User agreements are written for regulators and lawyers but a new database intends to help consumers make more informed choices to ensure data is protected

No one reads those interminable terms of service agreements on Instagram, WhatsApp and their like. But they could make the difference between life and death, according to Rebecca MacKinnon.

“It may be about whether you get tortured for what you wrote on Facebook or not, or whether you get tried based on some of the stuff you had in your text messages or something you uploaded. They’re worth a lot to human beings,” said MacKinnon, the leader of a new project that hopes to show people just what they are signing away when they blindly click “agree”.

World's biggest tech companies get failing grade on data-privacy rights Read more

MacKinnon’s project at the New America Foundation’s Open Technology Institute (a thinktank inside a thinktank) is called Ranking Digital Rights (RDR), which is also what it does. It scratches an itch most people probably feel nagging at them whenever they tick the little box under the login fields as they sign into a social network or a multiplayer online game: what am I agreeing to? What am I giving away? Who are these people?

We live in a world of options. Across that world, people make choices about what technologies to use: Google, Microsoft or Yahoo for email, Vodafone or Orange for cellular, AT&T, America Movil or Axiata for internet service. Those decisions are often made on cost, storage available, ease of use or familiarity. Rarely do we care about the terms on which we’re using those technologies – until something goes wrong.

Your rights around your own information are too often ignored, said MacKinnon and her team. With large-scale data theft in the news nearly every day, consumers are starting to realize that it’s vital to understand how businesses agree to treat that data. Corporate disclosure notices and user agreements are written for regulators and tech lawyers. How can normal people make informed choices?

RDR is dedicated to answering that question. The project, produced in concert with research firm Sustainalytics after detailed study of many, many data handling standards from United Nations reports to Wharton’s Zicklin Accountability Index, defines the borders of public corporate contracts on the internet. What happens legally when you pass information through Facebook? Or Gmail? Or Twitter? Or Tumblr? Governments across the globe are creating secret pipelines through which those companies may share your information with them – the US’s Cybersecurity Information Sharing Act (Cisa) is only the most recent – and they share data with each other and with advertisers, as well. MacKinnon wants to know how much you’re being told about your data’s disposition, and by whom.

On a hot day in September in a little Washington DC office, she was listening to a conversation about which technology company had performed best on her group’s index of fundamental rights – a series of privacy, human rights and free speech indicators. Google had scored highest, but Twitter seemed to have greater corporate commitment while disdaining the details.

Finally, MacKinnon cut in: “If this was a test, nearly everyone failed.”

Toward a digital bill of rights



There are plenty of jokes about terms of service. South Park had a whole episode devoted to how heedlessly we agree to them called Human CentiPad. But as MacKinnon points out, they are incredibly serious when tested legally – as they are at the moment in the current courtroom face-off between Microsoft and the Department of Justice that could give the US government access to email stored anywhere in the world.

Nate Cardozo, a staff attorney with the privacy rights group Electronic Frontier Foundation, said that while it’s more common to hear about users getting the short end of the stick from the tech companies they patronize, digital rights cut both ways.

“The terms of service are definitely enforceable in the United States under straight-up contract law,” Cardozo said. “Any sophisticated company will draft its terms of service in order to give itself as much protection as possible and the user as little as possible. That’s just good lawyering.”



But there are cases where companies didn’t lawyer hard enough, and they paid for it in court. He points to the court case that ensued from Facebook’s use of Beacon, an advertising network that published details of people’s activities on other websites.

It ended in a lawsuit, Lane v Facebook, and an embarrassing climbdown for Facebook. “It was a class action against Facebook for essentially violating their privacy policy,” Cordozo said.

If censorship and privacy are simply left to corporate discretion, the results can be devastating. Yahoo settled out of court in 2007 after a human rights group sued the company for outing a Chinese dissident who was subsequently tortured; it was only one of several cases of alleged cooperation with local authorities. AT&T made domestic spying possible – and easy – over decades of collaboration with the National Security Agency (NSA), a partnership revealed by Edward Snowden.

MacKinnon wants to see users protected by commitments to generally agreed-upon universal digital rights. But there are impediments to that progress and they aren’t all simple self-interest: legal obligations prevent tech companies from disclosing vital information. Last year, Twitter sued the US government for permission to disclose how often it had received “national security letters” and orders under the Foreign Intelligence Surveillance Act (Fisa) that are part of a secret, parallel courts system beyond the reach of the public.



The companies investigated by the index scored universally low on one important privacy metric: how well they inform consumers whether their information has been turned over to a government. Many are trying – Facebook, among others, produces an annual report of government requests and lists the reasons it is asked to censor its users. In Germany, Holocaust denial is illegal; in Turkey defamation of Ataturk is illegal. But the law often makes it difficult.



Often, in fact, disclosures and notices and agreements tend to obscure how little we know about where and how our information is used by social media, email and internet providers.



“No company clearly explains whether users can control what the company itself collects and shares about users,” wrote the team in its executive summary. “Furthermore, half of the companies do not explain whether users can access the information the company holds on them, and seven companies do not provide detail on how long they hold user information.” This is becoming increasingly important – when Ashley Madison was hacked earlier this year, it was revealed to have kept every single user profile from the beginning of its existence. The result was mass blackmail.



Even more egregiously, no one at all will tell you what kind of content they censor, not as a result of copyright notices or government requests, but as a matter of course. Or why.

The post-Snowden world

MacKinnon is trying to make sure consumers know at least a little about the vital information created by and about them. Formerly the head of CNN’s Beijing bureau (and then Tokyo), she’s is an acknowledged expert in this widening field. In one of her books, Consent of the Networked, MacKinnon argued that the arc of technological history could bend away from justice if we let it.



“Governments and corporations are working actively to shape the internet to fit their own needs,” she told the Atlantic when the book came out. “The most insidious situations arise when both government and corporations combine their efforts to exercise power over the same people at the same time, in largely unconstrained and unaccountable ways.”



It’s in the best interests of these companies to make their protections clear to users, said MacKinnon. “Particularly post-Snowden [a phrase Cardozo also uses], but even before that in some cases, some of these companies were starting to realize that if they made incredible effort to show they cared about user rights, it would be good for their business,” she said. “We saw that with Google and some of things they didn’t end up doing in China [on privacy concerns]. Yahoo got burned pretty badly in China when they handed over user information to the police, and then they signed on to the Network Initiative.



“Demonstrating that you’re taking users’ rights seriously is important to your business.”



If you’re unclear on what kinds of rights are afforded to you in writing by big public companies, MacKinnon and her team say that probably simply puts you in the majority – this information is designed for regulators and lawyers, not the consumers it ostensibly protects. Disclosure about data collection, use, sharing and retention is poor, she said. Even if the information is publicly available, it’s far away from the end-user.



“People used to be more worried about censorship than privacy,” she said. “Then the pendulum swung the other way and they began to worry about privacy more, which was good at the time. But it probably needs to swing back towards censorship again.”



Part of this is simply the acknowledgement of a very uncomfortable truth: As technology companies cross borders and develop new ways of transmitting and accessing vast quantities of information, they behave more and more like governments, with their own sets of rights and rules. What passes muster in the People’s Republic of Tumblr may not fly in Instagramistan. It might not even fly in the United States of Facebook, which owns Instagram but keeps its user policies completely separate.



Tech companies are making an effort, said MacKinnon, pointing to Brad Smith, Microsoft’s top lawyer, calling the NSA “an advanced persistent threat to their business” and Apple’s Tim Cook championing encryption against the FBI’s wishes.

But this is an industry that wants more and more of your data. “Companies have business models where they collect and sell user information as part of the business – how do companies ensure that they’re being accountable to their users for what they’re doing?”









