages, so there's not really private content, per se, but there is public, or semi-public or even, you know, some posting that happens in closed groups. Some of that does get sold to the government.

Jack Goldsmith: Okay, so the government's buying up all of this data.

Why? What does it do with the data? Why does it want it?

Byron Tau: Well, it would depend on the government agency and what particular mission they have at any given time. I think broadly speaking, governments are interested in understanding the world, in solving crimes, in doing public safety, and so as data becomes available, as there are data sets that exist out there.

Government entities have begun to buy them for whatever lawful mission they're pursuing. We've seen governments use data sets like geolocation for things like manhunt or solving crimes or, you know, cracking down on unlawful immigration. We've seen the use of social data to do things like derive insights about the Islamic state, or do targeting in some cases for lethal strikes, or at least to inform targeting for lethal strikes.

And so, this kind of data can be very valuable to a number of different government agencies with a wide variety of missions. Everything from the military to the top tier intelligence agencies to the local police departments who all have wildly different missions, but generally find that there is open source data out there and that it's available for purchase.

And in some cases it's actually pretty cheap, relative to a government budget.

Jack Goldsmith: Okay, explain what you mean by open source information that's out there.

Byron Tau: So, generally speaking, open source information is publicly available information that does not require any sort of hacking or legal process to obtain.

Sometimes it's available for sale, but sometimes it's as simple as reading a newspaper or opening a book or opening someone's social media profile. That is all under the umbrella of open source information and governments and private researchers alike have increasingly seen how much power there is in looking at unclassified, publicly available information for insights.

Jack Goldsmith: And this is also the key, I think, the fact that it's publicly available, to why the U.S. government is able to do it. Because under the Constitution and federal statutes and internal policies, I mean intelligence community and FBI policies, commercially available information is generally less regulated than other forms of information that they require.

And that's primarily because it's publicly available information. So publicly available information, there are many fewer hurdles to government collection than other forms of information. So that just, I think in the book somewhere you quoted someone as saying, ‘we can't hack it, but we can buy it,’ or something to that effect.

So it's a way of getting information using the commercial collectors as inter intermediaries, and they can do so largely, I don't think fully, but largely without worrying about legal restrictions.

Byron Tau: That's right. I wouldn't wanna leave your listeners with the impression that there are no rules governing the use of this information inside government.

For example, you're not supposed to look up your spouse or your lover or your neighbors not pursuant to some lawful government mission, but generally speaking, unclassified open source information has a lot fewer restrictions than the classified information that the government uses in more targeted surveillance.

And so, it has become easier to use inside government, easier to give to people who don't necessarily have clearances and easier to share with American partners and allies that we potentially don't have a deep and long intelligence sharing history with. And so, it's become, in some ways the easy button for government agencies to be able to purchase large amounts of this data and share it with people like police officers, who don't necessarily have security clearances, or other countries in some cases.

Jack Goldsmith: The government goes after because it's easy, in terms of legal restrictions, but they also think it's extremely valuable. They've been not been unclear about that. Isn't that right?

Byron Tau: That's right. And I think that's something of a culture shift, because if you look back maybe 20 or some years ago, you had CIA director, George Tenet saying that, you know, the CIA wasn't in the business of doing open source intelligence and that he was only willing to pay for secrets.

But over time that idea, that secret meant better, has eroded because there is so much information in the public domain. And time and time again, governments have found very interesting information embedded in social media photographs, available for sale and commercially available data sets, and available out in the world in not necessarily classified channels.

And so this idea that classified or secret means better information has eroded and governments have moved quickly and enthusiastically to take advantage of all of the ways in which open-source intelligence offers a new way to understand the world.

Jack Goldsmith: And it's not just because there's so much information, it's also because they've developed, and as the private sector has, I assume the government has developed techniques to operate on these data sets that enable it to extract useful information for intelligence or law enforcement purposes, perhaps non-obvious information that they couldn't obtain in any other way, or at least not as easily. Is that right?

Byron Tau: I think that's right. You know, a lot of this is, as I said, cloaked in some level of secrecy, but you do hear stories about how government agencies have figured out how to geolocate people based on, you know, the mountains in the background or the apex of the sun, or things like that.

There's obviously very interesting ways to combine classified data and unclassified data to derive even more insights. And generally speaking, governments have been pretty clever in figuring out ways to exploit open information and use it for whatever mission is important at the time.

Jack Goldsmith: Okay, so the government's doing this on a massive scale. You document that in your book better than anyone has. So what's the problem?

Byron Tau: Well, it's a good question. I think in the United States, government has traditionally protected civil liberties by limiting government power and limiting government intrusions into the affairs of the individual.

But with the increasing amount of information out there, I think that social bargain is being upended a bit by the amount of information available for purchase. And beyond that, I also think that neither the data brokers nor the government agencies are being clear and honest with users and citizens about exactly what they're doing.

For example, users, especially in these geolocation data sets that I'm talking about, are often told that the data is quote, “anonymized” when it's sold and, in fact, there are very simple ways to de-anonymize geolocation data. For example, I'm generally the only person that wakes up at my house and bikes down the National Mall and comes to my office here in Georgetown, right?

So even if my name isn't attached to a geographical data set of Washington, D.C., you can still probably pick me out of a large-scale data set like that.

Second, many of the users at the point of collection of this data by corporations are told that the collection is for corporate purposes or targeted advertising or analytics, when in fact many of these data brokers sell to all sorts of parties, including public sector entities, including intelligence agencies, including law enforcement.

And so the consumer is not adequately being made aware that this is where their data is going and where it is flowing.

Jack Goldsmith: Do you think if they were made aware of it, that anything would change?

Byron Tau: Potentially. It's a good question, but you know, more importantly, I think if your legal basis for the collection of this information is consent or that's part of the legal basis, then I think it is important to genuinely get the consent and buy-in of the people whose data is being collected.

Jack Goldsmith: And in some sense, there is consent. I mean somewhere buried deeply in the computers and sensors, well, not all of them, but in, in many instances, we click on and agree to things, and they have terms of service that say “We can collect data, we can resell data, et cetera.”

But A, nobody reads those contracts and B, I don't think they tell you that they're gonna be selling it to the government.

Is that right?

Byron Tau: I think that's exactly right. That while there potentially might be legal cover for this kind of data collection and sale and the terms of service are written broadly enough that I don't think the average consumer who, even if they read those terms of would understand that there are potentially governments buying this data.

And not just their government, but potentially adversarial foreign governments. And so I don't think the consumer consent has been full, and I don't think it's been fair.

Jack Goldsmith: And the old idea that it's okay for the government to collect publicly available information or at least the origins of that idea, I think, are that if you as an individual disclose information and make it public, that you don't have an expectation of privacy in that data.

And our Fourth Amendment law and much of our statutory law, not all of it, is built upon that assumption. And that's why in a nutshell, simplifying a great deal, there are many fewer legal restrictions on the government collecting this stuff.

But that rule grew up at a time when we didn't have massive data sets, huge, massive data sets on all manner of things that American citizens do, and when it wasn't possible for governments to do things with those data sets that they can do today.

Is that why the publicly available information rationale doesn't work?

Byron Tau: I think that's exactly right, that the Supreme Court articulated the third-party doctrine at the time where we gave very little information to third parties, right? We kept our important papers in our drawers or in our safes at home. And essentially, the doctrine was created around things like banking records and telephone numbers.

But as time has gone on, the amount of data that we give to third parties now is staggering. I certainly think that it's potentially time to reconsider that doctrine, given the sheer amount of information that's out there about Americans.

Jack Goldsmith: Okay, so I see what the prudential problem is, and I see why this practice exploits old understandings of publicly available information, and I see what the potential problem is. But are there actual abuses that you can document?

Byron Tau: Well, you know, one person's abuse is another person's clever cyber collection capability.

So it sort of depends on what you think of as abuses. We've certainly seen examples of this kind of data being used, say, in the criminal context without any mention of it going to the defendant or the defendant's attorneys. So that raises some challenges about what criminal defendants are told about what investigative steps and what tools and techniques governments are using to do, to solve crimes.

Beyond that, there have certainly been U.S. linked data collection efforts that are aimed at particularly vulnerable groups.

So, you know, I do document somewhere in the book that there was a U.S. government linked contractor that seemed to be putting software into predominantly Muslim-themed apps, with the intention of collecting large amounts of data from the Muslim world. And they weren't just targeting the Middle East, they were also targeting, you know, Eastern Europe and other geopolitical hotspots.

But, you know, those kind of targeted collection programs aimed at a certain religion could certainly raise concerns. Finally, you know, I document two incidents about the acquisition of Grindr data, that's a gay-themed dating or hookup app, and in one instance, a U.S. government contractor was able to do a counterintelligence demonstration that acquired large amounts of Grindr data from a data broker that showed location, the movement of a phone, a device.

And he was able to track the movement of government employees around the D.C. area and around the world and could potentially infer things about them, like who they were dating, who they were seeing, where they went when they weren't in a government office space.

And finally, there was the outing of a U.S. Catholic official who was also using Grindr. A Catholic media outlet outed him as a Grindr user. He lost his job with the church for a time. And I do find some circumstantial evidence that one of the people that was pedaling this information was potentially linked to a U.S. National Security Program.

And so there are definitely potential abuses here, or at least concerns about the ways in which governments either are, or could, use this data

Jack Goldsmith: And of course, despite your book, we don't know what we don't know. The public doesn't know what it doesn't know.

Byron Tau: That's right because in general, as I said, both the contractors and the government agencies are not exactly super eager to talk about these tools and techniques. And so, a real public debate about the ways in which this kind of data leaves ordinary citizens vulnerable has sadly been lacking.

Jack Goldsmith: Early in the book, I think, you point out that there's been scant public debate and little oversight of this issue. But, I'm a little skeptical that more sunshine is going to at least bring legislative change. I'll talk about judicial change in a second.

The intelligence community has not really been hiding the fact that it's doing this. There's a website that lists a bunch of intelligence community contracts for, or potential contracts for commercially available information. ODNI, as you know, just published a long report, a self-reflective report, and somewhat critical report, about its commercially available information use.

You've been reporting on this for a long time. Senator Wyden has been screaming about it for ages. I'm just, I've been surprised that it hasn't gotten more traction with the American public. Are you surprised and do you have an explanation for it?

Byron Tau: Well, I think that it's been general knowledge that the U.S. government buys data, but A, I don't think that was the case when I started reporting on it five or six years ago, and B, I don't—

Jack Goldsmith: Well, I agree completely. I agree completely.

You, I think more than anybody, brought this issue to the fore, but you did bring it to the fore.

Now you've written this book and I'm just wondering whether you think, you know, the IC, as you say, there's generally, it's generally known that they do this, and probably more detail now than when you started writing the book, probably because of your reporting.

But I'm just asking about the prospects for anything happening on the legislative or administrative front.

Byron Tau: Yeah, I mean, it's a good question. So, you know, I think, as I say somewhere in the book, no one ever went bankrupt betting on Congress doing nothing. But I do think there has been an increasing amount of attention on these issues from policymakers in the last few years.

I mean, you have seen a bipartisan push among some civil, libertarian-oriented Republicans and Democrats to pass a bill that was initially called the Fourth Amendment is Not for Sale Act that would essentially ban the U.S. government from data on Americans.

You've seen some executive action from the Biden administration recently about stopping flows of data to adversary countries, or what they call countries of concern. So I do believe there is an increasing amount of attention on this issue.

And you know, data privacy issues are hard to get the public interested in. And so, sometimes it takes showing the actual details of exactly how governments are using this data. You know, sometimes it takes characters and anecdotes to bring these stories to life, and that's what I've aimed to do in writing this book.

Jack Goldsmith: So, Byron, have you read the ODNI Commercially Available Information Report?

And did you learn anything from it? What did you think of it?

Byron Tau: I have read the report, and actually the most striking thing to me was how long it was actually withheld from the public. I believe it was finished and not publicly released for 18 months.

And when I got a look at it, it was interesting—it, you know, said some pretty bold things, including the fact that, you know, commercially available information was starting to replicate what was once surveillance that could only be derived from classified techniques.

But the fact that the intelligence community felt the need to withhold this kind of report from the public for so long, I think speaks volumes about the fact that many of these government agencies do not want to have a public conversation about some of the issues raised by government acquisition of this kind of information.

Jack Goldsmith: But the report, I didn't notice that it was delayed that long. I didn't notice that. But the report did suggest that the IC needs to, to some degree, rethink its policies on this stuff, not taking a view on the law, but on its policies.

Byron Tau: Right. I think it did have a recognition that commercially available information, especially when you're talking about data sets, like geolocation or things that show what apps people are putting on their phone, that could potentially, you know, you can potentially derive a lot of information from that, that kind of information is quite sensitive and can reveal a great deal about individuals and that it shouldn't be treated the same as something someone is putting on Twitter or something that you can read in a newspaper.

So I do think that was a very interesting conclusion and one that I look forward to seeing what the intelligence community, and the military, and other public safety entities do in the coming years about exactly that issue.

Jack Goldsmith: Let's talk about the intelligence value side of this stuff. That ODNI report I just mentioned says the following: “Commercially available information is increasingly powerful for intelligence and increasingly sensitive for individual privacy and liberties.” So we talked about the threat to civil liberties and privacy.

The report also says that, I'm quoting again, "Commercially available information is extremely and increasingly valuable and important for the conduct of modern intelligence activity, both as a source of open-source information and to support, enrich, and enable other intelligence disciplines.”

So, it's clear that the IC thinks this is hugely valuable and important.

Can you give us a sense why? We talked about it a little bit, but why are they doing this so much?

Byron Tau: Yeah, I think it's a great question. I mean, I do think commercially available data helps them better understand the world in ways that are easier to share, or easier to fuse with classified data. I also, I can't draw a direct line, but I do have some indication in my reporting that the intelligence community, after Edward Snowden lost some visibility into data streams that they had previously had access to, like being able to see advertising data by tapping fiber optic cables.

And suddenly, you know, a couple years after Snowden, the exact same data becomes available for sale. And so, it's potentially replacing some surveillance capabilities that had gone dark for a period. And, you know, finally, I do think the social norms around sharing information have changed dramatically in the past 10 or 20 years.

And today, people put all sorts of things on social media, including terrorists, including criminals and governments feel the need to be in these social spaces. And be in the networks where people are communicating and planning and traveling and spending money.

Jack Goldsmith: You mentioned the executive order that I believe was issued in February that directed the Justice Department, I believe, to come up with rules about prohibiting the sale or transfer of this data we're talking about to foreign adversaries.

Can you talk about that a little bit?

Byron Tau: Yeah, I think it's an interesting step by the Biden administration because everything that our government can do with data other governments can also do. And so, I think there is an increasing awareness that the amount of data that Americans are generating could potentially be useful for adversary countries and that, potentially as a first step towards stopping countries like China and Russia from obtaining data on American citizens,

that there needs to be new rules to control some of the flow of that information from our fairly free and open society to not so free and open societies that could potentially use that information to track down dissidents, to blackmail individuals, to recruit Americans for foreign intelligence purposes.

And I should also say that, you know, I report on the U.S. government in this book, but you know, that's only because the U.S. government is a fairly open government. And it's absolutely true that China and Russia are doing very similar things. It's just much harder for me as a journalist in Washington D.C. to really penetrate those countries and figure out exactly what they're doing with this kind of data.

Jack Goldsmith: Yeah. The ODNI report that I was referring to a second ago, it said the United States would be at a significant disadvantage vis-a-vis foreign adversaries and foreign competitors if it didn't have access to this data.

And I think it's talking about both the intelligence value of the data. Maybe, I don't know, the ability to use this data to train AI models. And the worry, I think is, and there's just so many competing tradeoffs here.

The worry is that if the United States doesn't have access to this data, but our adversaries do, then we'll just be at a perpetual asymmetric disadvantage for—in all of the realms where big data is important.

And I would suspect that the consequences of the executive order, whatever comes of it, is not gonna change that a whole lot 'cause our competitors can steal the information.

So how do you think about this asymmetry if we crack down on the government from getting this data?

Byron Tau: Yeah, I think it's a completely fair point, right? Because I do understand the criticism from some of the intelligence community to say the Fourth Amendment is Not for Sale Act, which would essentially ban the U.S. government, and only the U.S. government, from acquiring large scale data sets about Americans, when companies like Home Depot or Walmart can use that exact same data to target ads.

So you know, government agencies say, well, our public safety mission is so much more important than selling patio furniture or children's toys, and why can't we have access to these same data streams? That is a reasonable point.

And you know, but the fact is the government can visit consequences on individuals that Home Depot and Walmart cannot. And so it's—it is a double-edged sword.

And you know, how do you balance the government's lawful public safety mission with the privacy interests of Americans? I mean, I think that's one of the oldest questions in intelligence and public safety, and it's one that we're continuing to debate even now.

Jack Goldsmith: I agree, but I was actually trying to ask about a different problem, and that is if the U.S. government can't get access to this bulk data, the commercially available, publicly available information, but say China can, then over time we're gonna be at a disadvantage. A disadvantage in taking advantage of big data for all the reasons we know the big data can be used.

Byron Tau: I think that is a potential and real concern. And you know, it suggests that potentially the way to solve this problem is to, you know, encourage voters and consumers to reduce the amount of data that they generate, to have corporations collect data in a much more privacy-centric way, and to potentially do something like passing a comprehensive privacy law that would affect the large scale flows of data at the collection point and at the transfer points.

Jack Goldsmith: But that just pushes us back to the point we talked about earlier, which is there doesn't seem to be any interest in this country in doing that.

You know, big data continues to grow, I imagine these data brokers in what they do with this data continues to grow. It's not a secret, really, although there's a lot we don't know.

I'm skeptical that privacy legislation is going to crack down in a serious way. You're talking about going after the surveillance capitalism layer as a way of restricting the movement of this data and the aggregation of this data.

But it's so valuable for commercial purposes and Americans, for whatever reason, don't seem to be terribly worried about it on the whole, sometimes they are, and in some context they are, and I'm skeptical of that as a solution.

Byron Tau: I think skepticism is potentially warranted because Europe and California have indeed passed what they call comprehensive privacy legislation, and it hasn't seemed to tremendously impact global data flows.

And so, it's true that there are major regulatory problems here to doing what I'm suggesting, and that potentially that's not, you know, a full-scale solution. But, you know, at the end of the day, I don't have a great answer here. I am describing a phenomenon that's real. And you know, I do think consumers and voters still ultimately have choices and they need to make those choices with as much information as I can provide.

Jack Goldsmith: And I predict, it's not a terribly ambitious prediction, that when reform comes, it will come first from the courts, who in other Fourth Amendment contexts have been increasingly skeptical about the use of large-scale metadata, at least targeted metadata, but still large-scale metadata use in law enforcement.

And I predict that—I don't know how it will happen, whether under the Fourth Amendment or under one of the privacy statutes—but I predict that this different in kind use of publicly available information and the different in kind size of publicly available information will cause the Court to recalibrate what it thinks about, especially the Fourth Amendment, but perhaps also how the privacy statutes work.

And I think that's where—that will be the exogenous event that leads to reform, if there is one. What do you think about that?

Byron Tau: I think that's fair. I think if you look at the Court's logic in a decision like Jones about attaching a GPS tracker to a car, or you look at what the Court said in Carpenter about the totality of someone's movements collected through their cell phone records, it's not a tremendous stretch to apply that same logic that same idea that people have some privacy interest in the totality of their movements to a dataset like commercially available geolocation data.

And I think it will be interesting to see how courts grapple with these issues in the coming years.

Jack Goldsmith: Byron Tau, thank you very much.

Byron Tau: Thank you so much for having me.

[Outro]

Jack Goldsmith: The Lawfare Podcast is produced in cooperation with the Brookings Institution. You can get ad free versions of this and other Lawfare podcast by becoming a Lawfare material supporter at patreon.com/lawfare. You'll also get access to special events and other content available only to supporters. Please rate and review us wherever you get your podcasts.

Look out for our other podcasts, including Rational Security, Chatter, Allies, and the Aftermath, our latest Lawfare Presents podcast series on the government's response to January 6th.

Check out our written work at www.lawfaremedia.org. The podcast is edited by Jen Patja Howell, and your engineer this episode was known Noam Osband of Goat Rodeo. Our music is performed by Sophia Yan.

As always, thank you for listening.