23 Jul 2024 Search

I wrote about how states should avoid free speech questions around Big Tech by establishing a licensing system for surveillance, and got some questions about how that would work.

The problem to watch out for is that state privacy regulators tend to be diligent high achiever types who aren’t afraid of doing a bunch of extra work. But what we want here is for most of the work of the licensing system to be done on the surveillance company side. The people who are getting paid by the taxpayers should spend as little time on it as possible. So here’s a possible way to do it.

  1. Pass a state law with a very general definition of surveillance, and say that anybody who surveils more than 20% of the population (to start with) needs to get a license. Appoint a surveillance licensing board.

  2. Design a surveillance licensing application, a one-page PDF. Name of company, contact person, and so on. Last form field is describe your surveillance practices in detail (attach additional pages if needed)

  3. When a company applies, put their application including the additional pages on the web (with employee name and contact info redacted of course) and have a public meeting.

  4. The meeting will be full of concerned citizens, NGOs, businesses that use the surveillance in some way, and other random members of the public. (Yes, people who got kicked off of Facebook because of getting hacked will show up at the Facebook meeting to complain.) Ideally this meeting would be organized in such a way that the Big Tech lawyers have to wait in a speakers’ waiting room next to random users. Will need to figure this out.

  5. Realistically some speakers at the meeting will come up with something that the surveillance company left out of their application, and some will mention harmful effects of surveillance practices. The board gives the company a temporary surveillance license and tells them to re-submit. While on a temporary license they can’t sign up any new users from this state.

  6. Go to step 3. When the company cleans up their act, then the board can give them a longer term license. If they persist the board might deny them a license and that’s when a lawsuit could kick in. But most of the steps of the process have already worked.

No speech mentioned, it’s all about non-speech conduct, so very difficult for surveillance industry sockpuppet orgs to get a court to block.

Update: pricing

So how much should a surveillance license cost? For a Big Tech company with a double-digit percentage of a state’s residents in their database, say $5-10 per person surveilled.

In general the license should be priced by count of people records, so a company would pay more per person surveilled as they surveil more people. As surveillance licensing comes into effect for smaller firms, they would pay less per record, and licensing would never be required for databases of less than a certain size.

Pricing a surveillance license proportional to (n log n) would help address some of the competition and centralization concerns raised by some kinds of privacy regulation. (see The Antitrust and Privacy Interface: Lessons for Regulators from the Data  by Brijesh Pinto, D. Daniel Sokol, Feng Zhu)