February 24, 2009

Rules carry a cost, whether to interpret, implement or enforce, yet society cannot exist without rules. Therefore we must be ready to bear a cost for the sake of living in society. This summary of last week's fillip may be enough to answer those who want to avoid regulations at all costs but does little to help us design good rules. If anything, we came up with a negative finding. There is often a trade-off between implementation on the one hand and interpretation and enforcement on the other. Decreasing costs in one area tends to increase them in the other.

This week we must do more for rule designers, especially since time is running short where privacy is concerned.

Read John Markoff on what cellphones promise to become once fitted with maps and location tracking (*). Isn't it a perfect illustration of Michael Schrage's call to unleash the economic potential of interoperability? A few years ago wasn't a cellphone just a device to give and receive calls, convenient perhaps, but hardly "the world's most ubiquitous computer"? Yet John Markoff gently reminds us "you may use your phone to find friends and restaurants, but somebody else may be using your phone to find you and find about you". Haven't we already sent out an SOS for the Shared Information Society?

As if the problem were not complex enough, Christopher Caldwell also warns us that cellphones have become both the indispensable companion of terrorists and a permanent invitation for surveillance states, not to mention being the bane of all public places (**). At issue here is not a user's right to privacy, but the right to cancel radio communications in a public space. Haven't we suggested one ought to survey, and perhaps redraw, the much disputed border between the public and the private sphere?

Worse is to come. Gillian Tett highlights a startling downside to interoperability which Michael Schrage and I both failed to isolate (***). The more our society reaps its benefits, the likelier it secretes organizations "too interconnected to fail". Gillian Tett is speaking of the financial system, but isn't it a general truth? And aren't we discovering how daunting a task it is to salvage rather than gut, such interconnected systems once fatal flaws threaten their imminent collapse? The operating room must often devote more resources to keeping the patient alive than to the planned surgery.

Enough about cellphones. Today we will focus on behavioral advertising as we heed the Federal Trade Commission. In part its recent report (1) stresses its record in defense of eprivacy. We will not deny the FTC the right to justify its existence and indeed rather deplore the fact it cannot compete with Google's lobbying budget. But we have not shied from criticizing the FTC in the past and it behooves us to hail some real progres.

Most striking is the FTC's acknowledgement of the vanity of treating "personally identifiable information" differently from what is purported not to be so. "The line separating PII and non-PII has become increasingly indistinct". We approve. Equally refreshing is the recognition it bestows on the comments received. In one instance, it even calls promising the suggestion made of mandating "a disclosure (e.g., "why did I get this ad?") that is located in close proximity to an advertisement". That's the spirit.

The best part however remains the dissenters' opinions, never mind their having to dissemble as "concurring statements". If Commissioner Jon Leibowitz' last words, "a day of reckoning may be fast approaching" (2), are not a shot across the bow of self-regulation, what is? As for Commissioner Pamela Jones Harbour, she reiterates her long-held misgivings about privacy-related self-regulation, "in practice [...] characterized by inactivity", while "consumers lack the information and ability to exercise privacy choices" (3). She has my voice.

Study the economy of rules and a glaring truth comes to light. While each rule has a cost, so does its absence. Take ID theft. Many belittle the costs of data breaches, yet ID theft insurance is a billion dollar industry. So much smoke, there must be a fire. Why did "the Veterans Affairs Department agree[...] to pay a total of $20 million to veterans for exposing them to possible identity theft in 2006 by losing their personal information" (****)? Puny as it is, this sum must be debited from the failure to rein in credit report agencies' power to resell consumer information at will.

If we accept this evidence, both the principle and the two challenges of rule making become obvious. For each rule proposed, tote up the costs to society with and without it and pick the most economical case. Unfortunately costs with and without a rule often fall on two separate populations, which reveals self-regulation for the utopian concept it really is. Even more difficult is to estimate the costs incurred in the absence of a rule whenever this situation feeds a bubble. How can one assign a credible present economic value to a future catastrophy, when trust suddenly turns to bust?

With respect to behavioral advertising, these fillips have modestly suggested three ways to tackle these challenges. Concerned readers, make sure to relay them to the FTC commissioners. It will do no harm and one time may be the charm.

Brad Stone and Brian Stelter tell how poor Facebook repeatedly falls on its face when it comes to monetizing its users' data (*****). Is it because Facebook is ineptly managed or rather because, as a social site, it can hardly hide its data dealings from its users while providing them with the perfect forum to fan their rebellion? Our first suggestion is to "shine the light" on the behavior of advertisers (4). Since by construction the data already exists, it would be almost costless to impose on advertisers the duty to disclose "in close proximity to an advertisement" not a privacy policy, but the actual personal profile it used for targeting the advertisement. Facebook may even volunteer to host the corresponding feedback group.

The second suggestion is to prevent media space sellers from extorting a allegedly legal consent from their users under cover of a bundled contract. Your data for my service is pure blackmail. What would we say if our electric company threatened to cut our power if we did not agree to hand over our personal data? Google cannot deny the evidence of its well deserved success, that it has become the main utility of our Information Age.

Our final suggestion is to mandate that when a personal profile is reused beyond the need to perform some original transaction, the database owner pays a small annual fee to the user profiled. This fee would act as an insurance premium and shift part of the risk born by consumers to those who benefit from creating the risk in the first place.

Do I hear shrieks of despair from data aggregators? Let them rest easy. To get a sense of magnitude, recall the settlement by the Veteran Administration amounts to about $1 dollar per user. As for the handling of so many small fees, let us copy the system used today to collect royalties from all public venues playing copyrighted music. Are consumers worth less than the most obscure band because they are not to the brand born?

Notice these suggestions do not depend on technology, nor do they dictate the behavior of advertisers or consumers. They are easy to interpret, practical of implementation and rely on each consumer for primary enforcement. What an economy of rules!

Philippe Coueignoux

• (*) ......... The Cellphone, Navigating Our Lives, by John Markoff (New York Times) - February 17, 2009
• (**) ....... The right to jam your phone, by Christopher Caldwell (Financial Times) - February 6, 2009
• (***) ..... Tight supervision might make the Wild West even wilder, by Gillian Tett (Financial Times) - February 24, 2009
• (****) ... $20 Million Settlement Reached for Veterans in ID Theft Suit, (AP) (New York Times) - January 28, 2009
• (*****) . Facebook Backtracks On Use Terms, by Brad Stone and Brian Stelter (New York Times) - February 19, 2009
• (1) see the FTC staff report on Self-Regulatory Principles For Online Behavioral Advertising, February 2009
• (2) see the Commissioner Jon Leibowitz' statement, February 2009
• (3) see the Commissioner Pamela Jones Harbour's statement, February 2009
• (4) to look up the original California "Shine the Light" law, see the reference list of our lecture series