16.5 Privacy Laws and the Impact of Digital Surveillance

The USA PATRIOT Act: Weakening Privacy Laws or Protecting Citizens?

The USA PATRIOT Act has generated a huge amount of debate and controversy since its approval by President George W. Bush in October 2001. Signed into law with little debate or congressional review just 43 days after the September 11 attacks, the act’s provisions enable the government, with permission from a special court, to obtain roving wiretaps over multiple communication devices, seize suspects’ records without their knowledge, monitor an individual’s web-surfing and library records, and conduct surveillance on a person deemed to be suspicious but without known ties to a terrorist group. Approving the House of Representatives’ decision to renew 16 of the act’s provisions in 2005, President Bush said, “The [USA] PATRIOT Act is essential to fighting the war on terror and preventing our enemies from striking America again. In the war on terror, we cannot afford to be without this law for a single moment (CNN, 2005).”

However, not everyone agrees with the former president’s opinion. While proponents of the act cite the need to disrupt or prevent terrorist attacks, New York City Council member Bill Perkins, who sponsored a 2004 resolution condemning the law, says, “The [USA] PATRIOT Act is really unpatriotic, it undermines our civil rights and civil liberties. We never give up our rights, that’s what makes us Americans (Garcia, 2004).” Opposition to the USA PATRIOT Act sparked a wave of protest across the United States. More than 330 communities in 41 states passed resolutions condemning the act (Egan, 2004). Librarians in Detroit reported that Muslim children had stopped checking out books on Islam out of fear they were being monitored, while librarians in New Jersey and California shredded records and computer sign-up sheets in an attempt to thwart the legislation. While citizens can protect against invasions of privacy on the Internet by limiting personal information and being careful about the information they share, the invasion of privacy through other lines of communication is more difficult to prevent. Despite fierce objections to the act, President Barack Obama signed an unamended 1-year extension of several key provisions of the PATRIOT Act (including the use of roving wire taps) in 2010. In the near future, politicians will have to decide whether citizen protection is worth the loss of liberties in the United States.

Social Networking: The Blurring of Personal and Professional

The privacy issue has strayed well beyond government legislation; it affects anyone who is currently employed or even just looking for a job. When employers consider whether or not to hire an individual, they no longer need to rely on just a résumé to obtain pertinent information. A simple Google search often reveals that a potential employee has a social networking site on the Internet, and unless privacy settings have been put in place, the employer can access everything the candidate has posted online. A 2010 survey by CareerBuilder.com revealed that 53 percent of companies check out candidates’ profiles on social networking sites such as MySpace, Twitter, LinkedIn, and Facebook before deciding to employ them, and a further 12 percent of companies intend to review social networking sites of potential employees in the future (Skinner, 2010). Factors that affect an employer’s decision whether or not to hire candidates based on their social networking page include the use of drugs or drinking, the posting of discriminatory comments, or the posting of photographs deemed to be inappropriate or provocative. The survey also revealed that some candidates posted information on their social networking page that proved they had lied on their résumé (Skinner, 2010).

Once employees are hired, they still need to be careful about what they post on social networking sites, particularly in relation to their jobs. Cheryl James, a hospital worker from Michigan, was fired in 2010 after she posted a message on Facebook describing a patient as a “cop killer” and hoping that he would “rot in hell (Dahl, 2010).” A few years earlier, Virgin Atlantic Airlines terminated 13 crew members for describing passengers as “chavs” (a derogatory British term similar to “white trash”). A Virgin spokesman commented, “There is a time and a place for Facebook. But there is no justification for it to be used as a sounding board for staff of any company to criticize the very passengers who pay their salaries (Conway, 2008).”

Although employees might reasonably expect to be disciplined for using social networking sites on company time—a 2009 study discovered that 54 percent of U.S. companies have banned workers from using social networks during work hours—the issue of whether companies can influence how their employees behave in their private lives is a little trickier (Gaudin, 2009). The outcome of a 2009 federal court case in New Jersey may have some bearing on whether companies have the right to spy on their employees while the employees are on password-protected sites using nonwork computers. The case, between restaurant employees Brian Pietrylo and Doreen Marino and managers at Houston’s in Hackensack, New Jersey, centered on a forum set up by Pietrylo on MySpace. The forum, which was password-protected and required an e-mail invitation to join, made fun of the restaurant décor and patrons and included sexual jokes and negative comments about restaurant supervisors. Restaurant hostess Karen St. Jean, who had received an invitation to the forum, showed the supervisors the site and believed they found it amusing; however, the information was passed further up the management chain, and Pietrylo and Marino were fired. The restaurant claimed that the pair’s online posts violated policies set out in the employee handbook, including professionalism and a positive attitude. Marino and Pietrylo filed for unfair dismissal, claiming that the restaurant managers had violated their privacy under New Jersey law. Following a trial in June 2009, a federal jury agreed that the restaurant had violated state and federal laws that protect the privacy of web communications. The jury awarded Pietrylo and Marino a total of $3,400 in back pay and $13,600 in punitive damages (Toutant, 2009).

Although the outcome of the New Jersey case may have some bearing on the use of social networking sites outside of work, employees should still exercise caution in the office. Companies are increasingly using technological advances to monitor Internet usage, track employees’ whereabouts through GPS-enabled cell phones, and even film employees’ movements via webcam or miniature video cameras. Lewis Maltby, author of workplace rights book Can They Do That?, says, “There are two trends driving the increase in monitoring. One is financial pressure. Everyone is trying to get leaner and meaner, and monitoring is one way to do it. The other reason is that it’s easier than ever. It used to be difficult and expensive to monitor employees, and now, it’s easy and cheap (Petrecca, 2010).” Whereas employees using their own equipment outside of work hours might have a reasonable expectation of privacy, the situation changes when using company property. Nancy Flynn, founder of training and consulting firm ePolicy Institute, said, “Federal law gives employers the legal right to monitor all computer activity. The computer system is the property of the employer, and the employee has absolutely no reasonable expectations of privacy when using that system (Petrecca, 2010).” Because this lack of privacy covers everything from instant messages sent to coworkers to e-mails sent from personal accounts when employees are logged onto the company network, the prudent action for employees to take is to separate their work life from their personal life as much as possible.

Restoration of Privacy

Social networking sites have come under fire in recent years for violating users’ privacy. In 2009, Facebook simplified its settings to keep up with the popularity of microblogging sites such as Twitter. One consequence of this action was that the default setting enabled status updates and photos to be seen across the entire Internet (see Chapter 11 “The Internet and Social Media” for more information about Facebook privacy settings). The social networking site has also come under criticism for a temporary glitch that gave users unintended access to their friends’ private instant messages, and for a new feature in 2010 that enabled the company to share private information with third-party websites. Although Facebook simplified its controls for sharing information by consolidating them on a single page and making it easier for users to opt out of sharing information with third-party applications, public concern prompted 14 privacy groups to file an unfair-trade complaint with the Federal Trade Commission (FTC) in May 2010 (Ashford, 2010). Congress is currently investigating whether more government regulation of social networking sites is necessary to protect people’s privacy.

Other companies, including Google, are actively attempting to restore users’ privacy. In response to revelations that the company had accidentally captured and archived wireless data with its Google Street View cars (which are equipped with cameras to provide panoramic views along many streets around the world), Google announced in 2010 that it was launching an encrypted search facility. The technology uses SSL (secure sockets layer) to protect Internet searches from being intercepted while traveling across the web. Users can activate the secure search facility by typing “https” at the beginning of the URL instead of “http.” Although the technology provides a measure of security—the search will not be archived in the computer’s history or appear in the AutoFill during a subsequent search—it is not entirely private. Google maintains a record of what people search for, and Internet users will still need to rely on the company’s promise not to abuse the data. However, if the encrypted search facility proves successful, it may become a role model for social networking sites, which could offer encryption for more than just log-ins.