Cambridge Analytica & Data Privacy
This week our guest is David Carroll, a professor of media design at the New School in New York City who gained worldwide renown when he decided to engage in a legal battle with the Cambridge Analytica. For those who may not know, Cambridge Analytica was involved in a massive data scandal using Facebook data to manipulate voters into voting for Donald Trump and Brexit. In this conversation, we explore David’s battle against Cambridge Analytica from start to finish, attempting to go beyond the details captured in the documentary that was made about his fight, The Great Hack. We additionally discuss the current and future dynamics of data privacy and protection, including the often overlooked risks and the potential legislation that could drastically change humanity’s relationship with data.
Follow David at twitter.com/profcarroll
**
Host: Steven Parton - LinkedIn / Twitter
Music by: Amine el Filali
Transcription
David Carroll [00:00:00] A lot of people are only understand Cambridge Analytica as a Facebook privacy scandal. But that company was itself provably intermingled with defense contracting and the military industrial complex, basically. So the porous boundaries between the kind of war on terror, fighting hearts and minds and our own elections had been breached.
Steven Parton [00:00:43] Hello everyone. My name is Steven Parton and you are listening to the feedback loop on Singularity Radio. This week our guest is David Carroll, a professor of media design at the New School in New York City who gained worldwide renown when he decided to engage in a legal battle with the powerful entity known as Cambridge Analytica. For those of you who may not know, Cambridge Analytica was involved in a massive data scandal that involved using Facebook data to manipulate voters into voting for Donald Trump and Brexit. In this episode, we explored David's battle against Cambridge Analytica from start to finish, attempting to go beyond the details captured in the documentary about David's fight The Great Hack, which can be seen on Netflix still to this day. We go on to discuss many other aspects of data privacy and protection, including things like the often overlooked risks that are involved and some of the potential legislation that is currently underway or that might come down the line in the future that could change humanity's relationship with data. So without further ado, let's just jump into it. Everyone, please welcome to the feedback loop. David. Carol. What I think is a really interesting place to start with you in particular is how an associate professor of media design in New York ends up doing battle against a company in UK. That seems like quite an origin story. So what I would love is if you could just tell us a bit about yourself and how you went from, you know, that background to ending up in this pretty incredible situation that you found yourself in.
David Carroll [00:02:28] Sure. Yeah. It might not seem obvious on the surface, and certainly now I might say, well, why didn't I pursue a law degree? But hindsight is always 2020, so. But yeah, it's, it's prior primarily for working within and around the digital space, you know, since it started at the turn of the 21st century and watched it evolve into what it was and was sort of in the right place at the right time to be poking around in the dark corners because of just that history of just being born at the right time and being, you know, observant, but also from my profession that it was involving teaching students who are trying to get into these industries. So trying to figure them out so that we can even teach them. Also, my own practice in them working either for clients or more much more recently, you know, as a failed entrepreneur trying to do a tech company out of commercializing academic research. So also kind of knowing how the sausage was made and knowing the industry as somebody who actually did try to make something and so, you know, met all of the personalities that are operating in the space. And and then also was somebody on social media, especially after the startup failed. And I increase my critical view of things that I was kind of strident in views about the industry ahead of time, especially related to issues around privacy. And I made a strong connection early on between the trending of people installing ad blockers to also kind of privacy anxiety. Not just that ads are annoying. And by having a straight an opinion like that, I attracted the interest of people in Europe and they were sort of looking for are there any Americans who who are worried about this stuff like we are? And so they found me that way. And in particular, Paul Olivier, who is credited for kind of recruiting me to do the the sort of big test, the hypothesis that we proved by doing the data request that then led to the legal challenge, it was all about figuring out would the application of European data protection law have a a relevance to the 2016 presidential election? And the answer was yes. And it was incredibly easy to prove that. So in the purest form, it was just scholarly research and academic discovery and performing experiments and seeing what would happen.
Steven Parton [00:05:36] So could you talk a little bit then about what Cambridge Analytica was actually doing for people who might not know? Could you just talk a little bit about what kind of data they were collecting, how they were collecting it, and why it was such a concern for you?
David Carroll [00:05:52] Sure. Well, based on the knowledge that I figured out more recently, like, you know, in the lead up to the 2020 presidential election, when the 2016 database was leaked to the UK press and then UK journalists approached me with my actual file, the one that the, the regulator and the legal process was not able to extract and was the legal. Well, it was the data set that we always knew was there. So it was very interesting to then get the chance to look at it and confirm our suspicions. So, yes, it was a typical voter profile enriched with data broker information. So it really was a window into how voter files are routinely enriched with data broker data, and then what was in there. And then the supplemental things that were unique in this case were a psychological profile score. So all registered voters had a profile, had a psychological profile in their file in the RNC database. It wasn't just the 87 million people who the headlines shouted that were the victims because they had their Facebook data collected and sold to Cambridge Analytica by a developer who then used it in different ways in the 2016 campaign. Both the presidential campaign of Trump, but also other candidates and other PACs and super PACs. So the the the the reality is that the. Unlawful and in illicit. Harvesting and selling of Facebook data created a controversy that then. It sort of soiled the integrity of the RNC data operation. And the evidence that we finally saw at the end when it was leaked was that, yes, you know, they they used a model to model all voters. And so in the end. All voters were actually victims of a data crime, at least according to UK law at the time, which we proved because the regulator was able to criminally prosecute the company while in administration for ignoring the order to fully disclose the data. And the regulator also said in published reports that that the company would have been fined for violating principle one of the UK Data Protection Act for unlawfully creating political profiles of people without their knowledge or consent or associated rights. And the only reason why they were not fully prosecuted for that was because they were protected by the moratorium. That kicks in when you file for insolvency and bankruptcy. And indeed, the only thing that they were able to extract out of the company was this very particular enforcement notice problem which was allowed by the insolvency judge. So sort of so you get squeaked in at the last moment. So a lot of people only understand Cambridge Analytica as a Facebook privacy scandal. But I've you know, for me, it's much larger than that. It's that to me is just the sort of thing that got people emotionally invested in the story. But it really speaks to the reality that, you know, in previous election cycles, our data was transferred and transmitted outside of the borders of the United States. So we had this internationalization of the voter data industry and that that company was itself easily, provably intermingled with defense contracting and the military industrial complex, basically. So the porous boundaries between the kind of war on terror, fighting hearts and minds and our own elections had been breached. So those were the higher order issues that really animated my behavior and my interest in it, because I saw that the industry had gone international, which I thought should be domestic. Like, shouldn't our election data companies be domestic operations? Like, isn't that kind of intrinsic to what we want the democratic business to be constrained by? But it wasn't. And that was very disturbing to me just on a sort of level of, wait a minute, why are we industrializing election meddling? Why are we making a business out of out of people interfering in each other's elections? That just that alone was like, whoa, whoa. So I think in the larger story, when more general audiences got to see the bigger story and look beyond just Facebook privacy issues, I think that people saw a larger. Narrative that had bigger stakes and was much more than like who you took my Facebook likes. So I think but it was a it's a complicated story and. Is still not well understood.
Steven Parton [00:11:42] Do you think that this is happening with other countries that don't have these same kind of laws in place? Because as you were talking there, I kept kind of jumping to tick tock and China and Russia and the stuff that they did with like Facebook groups and their disinformation. You know what I mean? Do you think that this is going on probably from other countries at the same time and there's just no real law or accountability for us to, you know, keep things in check.
David Carroll [00:12:09] Well, I think that the larger concern over data sovereignty, that is, and data localization, that is where is the data physically living and located on the earth and how does that intertwine with local laws and jurisdictions and political? Geopolitical elements. So in the case of Europe, this has played out significantly with regards to, for example, the recent executive order by President Biden to restore the free flow of data between just the United States and the European Union, which had been destabilized by lawsuits and a shattering of treaties so that the international flow of data and the way that that is an expression of geopolitical issues, you know, is more and more clear for us now. So when it comes to Russia's local regulator using data localization as an instrument of the state to quash political dissent and other measures of control, we can see that mechanism being used and we can see the controversies that surround Bytedance and Tik Tok, because the boundaries between data flows between Beijing and the Western world are also not adequately understood and regulated and there's not enough confidence in it. That's why there's a fierce investigation into it, but there are some intrinsic anxieties about data flows. And to the question about, you know, what's still happening, I mean. In the United States, we don't have the basic universal right to access our own data. And so the only reason why I was able to investigate Cambridge Analytica was because of the weirdness that that Steve Bannon transferred it outside of our country into a country that had data protection laws and a regime. And so if he had kept it in the United States, then I would have had no recourse. And it was the weirdness that had left our country. So it highlights that we ourselves have not granted ourselves the rights that our peers across the Atlantic have. Mm hmm. And the exception to that are states here like California in the aftermath of Cambridge Analytica, gave Californians this right. And since three other states have passed state laws, which at their baseline, you know, create this right of access, the right to get your own data, which which does not exist and lets it unless it's enumerated. And so the enumeration of these basic access rights and then the other related rights, we're just getting started here in, in, in enshrining that and then we have to figure out how to enforce it. And the Cambridge Analytica fiasco demonstrated how difficult it is to enforce it.
Steven Parton [00:15:24] Yeah, well, for you, how long did it take from onset to getting some kind of conclusion to really go through the process of saying, I'd like my data and, you know, then get into solvency?
David Carroll [00:15:38] So we made the request even before Trump was inaugurated in early January 2017, and then they responded just within the at the time to the deadline to respond. So they responded in March. And then immediately the disclosure indicated the proof of our basic hypotheses and then also the new basis to then challenge and contested. And so that process began immediately. But then it took quite a bit of time to build the legal case and file the relevant complaints. And interestingly, ironically, unfortunately, depending on how you look, the day that I served Cambridge Analytica with its lawsuit papers, when the process server showed up to that their headquarters that night. Facebook tried to and run front run. I mean, the scandal that unleashed that weekend when The Guardian and The New York Times collaborated on the whistleblower story with Christopher Wylie, which is sort of known as the moment when the story became more than a back burner kind of scandal, but then became this international scandal. And so it was that moment that then the company then had a basis to then say, Well, we're losing all our clients, so we have to file for bankruptcy. So I never got the chance to advance the data protection case, which I was told was a slam dunk and was easy to get the best barristers in London to argue for on their equivalent of pro bono. And so then. So then it became a really complicated bankruptcy insolvency case and one that I continued to have to go for. And but it was a much higher stakes, much less assured win, much more of a moonshot. And of course, I lost. And then I was on the hook for a significant adverse cost, which was always the risk in taking on a case in Europe in a parliamentary system, which was, you know, just a legal system for the aristocracy. So you it's so not the same kind that we have here. So but luckily I did crowdfunding to to insure against that outcome. And it was the kind of case where you could raise an insurance policy against this outcome because people were invested in it on a on a personal basis like they were they saw what was at stake and they were willing to even, you know, pay a donation to the cause. And that saved my. But in the end.
Steven Parton [00:18:42] I'm glad that didn't come back to bite you. Can you talk a little bit about what did happen with California and some of the other states that you mentioned before? Do you know kind of what laws they put in the books?
David Carroll [00:18:55] Sure. So, you know, shortly after GDPR became enforced. So it was interesting in the timing back in 2018, that spring, you know, in March, we had this big scandal and then like two months later, GDPR came into effect just because it was scheduled to. And so the idea of data was in everyone's mind, as all of a sudden this new thing appeared for everyone around the world. You didn't even have to be living in Europe to have this sort of show up in your inbox. So. So, yeah, it was in the mind of people. And in California, a real estate developer was at a barbecue and was chatting up with a Google employee who was just like TMI about what Google can do. And it really got this guy whose name is Al Alister Taggart all riled up, and he committed to instigating a political movement in California, exploiting California's ballot measure system where there was a significant ballot measure. Writing on the privacy anxiety of Cambridge Analytica to pass a California privacy law, the California Consumer Privacy Act. And it gained so much momentum because privacy is one of those things where if you ask people, do you want it? They say yes. And despite their behavior, despite their other, it's a very and it's also quite bipartisan, too. So so the put tremendous pressure on Sacramento to act and and that's kind of why we have the situation where the home of Silicon Valley is the first state to regulate its own business. It really was the dynamic of the ballot measure forcing Sacramento to come up with something that is still quite a strong law in a land that has none, and then that caused some copycat states which. So Virginia was next, a much more industry friendly privacy law. But but had some of the basic fundamentals the same. And then Utah came next. Then Colorado came next with something better than Virginia. And then Utah became something even more industry friendly. And then Connecticut has been most recently with something strong but not as strong as California. So and then radically oversimplifying all that, because the real story is that a patchwork of not necessarily equivalent and contradictory privacy law is already emerging and that's making industry nervous. Because as you might imagine, industry would prefer a standard. And what is the standard, especially in this global context of data sovereignty, data localization, transnational data flow treaties getting smashed around. It creates a lot of uncertainty at the global level, and then now you have it at the local level. Businesses are like, what is happening? So in the in the backdrop against California passing, it's not only passing version one of its consumer privacy law, but actually even passing version to the CPRA, the California Privacy Rights Act. They've already iterated that. That's also very Californian, too, to to iterate products fast based on market response. They're already on version two of their privacy law and so. It has gotten Washington, D.C. to get its act together. And remarkably, a federal privacy law. The American Data Privacy and Protections Act made it out of committee the first time such thing made it out of committee ever. But that was there's almost no optimism among privacy, regulation and policy observers that it will come up for a vote. And it is not on the agenda and. The reason is not because it's a Democrat versus Republican issue. On the contrary, it came out of a bipartisan committee with bipartisan support. It's Democrats versus Democrats. It's really California and Washington, Democrats versus the rest of the party, because, unsurprisingly, California does not want its laws to be preempted by a national one. And even Washington lawmakers like Senator Cantwell and. So it's Senator Cantwell and Senator Widen. Who? Our senators from the West Coast who also want something much stronger. So for wider and you know he's also floated a bill called the Fourth Amendment is not for sale act strongly concerned with the problem that law enforcement and the military and federal government can get around the Fourth Amendment simply by buying data from data brokers on the open market. Just what Cambridge Analytica did, that the free flow of data on the open market is completely unrestricted. So, you know, we have a party currently that has control of these legislative levers that is at odds with itself of related to matters of federalism, that that will we have a patchwork of state innovation where the laboratory of law is most agile, or will we have a national standard that is much more conducive to the practice of the free enterprise? I don't know. So that that's playing out right now in a very vigorous way. And then you also have like, how strong can we get it? Many people argue that add, as you pronounce it, the American Data Protection and Privacy Act is potentially stronger than the European general data privacy, general data regulation. So it's it's a pretty interesting time to see how much has changed in five years where prior to Cambridge Analytica, it would be inconceivable to imagine California passing a privacy law, let alone. A bipartisan one getting out of committee. Yeah. In Washington, D.C..
Steven Parton [00:25:23] Does California's law, what does it stipulate? Is it kind of something similar to what you did where people can request their data? Does it say that they companies in California specifically can't collect that kind of data? You know, the challenge with a lot of things like this is that it's all based about where the company is and then how that affects the people using that product outside of those borders, outside of that state border. So what's what are some of the kind of stipulations of the California law?
David Carroll [00:25:52] Mm hmm. Yeah. Residency seems to be a key element to. Both for the subject of what we call in and data protection policy wonk parlance, the the user, the person, the citizen is called the subject. And the entity that has data is called the data controller. And so. And these this language is being adopted in the United States. So the idea is in California, if you're a data subject, meaning you're a resident of California, then you may then you can exert your Californian rights as a resident, and particularly if it's a business that does business in California, a source headquartered there, especially, I mean, the the attorney general of California enforces the law there and increasingly by a new data protection authority. So California will be the first state to have its own dedicated privacy regulator. So it's a evolving target as to how it gets enforced and who's enforcing it and what are the stakes. But the first California Privacy Act settlement has just happened. And the company the first company is Sephora. The cosmetics retailer, which ironically, is a French company. And they violated various things related to the California Consumer Privacy Act, namely things like not letting people opt out properly and not having proper notice. I mean, a lot of like kind of simple annoying things. But the interesting thing about these laws is they're actually quite deferential to business because they give businesses ample opportunity to solve problems from complaints before any sort of real action occurs. Just calling a curing period where basically a complaint goes in, they say this is legitimate, this is a legitimate problem. You guys are in the wrong here. You can fix it. No questions asked, no slap. And there is nothing. Just like get out of jail. Free card is built into the law. So far it didn't take advantage of that. So then they got nailed and so then they had to settle. So I think I hope companies will take it seriously. The first company is one that said this is not and they're not really done yet yet. They will if you want to act like that. So. So I think it was an interesting first example of as if you're if you're if you find that these new regulations as an entrepreneur are terrifying, it's going to make lawyers lots of money. It's going to be all this new red tape and so on. They really don't know how to enforce this yet. And there really are. Get out of jail free cards embedded in these laws. You just have to look for them.
Steven Parton [00:28:47] Yeah. This might seem like an obvious question, but I'd love to hear you kind of wax philosophical about it to people who might challenge that there is not anything particularly unique about data collection. And, you know, the way we're advertising now compared to, you know, how advertising on TV or in newspapers. What would you say to that? I mean, people might just say, hey, you know, this is what's always happened. They've always gathered information. They've used census data. They they always poll, they do surveys. Why is now different than before?
David Carroll [00:29:23] Sure. Yes. So these issues of communication and persuasion and propaganda have always existed and will persist and continue to exist. And then in many ways, they're not new issues or concerns. But of course, technology and the data supply chain has evolved profoundly. And of course, also the fundamental unit of media production has fundamentally changed in that in the 20th century, you had a set of a set of singular voices that dominated and had supremacy over the communications landscape. And the 21st Century, characterized by the digital revolution, collapsed that singular need to have a central communications authority because the the cost of of producing media and disseminated it had fundamentally shifted. So indeed, the shift towards the individual has been the pronounced shift. And so it is not only that the individual is micro targeted with unique communications that have been detailed and constructed just for them has really changed the dynamic that mass communication has shifted to hyper personalized communication, and it's a different beast altogether. So one of the things that disturbed people about the 2016 election in the context of Cambridge Analytica is that people could be targeted ads that no one else could see. So mass media, we can all look at the same thing because it's all being targeted like a Super Bowl ad is. There's going to all the millions of people at once. We're all seeing the same thing. When communications is no longer a shared experience, but actually hyper individualized, then this sort of like the visibility into it has as it may become opaque. So this was the main reason why, for example, Facebook deployed what it calls the ads library, which allows civil society to go in and look at political campaign ads and see all of the ads that are running and who and and get visibility into what is otherwise targeted. So that's a one little example of that. But as we individualize communications, it becomes opaque to the rest of society, which is itself a risk that has to be mitigated. The other problem is then related to that is it allows the targeting of false information quite efficiently. And we see an example that is really disturbing in the aftermath of 2016, where when you combine data profiles that can be misused. So for example, we know that the 2016 Trump database had data points for ethnicity and race, and then we know that there were deterrence campaigns in battleground districts and when the UK. When the U.K. broadcaster, Channel Four got a hold of the leaked database and they went to voters, for example, a black woman in Milwaukee, Wisconsin, and showed her her her voter profile, which was all accurate to her, and showed that she was marked for deterrence by seeing that it made her response was, well, this makes me want to vote even more. So in that way, the visibility into these profiles can be a neutralizing force to their abuse of power. Because we know that that when you target people, you can target with information that is abusive and false. So we know that, for example, Cambridge Analytica, when working for super PACs, created misleading video clips and then targeted them to African-American voters. In particular, a video clip of a speech by Michelle Obama where she makes this quip where she says, if you can't run your own house, you can't run the White House. And she is self deaf in the larger context, she's self-deprecatingly referring to herself. But Cambridge Analytica put a simple caption over the the clip, saying that she was referring to Hillary Clinton, which was false. And that clip was then micro-targeting to black voters in battleground districts marked for the deterrence campaign. So there we have like the data that's supposed to belong to the republic, the voter rolls and data that is circulating freely in the free market, the data brokerage. And then, you know, even things that can be deduced or inferred accurately, such as race and ethnicity, then abused, you know, in what is arguably an anti-democratic, unethical, immoral manner and then used to spread false information to degrade the the, you know, in demobilize participation in democracy. You can see that the same tool used to motivate people and motivate mobilize people and get people involved and build a better society can be used for the opposite effect. It just made it just as a matter of how it's precisely deployed. Unfortunately, it there is no. Simplistic way to to say it's it's beneficial or harmful.
Steven Parton [00:35:15] Well, yeah. And I was thinking at one point in the documentary, Brittany Kaiser talks about the classification of psychographics as a weapon. And I don't think you get to actually see too much of your response to that. There's a moment of shock. But then I think the the documentary just kind of goes on. But. What do you think about that idea of psychographics as a weapon, as a classified, as a weapon? Does that seem valid and fair to you?
David Carroll [00:35:41] So in learning more about, you know, what that particular thing that she's referring to of it is back to what I was describing as these companies in the wake of 911, developed psychological warfare tactics. And there was a incentive to classify them for export control so that those companies could get contracts with entities such as the British government and the US State Department. So the system itself incentivizes incentivized. A company like the parent company of Cambridge Analytica, SCL, to develop, you know, a methodology that then could be export controlled because then that helps them get contracts. And then they were saying, well, if we didn't renew this application for export control and then we could use the same methodology and technology for civil society and elections. So that's the context of like what Brittany is reading and react to and responding to. And also, you know, highlights this porous boundary that, you know, what you can use for advertising, you can use for news, skin creams, ski vacations. Islamic extremism and fomenting, you know, political division in an election that that that it's the same infrastructure is there and the same tools are there. It just depends how you use it. And that's what was interesting about the story. And and it was just a matter of how it's classified and deployed and used in any particular industrial sector.
Steven Parton [00:37:26] Do you see this stuff changing as we move forward? I mean, do you see these trends correcting themselves then with all this attention that is coming to light, some of the changes that you've talked about in different states, even at the federal level in the United States, does it seem like some of the issues that initially concerned you.
David Carroll [00:37:46] Are.
Steven Parton [00:37:47] Really gaining traction, that the solutions are gaining traction?
David Carroll [00:37:53] Yes and no. I mean, a mix of things. I mean, so, yes, it's been. I guess. I hope that. We have interrupted the trend towards an internationalized voter analytics industry. And yes, I hope that there's greater awareness that we need to firewall more of these industries so that we have cleaner separation between the way we use these tools on society for different purposes and cross-functional uses can be really problematic, even though it can make for a good business model. Mm hmm. And but then I think, you know, we've also seen the struggle that the platforms have had themselves in responding to these crises. So, you know, if we if we if we take a if I if I take a really kind of cynical, honest assessment of, for example, where the platforms are right now, you know, it seems like Mark Zuckerberg is now is no longer interested in. The Blue app. And he is. He wants to make a new thing that he can move beyond the ghosts that haunt him. And he's really fighting. And he wants to build that. He wants to build, you know, his mat metaverse that nobody's visiting. And he's really fighting against Tic TAC. And and that's a sort of a current dynamic that's shifting things. And then meanwhile, we're watching Elon Musk purchase Twitter and Kanye West purchase Parler and a sort of fragmentation on political grounds of. Of these platforms themselves. And the politics, the the the political problems of technology that erupted five years ago, you know, are still animating the discourse in different ways and still like roiling the how people are confronting these issues that, you know, and of course, the January six insurrection occurred, you know, between these moments, too, and and the pandemic and and the Dobbs decision and and all these things like are indistinctly connected to both the political divisions, but also the question of privacy. You know, that it couldn't be more bleak with regards to the fall of Roe. That personal autonomy is directly connected to whether or not those rights are enumerated in the Constitution. And so the enumeration of rights is something that we're we have to really be considering now. So that's why I think the discussions around privacy at the federal, state or wherever. Ah, interesting, because we are trying to enumerate basic rates that could help us better adapt to the impact of these technologies. That that, that for me, the simple right of access is a is a is a little window that could give us visibility to create a better balance, to advocate for fairness, to reduce harm, to create more equity, and to go against to sort of counteract the built in incentives which can be, you know, inherently harmful. So to me. The first step is, can we even see? And then if we can see, what could we do? And there's a lot of work to do to just be able to see. And as we move, you know, increasingly towards algorithms and large learning set models, and we are you know, we're now we're moving beyond like does a platform like these, a platform responsible for these things. We're getting to the point where. An indeterminate code base that nobody even owns is responsible. And who do you even sue? Yeah.
Steven Parton [00:42:04] Well, it seems crazy to me to, you know, I'm not the first to think of this at this point, but, you know, I do social science research. And if you talk about where you could get the best data for that, it's going to be at a place like Facebook. And it's kind of just insane to me that the biggest laboratory for understanding the human condition right now is not is not accessible to our our more altruistic researchers, to our, you know, nonprofits, to our government. It's in the hands of a company that's just selling our data. And it's like that's such not only is that just a travesty for humanity that we don't have that information to help better our society. But it's also really dangerous.
David Carroll [00:42:53] Yeah. And it's and it's, it's funny to hear people in the digital humanities and social sciences and related fields, science and technology studies, etc., etc., like talk about how, you know, Twitter causes the fruit fly problem that that because Twitter data is so easily accessible and study able it studied like fruit flies are so that we have this bias towards studying Twitter that's disproportionate to its impact just like we know too much about fruit flies because they're easy justice to study. So so yeah. And indeed, the Cambridge Analytica fiasco dramatically affected the position of Facebook with regards to research data because at its core. It was a scandal around the misappropriation of academic research and commercialization, that it was the improper management of. The boundaries between research for academia and research for a commercial entity, and that that itself was mixed boundary between defense contracting and working in elections, that that the firewalls between data collection within academia had become too porous. It was a wake up call for academia itself. I'm afraid to say that we are punished from our own. Recklessness that even the storied halls of Cambridge University were implicated in the scandal here, that it took some mistakes being made by academic researchers to realize, you know, where we can go wrong. So hopefully, chastened by this, we can develop more responsible ways to do these kinds of studies and certainly innovations with privacy, protecting technologies, whether that be differential privacy in the immediate scope of things. But down the road, potentially homomorphic encryption has a long way to go, but certainly there are some. Interesting advancements in the near term that we could get to responsible data use by researchers that are that's also part privacy protecting. Yeah but but it's it's really difficult because privacy itself is a power differential. So the question is privacy. Who has it? And who'd who'd. Who doesn't? And. And that's that's what we're ultimately negotiating when we try to do research with the public's data.
Steven Parton [00:45:47] What I was thinking I'd love to hear from you about is, is having ownership of your data a human right at this point. And at the same time, I'm thinking how tragic it is that we're all in this kind of fragmented society where we all live in our own reality tunnels based on the different information that we're being sold. And I'm thinking as soon as we give people ownership of their data, they're just going to sell it back to these companies because they're incentivized to make money in this economy in many ways. And then we're just going to end up in the same place. So there's many levels of a question there, I suppose. But, you know, do you think from what you've seen of your students, do people over the years, do people seem to actually care about what's done with their data? Do you think if we did give ownership of our data back to people, that we wouldn't just end up in the same place?
David Carroll [00:46:38] Yeah, it's a great question. And I think so. The first thing is, is it a human right? Well, only for some people. So, for example, the largest economic bloc in the world, the European Union, those people who live there do enjoy data protection as a fundamental human right. And it's inscribed in their founding documents. And it's just a matter of how it gets enforced in this society. Now, as I described before, some people in some states are starting to in the United States are starting to enjoy some aspects of it as a human right in what we might say, a civil right. And and so is it is it effective as a tool of accountability and transparency and to equalize the power differential that privacy or otherwise causes? And then the question is, are you really owning your data when you retrieve it? And I would say you're not. You're just it's a claw back at best, but it's not really ownership because there are many copies of data and all you're doing is clawing back one aspect of it. But you or you have no exclusive rights to all the copies of the data. There's no way to claw back at all. There's no way to to to seize total control of your data, with which it could then become a scarce resource to then have any value on its own possible, which I think is the fundamental philosophical flaw with the idea that you can sell your data because it's not a scarce asset. It's and it's it has no scarcity to it at all, even if you try to exert all this power to claw back. And then, of course, data itself is has a half life. You know, it has an expiration date of shelf life. The data on you is out there now, but in ten years it's worthless because it's no longer that relevant to you. So that's a factor that makes it difficult to make it a valuable asset on an individual level as well. And then, of course, it's it's we don't have a retail. Economy for data. We only have a wholesale did. The data supply chain is exclusively a wholesale market and we are bought and sold as wholesale only. We are only valuable in aggregate as audiences, as segmentations, as collections of of of vectors, of behavior, predictions, proxies of attention. It's also abstract and traded derivative and so on. This idea that it's we are invaluable as an individual is hilarious because we really aren't and we don't want to be told that or admit that or really feel that. But it's true. If anything, it's just pennies or the closest we are seeing now to a price tag on our personal data is something I've been noticing potentially happening in Europe of all places. In Germany, some people are some companies, publishers are trying to work around the GDPR in a loophole and make it so that if you decline cookies, you will have to pay extra. So kind of a fee to say no to the cookie consent. And that's really putting a price tag then on how you are priced as a wholesale item in the market, or at least that's how you're getting retailed from whatever you're worth at the wholesale. So we are seeing some ways that personal data is getting put a price tag on. We're also seeing it in in legal cases. So in Illinois, one state that has a really strong biometric privacy law, the Biomet deal, Illinois Biometric Information Privacy Act, or beeper. There was a Facebook lawsuit and settlement and residents of Illinois were eligible for settlements for Facebook illegally using their facial recognition scans. And it was lots of money. It was in some people got up to $600. So and then, of course, you could say my Cambridge Analytica story is an example of the elasticity of the cost of personal data, because it costs me £10, not U.S. dollars, to make the data request, because at the time, companies could could charge fees for requests. And then, of course, the legal costs to to then defend it grew a substantially ballooned immeasurably. So to me that shows that data is worthless unless it isn't.
Steven Parton [00:51:24] Yeah I mean fair point.
David Carroll [00:51:27] Yeah.
Steven Parton [00:51:28] You can't argue with that. I mean looking forward then I know we're getting close on time here. Looking forward. What would you like to see happen from from all of your experiences, from the lessons that you've learned from this process, from the research that you've done and the dangers of this situation? What are some of the ideal paths for that? You would love to see us start walking down.
David Carroll [00:51:52] Sure. Well, I think the sequence of, you know, tainted elections and global pandemic and the fall of reproductive autonomy is like a triple blow to especially Americans. And in places like China, you have zero COVID and the the sort of infiltration of surveillance in everyday life. And some people in China are maybe seeing the limits of their tolerance for that kind of a life. So, you know, we're getting the squeeze and we're work from home means that people are installing invasive surveillance into their computers to monitor their productivity when they're, you know, on the job. And so the boundary of home life and surveillance is being destabilized. And, you know, so we are in the process of confronting this. So with that in mind, I hope that more and more people are accepting the foundational problem here of privacy is power and who has it and who doesn't. And it matters. And we're realizing how it matters and what's at stake. And, you know, didn't even talk about the problems of the data brokers who are selling people's visits to reproductive health clinics to potentially advance a vigilante law in another state, like some worst case scenarios have really come to pass. So my hope is that the the stakes are so high that that people will act. And I would so would hope that if the if Democrats maintain control of the levers of government in the next Congress, that they that they push through add put or something like it that the. Business needs a national standard that all citizens deserve the same rights, equal rights. I'm also sort of against this idea of let's do children first and then adults later. Now let's do everyone. And I feel like the argument for equal protections for all is becoming clearer to people who might not see the value of it. And even businesses are seeing the need to sort of get on board and see the benefits of increased trust in the business ecosystem and increase certainty and decrease uncertainty and and resolve these anxieties for greater stability both at the international and local level. So I think we all have some alignments that we could recognize to be on the same team.
Steven Parton [00:54:44] On that note, man, I want to give you a chance before we officially wind down here to just leave us any closing thoughts. If you have anything at all you'd like to say, maybe something you're working on research that you could use volunteers for, anything you'd like to point people towards, obviously. Well, we'll link to the documentary, but if you just have any closing thoughts, I'd like to give you that chance to kind of lay it out now.
David Carroll [00:55:06] Yeah, no, I think we're months away from another significant election in the United States, the midterm elections. And what's fascinating is we don't know how it's going to we we know no one can accurately predict the outcomes. So this idea that we can predict the future perhaps is is even less assured than it was a few years ago. And maybe that's good. Maybe we can't predict the future as well as we think we can.
Steven Parton [00:55:33] They could have. Perfect. David, thank you for your time and for this insightful and informative conversation. And I really appreciate it.
David Carroll [00:55:41] Thanks so much, David.
