Today, I attended UC Hastings Law School’s “The Evolution of Privacy in the Age of Technology” which had two great panels and a great keynote speaker in between the panels.

The keynote speaker was Jay Stanley, a brilliant senior policy analyst from the ACLU. The first panel consisted of Robert Callahan (Internet Association), Joanne McNabb (Director of Privacy Education and Policy at the California Attorney General’s office), Hannah Poteat (Privacy Counsel, Github), Jamie Lee Williams (Staff Attorney, EFF), and was moderated by Professor Ahmed Ghappour (Visiting Professor, UC Hastings College of Law). The second panel included Hank Dempsey (Chief Consultant, Privacy and Consumer Protection Committee, California State Assembly), Whitney Merrill (Attorney, FTC), Claire Johnson Raba (Staff Attorney, Bay Area Legal Aid), Christina Terplan (Partner, Clyde & Co.) and moderated by Drew Amerson (Visiting Assistant Professor, UC Hastings College of the Law).

Big Issues that Came Up

The Privacy-Breaching Vibrator

A big thank you to Hannah Poteat for bringing this one up:

“In August, hackers at the Def Con security conference revealed that Standard Innovation’s We-Vibe smart vibrators transmitted user data—including heat level and vibration intensity—to the company in real time. In response, Standard Innovation confirmed that it collected “certain limited data” and pledged to make its terms and conditions clearer to consumers.,” Smart Sex Toy Maker Sued for Sneakily Collecting ‘Intimate’ Data

Yup, the We-Vibe vibrator not only collects data it doesn’t need to collect, but does so in violation of a bunch of laws. Specifically, “At least one We-Vibe customer . . . found [the company’s] explanation inadequate. According to Courthouse News, a woman identified as “N.P.” filed a class action lawsuit against Standard Innovation on September 2, accusing the company of demonstrating “a wholesale disregard for consumer privacy rights” and violating “numerous state and federal laws”.”

Pacemaker Data Used to Impeach

“Police called pacemaker data an ‘excellent investigative tool’ that provided ‘key pieces of evidence’ to charge a man with arson and insurance fraud.

. . .

Police set out to disprove Compton’s story about the fire by obtaining a search warrant to collect data from Compton’s pacemaker. WLWT5 reported that the cops wanted to know “Compton’s heart rate, pacer demand and cardiac rhythms before, during and after the fire.”

On Friday, Jan. 27, the Journal-News reported that court documents stated: “A cardiologist who reviewed that data determined ‘it is highly improbable Mr. Compton would have been able to collect, pack and remove the number of items from the house, exit his bedroom window and carry numerous large and heavy items to the front of his residence during the short period of time he has indicated due to his medical conditions.’”” Cops use pacemaker data to charge man with arson, insurance fraud

What struck me was that the court was not working off a traditional “Internet of Things” device like a Fitbit or something. Law enforcement pulled data from the defendant’s pacemaker.

Amazon Echo & a Murder Case

A murder mystery representative of our modern world:

“On a November, 2015 morning in Bentonville, Arkansas, first responders discovered a corpse floating in a hot tub. The home’s resident, James Andrew Bates, told authorities he’d found the body of Victor Collins dead that morning. He’d gone to bed at 1 AM, while Collins and another friend stayed up drinking.

This past December, The Information reported that authorities had subpoenaed Amazon over the case. The police were considering Bates a suspect in what they suspected was a murder after signs of a struggle were found at the scene. They hoped his Echo might hold some insights into what happened the night before.

Amazon initially pushed back against the request, citing First Amendment protections, but ultimately conceded when Bates agreed to allow the information to be handed over to police.

While Amazon’s fight has been rendered moot, this case lays groundwork for some tough and important conversations to come, raising a slew of fascinating questions around the technologies. What do devices like the Echo or Google Home actually record and save? Have we, as consumers, effectively surrendered a reasonable right to privacy from corporations and the government by bringing such devices into our home?,” Can your smart home be used against you in court?

Unfortunately we didn’t get a rule out of this case because the defendant in the case agreed to allow the data in question to be handed over to law enforcement. But this case should remind you to maybe unplug your “always-listening” devices when you have people over, you know, as a common courtesy. XKCD did a fantastic comic on the issue: