p.21

"The right to be left alone." For many this phrase, made famous by Louis Brandeis, an American Supreme Court justice, captures the essence of a notoriously slippery, but crucial concept. Drawing the boundaries of privacy has always been tricky. Most people have long accepted the need to provide some information about themselves in order to vote, work, shop, pursue a business, socialise or even borrow a library book. But exercising control over who knows what about you has also come to be seen as an eesential feature of a civilised society.

Totalitarian excesses have made "Big Brother" one of the 20th century's most frightening bogeymen. Some right of privacy, however qualified, has been a major difference between democracies and dictatorships. An explicit right to privacy is now enshrined in scores of national constitutions as well as in international human-rights treaties. Without the "right to be left alone", to shut out on occasion the prying eyes and importunities of both government and society, other political and civil liberties seem fragile. Today most people in rich societies assume that, provided they obey the law, they have a right to enjoy privacy whenever it suits them.

They are wrong. Despite a raft of laws, traties and consitutional provisions, privacy has been eroded for decades. This trend is now likely to accelerate sharply. The cause is the same as that which alarmed Brandeis when he first popularised his phrase in an article in 1890: technological change. In his day it was the spread of photography and cheap printing that posed the most immediate threat to privacy. In our day it is the computer. The quantity of information that is now available to governments and companies about individuals would have horrified Brandeis. But the power to gather and disseminate data electronically is growing so fast that it raises an even more unsettling question: in 20 years' time, will there be any privacy left to protect?

Most privacy debates concern media intrusion, which is also what bothered Brandeis. And yet the greatest threat to privacy today comes not from the media, whose antics affect few people, but from the mundane business of recording and collecting an ever-expanding number of everyday transactions. Most people know that information is collected about them, but are not certain how much. Many are puzzled or annoyed by unsolicited junk mail coming through their letter boxes. And yet junk mail is just the visible tip of an information iceberg. The volume of personal data in both commercial and government databases has grown by leaps and bounds in recent years along with advances in computer technology. The United States, perhaps the most computerised society in the world, is leading the way, but other countries are not far behind.

Advances in computing are having a twin effect. They are not only making it possible to collect information that once went largely unrecorded, but are also making it relatively easy to store, analyse and retrieve this information in ways which, until quite recently, were impossible.

Just consider the amount of information already being collected as a matter of routine--anmy spending that involves a credit or bank debit card, most financial transactions, telephone calls, all dealings with national or local government. Supermarkets record every item bing bought by customers who use discount cards. Mobile-phone companies are busy installing equipment that allows them to track the location of anyone who has a phone switched on. Electronic toll-booths and traffic-monitoring systems can record the movement of individual vehicles. Pioneered in Britain, closed-circuit TV cameras now scan increasingly large swathes of urban landscapes in other countries too. The trade in consumer information has hugely expanded in the past ten years. One single company, Acxiom Corporation in Conway, Arkansas, has a database combining public and consumer information that covers 95% of American households. Is there anyone left on the planet who does not know that their use of the Internet is being recorded by somebody, somewhere?

Firms are as interested in their employees as in their customers. A 1997 survey by the American Management Association of 900 large companies found that nearly two-thirds admitted to some form of elec-

p. 22

tronic surveillance of their own workers. Powerful new software makes it easy for bosses to monitor and record not only all telephone conversations, but every key-stroke and e-mail message as well.

Information is power, so it is hardly surprising that governments are as keen as companies to use data-processing technology. They do this for many entirely ligeitimate reasons--tracking benefit claimants, delivering better health care, fighting crime, pursuing terrorists. But it inevitably means more government surveillance.

A controversial law passed in 1994 to aid law enforcement requires telecoms [sic] firms operating in America to install equipment that allows the government to intercept and monitor all telephone and data communications, although disputes between the firms and the FBI have delayed its implementation. Intelligence agencies from America, Britain, Canada, Australia and New Zealand jointly monitor all international satellite-telecommunications traffic via a system called "Echelon" that can pick specific words or phrases from hundreds of thousands of messages.

America, Britain, Canada and Australia are also compiling national DNA databases of convicted of convicted criminals. Many other countries are considering following suit. The idea of DNA databases that cover entire populations is still highly controversial, but those databases would be such a pwerful tool for fighting crime and disease that pressure for their creation seems inevitable. Iceland's parliament has agreed to plan to sell the DNA database of its population to a medical-research firm, a move bitterly opposed by some on privacy grounds.

To each a number

The general public may be only vaguely aware of the mushrooming growth of information-gathering, but when they are offered a glimpse, most people do not like what they see. A survey by America's Federal Trade Commission found that 80% of Americans are worried about what happens to information collected about them. Skirmishes between privacy advocates and those collecting information are occurring with increasing frequency.

This year both Intel and Microsoft have run into a storm of criticism when it was revealed that their products--the chips and software at the heart of most personal computers--transmitted unique identification numbers whenever a personal-computer user logged on to the Internet. Both companies hastily offered software to allow users to turn the identifying numbers off, but their critics maintain that any software fix can be breached. In fact, a growing number of electornic devices and software packages contain identifying numbers to help them interact with each other.

In February an outcry greeted news that Image Data, a small New Hampshire firm, had received finance and technical assistance from the American Secret Service to build a national database of photographs used on drivers' licences. As a first step, the company had already bought the photographs of more than 22m drivers from state governments in South Carolina, Florida and Colorado. Image Data insists that the database, which would allow retailers or police across the country instantly to match a name and photograph, is primarily designed to fight cheque and credit-card fraud. But in response to more than 14,000 e-mail complaints, all three states moved quickly to cancel the sale.

It is always hard to predict the impact of new technology, but there are several developments already on the horizon which, if the recent past is anything to go by, are bound to be used for monitoring of one sort or another. The paraphernalia of snooping, whether legal or not, is becoming both frighteningly sophisticated and easily affordable. Already, tiny microphones are capable of recording whispered conversations from across the street. Conversations can even be monitored from the normally imperciptible vibrations of window glass. Some technologists think that the tiny battlefield reconnaissance drones being developed by the American armed forces will be easy to commercialise. Small video cameras the size of a large wasp may some day be able to fly into a room, attach themselves to a wall or ceiling and record everything that goes on there.

Overt monitoring is likely to grow as well. Intelligent software systems are already able to scan and identify individuals from video images. Combined with the plummeting price and size of cameras, such software should eventually make video surveillance possible almost anywhere, at any time. Street criminals might then be observed and traced with ease.

The burgeoning field of "biometrics" will make possible cheap and fool-proof systems that can identify people from their voices, eyeballs, thumbprints or any other measurable part of their anatomy. That could mean doing away with today's cumbersome array of security passes, tickets and even credit cards. Alternatively, pocket-sized "smart" cards might soon be able to store all of a person's medical or credit history, among other things, together with physical data needed to verify his or her identity.

In a few years' time utilities might be able to monitor the performance of home appliances, sending repairmen or replacements even before they break down. Local supermarkets could check the contents of customers' refrigerators, compiling a shopping list as they run out of supplies of butter, cheese or milk. Or office workers might check up on the children at home from their desktop computers.

But all of these benefits, from better medical care and crime prevention to the more banal delights of the "intelligent" home, come with one obvious drawback--an ever-widening trail of electronic data. Because the cost of storing and analysing the data is also plummeting, almost any action will leave a near-permanent record. However ingeniously information-processing technology is used, what seems certain is that threats to traditional notions of privacy will proliferate.

This prospect provokes a range of responses, none of them entirely adquate:

° More laws. Brandeis' article was a plea for a right to sue for damages against intrusions of privacy. It spawned a burst of privacy statues in America and elsewhere. And yet privacy lawsuits hardly ever succeed, except in France, and even there they are rare. Courts find it almost impossible to pin down a precise enought legal definition of privacy.

America's consumer-credit laws, passed in the 1970s, give individuals the right to examine their credit records and to demand corrections. The European Union has recently gone a lot further. The EU Data Protection directive, which came into force last October, aims to give people control over their data, requiring "unambiguous" consent before a company or agency can process it, and barring the use of the data for any purpose other than that for which it was originally collecteed. Each EU country is pledged to appoint a privacy commissioner to act on behalf of citizens whose rights have been violated. The directive also bars the export of data to countries that do not have comparably stringent protections.

Most EU countries have yet to pass the domestic laws needed to implement the directive, so it is difficult to say how it will work in practice. But the Americans view it

p. 23

as Draconian, and a trade row has blown up about the EU's threat to stop data exports to the United States. A compromise may be reached that enables American firms to follow voluntary guidelines; but that merely could create a big loophole. If, on the other hand, the EU insists on barring data exports, not only might a trade war be started but also the development of electronic commerce in Europe could come screeching to a complete halt, inflicting a huge cost on the EU's economy.

In any case, it is far from clear what effect the new law will have even in Europe. More products or services may have to be offered with the kind of legalistic bumf that is now attached to computer software. But, as with software, most consumers are likely to sign without reading it. The new law may give individuals a valuable tool to fight against some of the worst abuses, rather on the pattern of consumer-credit laws. But, aslso as with those laws--and, indeed, with government freedom of information laws in general--individuals will have to be determined and persistent to exercise their rights. Corporate and government officials can often find ways to delay or evade individual requests for information. Policing the rising tide of data collection and trading is probably beyond the capability of any government without a crackdown so massive that it could stop the new information economy in its tracks.

• Market solutions. The Americans generally prefer to rely on self-regulation and market pressures. yet so far, self-regulation has failed abysmally. A Federal Trade Commission survey of 1,400 American Internet sites last year found that only 2% had posted a privacy policy in line with that advocated by the commission, although more have probably done so since, not least in response to increased concern over privacy. Studies of members of America's Direct Marketing Association by independent researchers have found that more than half did not abide even by the association's most modest guidelines.

If consumers were to become more alarmed about privacy, however, market solutions could offer some protection. The Internet, the frontline of the privacy battlefield, has already spawned anonymous remailers, firms that forward e-mail stripped of any identifying information. One website (www.anonymizer.com) offers anonymous Internet browsing. Electronic digital cash, for use on or off the internet, may eventually provide some anonymity but, like today's physical cash, it will probably be used only for smaller purchases.

• Enter the infomediary

John Hagel and Marc Singer of McKensey, a management consulting firm, believe that from such services will emerge "infomediaries", firms that become brokers of information between consumers and other companies, giving consumers privacy protection and also earning them some revenue for the information they are willing to release about themselves. If consumers were willing to pay for such brokerage, infomediaries might succeed on the Internet. Such firms would have the strongest possible stake in maintaining their reputation for privacy protection. But it is hard to imagine them thriving unless consumers are willing to funnel every transaction they make through a single infomediary. Even if this is possible--which is unclear--many consumers may not want to rely so much on a single firm. Most, for example, already have more than one credit card.

In the meantime, many companies already declare that they will not sell information they collect about customers. But many others find it more profitable not to make--or keep--this pledge. Consumers who want privacy must be ever vigilant, which is more than most can manage. Even those companies which advertise that they will not sell information do not promise not to buy it. They almost certainly know more about their customers than their customers realise. And in any case, market solutions, including infomediaries, are unlikely to be able to deal with growing government databases or increased surveillance in public areas.

• Technology. The Internet has spawned a fierce war between fans of encryption and governments, especially America's, which argue that they must have access to the keys to software codes used on the web in the interests of law enforcement. This quarrel has been rumbling for years. But given the easy availability of increasingly complex codes, governments may just have to accept defeat, which would provide more privacy not just for innocent web users, but for criminals as well. Yet even encryption will only serve to restore to Internet users the level of privacy that most people have assumed they now enjoy in traditional (ie, paper) mail.

Away from the web, the technological race between snoopers and anti-snoopers will also undoubtedly continue. But technology can only ever be a partial answer. Privacy will be reduced not only by government or private snooping, but by the constant recording of all sorts of information that individuals must provide to receive products or benefits--which is as true on as off the Internet.

• Transparency. Despairing of efforts to protect privacy in the face of the approaching technological deluge, David Brin, an American physicist and science-fiction writer proposes a radical alternative--its complete abolition. In his book The Transparent Society (Addison-Wesley, $25) he argues that in future the rich and powerful--and most ominously of all, governments--will derive the greatest benefit from privacy protection, rather than ordinary people. Instead, says Mr. Brin, a clear, simple rule should be adopted: everyone should have access to all information. Images from the video-surveillance cameras on city streets should be accessible to everyone, not just the police.

The idea sounds disconcerting, he admits. But he argues that privacy is doomed in any case. Transparency would enable people to know who knows what about them, and for the ruled to keep an eye on their rulers. Video cameras would record not only criminals, but also abusive policemen. Corporate chiefs would know that information about themselves is as freely available as it is about their customers or workers. Simple deterrence would then encourage restraint in information gathering--and maybe even more courtesy.

Yet Mr. Brin does not explain what would happen to transparencyviolators or whether there would be any limits. What about national-security data or trade secrets? Police or medical files? Criminals might find these of great interest. What is more, transparency would be just as difficult to enforce legally as privacy protection is now. Indeed, the very idea of making privacy into a crime seems outlandish.

There is unlikely to be a single answer to the dilemma posed by the conflict between privacy and the growing power of information technology. But unless society collectively turns away from the benefits that technology can offer--surely the most unlikely outcome of all--privacy debates are likely to becomeever more intense. In the brave new world of the information age, the right to be left alone is certain to come under siege as never before.

Click here for related Economist article on p. 15