Surveillance and Civil Liberties

CSCI 3921w Social, Legal, and Ethical Issues in Computing
Adriana Picoral

Q&A (10 minutes)

Q&A about ethics, computing, and logistics of the course.

No question is too silly, naive, controversial, basic, or advanced.

Warm-up

Before we start, answer in your journal:

Your phone has recorded where you have been for the last year.

  • Who do you think could get access to that history? A company? The police? Your university? Your employer?
  • Would they need your permission? A warrant?

The Fourth Amendment and digital data

The Fourth Amendment

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause […] and particularly describing the place to be searched, and the persons or things to be seized.

Ratified in 1791. How do “papers and effects” apply to a smartphone, a cloud account, or location data?

From wiretaps to smartphones

Case Holding
Katz v. United States (1967) The Fourth Amendment protects people, not places: a reasonable expectation of privacy test: “(1) that a person have exhibited an actual expectation of privacy and (2) that the expectation be one that society is prepared to recognize as reasonable.”
United States v. Miller (1976), Smith v. Maryland (1979) Third-party doctrine: no expectation of privacy in information you voluntarily give to a third party (bank records, numbers dialed)
Riley v. California (2014) Police need a warrant to search a cell phone seized during an arrest
Carpenter v. United States (2018) Police need a warrant to get historical cell-site location records (7+ days) from a phone company

If the third-party doctrine were applied to everything, what would be left of the Fourth Amendment today?

Carpenter v. United States (2018)

Mapping a cell phone’s location over the course of 127 days provides an all-encompassing record of the holder’s whereabouts […] revealing not only his particular movements, but through them his familial, political, professional, religious, and sexual associations.

Chief Justice Roberts, majority opinion

The data broker loophole

Carpenter requires a warrant to compel a phone company to hand over location data. But what if the government simply buys it?

Geofence and keyword warrants

Traditional warrants name a suspect and ask for their data. Newer warrants work the other way around:

  • Geofence warrant: “give us every device that was in this area during this time window”
  • Keyword warrant: “give us everyone who searched for this address or term”

Everyone in the area (or who searched) becomes a potential suspect.

Design decision → civil liberties outcome: where data is stored is an ethical choice.

Case studies

Case: Reproductive health data after Dobbs

Data that is not collected cannot be subpoenaed. What does this mean for app designers?

Case: Facial recognition and protest

  • Clearview AI scraped billions of photos from social media to build a face search engine and sold it to police departments
  • 2022: ACLU v. Clearview AI settlement under Illinois’ Biometric Information Privacy Act (BIPA) bans Clearview from selling its database to most private companies nationwide
  • Face recognition can identify people at protests, places of worship, or clinics: a threat to the First Amendment (speech, assembly, religion), not only the Fourth
  • Recall: the wrongful arrests from face recognition (Robert Williams, Porcha Woodruff) and unequal error rates

Case: Student surveillance

Who are the stakeholders? Can students give voluntary consent to surveillance required to pass a course?

U.S.: A sectoral patchwork

There is no comprehensive federal privacy law in the U.S. Instead, laws cover specific sectors:

U.S. states

States have moved faster than Congress:

  • Illinois BIPA (2008): requires consent to collect biometrics (face, fingerprints) and lets individuals sue. Facebook paid $650 million to settle a BIPA class action over photo tagging
  • California CCPA (2018) / CPRA (2020): rights to know, delete, correct, and opt out of the sale of personal data
  • Minnesota Consumer Data Privacy Act (in effect since July 2025): rights to access, correct, delete, and opt out of targeted advertising, sale, and profiling, including a right to question the result of a profiling decision
  • About 20 states now have comprehensive consumer privacy laws, each a bit different

The EU: GDPR (2018)

The General Data Protection Regulation treats data protection as a fundamental right:

  • Data processing needs a lawful basis (consent is only one of six)
  • Consent must be freely given, specific, informed, and unambiguous (no pre-checked boxes)
  • Data minimization and purpose limitation
  • Rights to access, correct, erase (“right to be forgotten”), and data portability
  • Article 22: right not to be subject to a decision based solely on automated processing with legal or similarly significant effects
  • Fines up to €10/€20 million or 2%-4% of the company’s total worldwide annual turnover from the preceding fiscal year, whichever is higher (e.g., Meta’s €1.2 billion fine in 2023)

What would change in the apps you use if GDPR applied in the U.S.?

Group Activity: Write the rule

Your group is a legislative staff team. Choose one scenario:

  1. Police want to use a city’s automated license plate reader network to find a stolen car
  2. A university wants to require AI proctoring software for all online exams
  3. A period-tracking app wants to sell anonymized data to researchers and advertisers

For your scenario:

  1. Who are the stakeholders? Who is most vulnerable?
  2. What data flows should be allowed, allowed with a warrant/consent, or banned?
  3. What would meaningful informed consent look like (if it is possible at all)?
  4. Write one rule/regulation (2–3 sentences) you would propose.

References and Further Readings

References and Further Readings

Journal Writing

Reflect on what you liked and disliked about this lecture, what you learned, and what you wished you’d learned.

  1. What you learned from the lecture and discussion – this can be something that surprised you, something you had not considered before, a new way of thinking about something
  2. What you wish you’d learned from the discussion – this can be questions you still have and questions you would like to explore further
  3. Anything you liked or disliked