胡佛研究所-私人數(shù)據(jù)公共監(jiān)管（英）-2021-28正式版

AHOOVERINSTITUTIONESSAYPrivateData/PublicRegulationBARRYFRIEDMANAegisSeriesPaperNo.?2105IntroductionPolicecollectinformation—thatiswhattheydo,andtheycouldnotdoitwithouthelp.Nodoubtfromthebeginningofpolicing,of?cershaverelieduponprivatepartiestoaidtheirinvestigations.Tipsterstip,snitchesarepaid,andwell-meaningdenizenssharetheinformationtheypossess.Atcrimescenes,policecollectthenamesofpeoplewhomayhave?seensomethingandfollowuponthoseleads.Andforthemostpartthishasbeen,and?remains,unregulated.Buttherehasbeenaseachange,broughtuponusbytechnology,achangesodramaticithastransformedpolicingitself.Increasingly,theinformationpolicecollectisdigital.Fewersearchwarrants,morerequestsfororderstoharvestmetadata.Purchasinglargepoolsofprivatedatafromdatabrokers.Capturinglocationinformationinvariousways.Tappingintoanetworkofprivatesecuritycameras.Andsoon.Sometimespolicecollectthedatathemselves.Moreoftentheygatheritfromthirdparties.Theydosofromvolunteers,bypurchase,andbycourtorder.1Thedigitalnatureofthedataallowsittobeacquiredinbulk.Ratherthanjustfocusingonthetargetofaparticularinvestigation,thegovernmentcangathertheinformationindiscriminatelyaboutlargeswathsofthepopulationorevenaboutallofus.2Thiswasthe?casewiththeNationalSecurityAgency’scollectionofourtelephonemetadata,butitalsoisthecaseatthelocallevelbyautomatedlicenseplatereaders.3Theusesofthisdataaresobroadthatitisnotjustwhatwetraditionallythinkofasthe“police”whogatherthedata,butavarietyofgovernmententitiesinvolvedinpublicsafetyandlawenforcement.Bulkdatacollectionhasallowedlawenforcementtoshiftitsfocusfromareactiveinvestigativestancetoaproactiveanddeterrentone.Thepolicelonghaveinvestigatedparticularcases,withsuspectstheyhadinmindorweretryingtoidentify.4Now,governmentagenciesutilizelargedatabasestopredictwherecrimewilloccur,orminethemforevidenceofcriminality.5Thisoccurswithoutaparticularsuspectinmindandisaimedmorebroadlyattheentirepopulationorasegmentofit.Nodoubtthisdatacollectionhasvalue,butpreciselyhowmuchisanopenquestion,andmaydependinpartonitsuse.Forexample,datacollectedfromthirdparties,suchasgeneticinformation,hashelped—tosolvecoldcases.6FacialrecognitionwasvitaltoidentifyingtheinsurrectionistsofJanuary?6,2021.7Theseareinvestigativeuses.Here,the2valueisplain,buttheextentofthatvalueunknown.Theutilityofbulkdatacollectionforpredictiveordeterrentpurposesisfarmoreuncertain.8Intruththereisfartoolittleassessmentoftheutilityofthesenewtechniques,forwhateverpurposetheyaredeployed.Butonethingisclear:placingthismuchpersonaldatainthehandsofthegovernmenthasitscosts.Itendangersourpersonalsecurity,andoursenseofprivacy.Itthreatensourrighttoassociate,includingforpoliticalactivity.Itputsenormouspowerinthegovernmenttocontrolbehavior.Andtoooftenthecollectionisdisproportionatelyofpeopleofcolor.I’mgoingtomakeanovelargumentthat,ifadopted,wouldallowforcapturingthebene?tsofdata-drivenpolicing,whilemitigatingitscosts.Myargumentisthatgovernmentagenciesthatengageinpolicingcannotcollectdigitaldata,particularlyaboutindividualsforwhomthereisnosuspicionofwrongdoing,withoutasuf?cientregulatoryschemeinplace.Thus,ifthesepracticesaretocontinue,legislativebodiesmuststepinandadoptregulation.What’snovelaboutmyargumentisthatIframeitinconstitutionalterms.I’mnotjustarguingthatregulationisdesirableasanormativematter.Mypreciseclaimisthatasamatterofconstitutionallaw,unauthorizedandunregulatedbulkdigitalcollectionofsurveillancedatasimplymaynotoccur.Absentsuchauthorizationandregulation,courtsshouldinvalidatesuchcollection.Morebluntly:withorwithoutcourtintervention,governmentagenciesinvolvedinthepolicingfunctionshouldceaseimmediatelywhattheyaredoinguntilsuf?cientauthorizationandregulationisinplace.Isupportmyargumentbyshowingthatinmanycontexts,underanumberofconstitutionalamendments,whengovernmentseekstocollectpersonalinformation,courtsimposeasetof“requisites”beforesuchcollectionismandatedorupheld.Theserequisitesincludethatthecollectionofdataisstatutorilyauthorized,thatitfurthersalegitimategovernmentpurpose,thatcollectionisminimizedtoprotectprivacyandpersonalsecurity,thataccesstothedataissafeguarded,andthatjudicialreviewisavailabletochallengethecollection,retention,anduseofsuchdata.Notethatvirtuallyallofthisismissingfromtoday’scollectionofsurveillancedatabygovernment.Thatiswhatmustchange.Iamnotarguinggovernmentcannotcollectthedata,butthatbeforeitdoes,authorizationandregulationbyademocraticallyaccountablebodyisessential.Thisputsthedecisiontocollectthedata,andminimalsafeguardsattendantthereto,inproperhands,ratherthanlettinggovernmentpolicingof?cialssimplydecideforthemselves.AlthoughIhopeithasverybasicnormativeappeal,myargumentisacomplexonewithanumberofmovingpieces.I’mnotgoingtohavethespacetolayitallouthere,butIamdoingsoinotherwork.9InPartI,Iwilldescribethephenomenonofwidespreaddigitalsurveillancedatacollectionthatdrawsmyattention.InPartII,IwillsketchoutmyBarryFriedman?PrivateData/PublicRegulation3argument,brie?ybutinfull.PartIIIthenwillhoneinonthebodyofconstitutionallawcentraltomyargument,thecasesIdescribejustabove.PartIVwillall-too-brie?ytouchonrelatedpartsoftheargumentandconclude.IIwanttobeginbybrie?ydescribingthedevelopmentsthatmotivatethepaperandtohighlighttwoparticularaspects.First,althoughmanyhaveexpressedalarmthatprivatecompaniesarecollectingandaggregatingenormousamountsofdataaboutus,governmentsarebuildingsimilardatabasesontheirownforlawenforcementpurposes.Theremaybebene?tstoallthis,buttheresurelyarecosts.Yet,second,theConstitutionaspresentlyconstrued—particularlytheFourthAmendment—hasprovenoflittlevalueinregulatingthepracticeofdatacollection,retention,anduse.Intheabsenceofconstitutionalregulation,therehasbeensomelegislativeintervention,butfarlessthanisnecessarytocoverthe?eldorbringgovernmentsurveillancedatacollectionunderthecontrolitrequires.I.APolicingagenciesatthenationalandlocallevelarebuildingvastdatabasestokeeptabsonusall.TheFBIisconstructinganenormousbiometricdatabasethatwillincludefacialimages,irisscans,voiceandpalmprints.10NewYorkisoneofseveralcitieswithanextensiveDomainAwarenesssystem,whichcollectsandaggregatesinformationfromanetworkthatincludesover9,000cameras,500licenseplatereaders,anddatafromgovernmentdatabases.11Nolongercontentwithusingstate-runandregulatedDNAdatabases,localdepartmentshavebeguncreatingtheirownversions,snatchingDNAinanywaytheycangetit:bysurreptitiouslynabbingbeveragecupsfrompeopletheysuspect,toaskingconsentfromvictimsorpeopletheywishtoclearininvestigations,andthenretainingit.12ThepoliceusetechnologylikefromthecompanyCellebritetovacuumupthe?contentsofcellphonesduringroutinesearches,andhoarditforlateruse.13Notcontentwiththeirowndatacollectionefforts,however,policingagenciesincreasinglyarerelyingonprivatedatasourcestomonitororprovideinformationaboutthepublicforthem.OneofthelargestistheCLEARdatabasemaintainedbyThomsonReuters,whichadvertisesCLEARasa“[p]owerfulpublicrecordstechnology”that“bringsallkeycontenttogethertoprovideintelligentanalyticsinoneenvironment.”14Thatdatabasecompilesextensiveinformationonpeople’scredit,employment,andsoforth.ArecentstorytoldhowICEwasusingCLEARtotraceundocumentedindividualsusingutilityusageinformation.15ThomsonReutersisnotalone;anotherrecentnewsstoryrelatedhowICEapparentlyisswitchingdatavendors,movingovertothedatabaserunbyLexisNexis.16Databasesthattrackourlocationareparticularlyillustrativeofthepublic-privatepartnershipsinthisspace.Automatedlicenseplatereaders(ALPRs)provideanexcellentexample.ALPRssitonpolicecarsorothervehicles,oraremountedin?xedlocations,andHooverInstitution?StanfordUniversity4theysuckinthelicenseplatesofmotoristsaroundthem,geolocatingwherethosecarsareatthatmoment.17OriginallythepointofALPRswastocomparethereadstoa“hotlist,”suchastodetectstolenvehicles.18Butlawenforcementagenciessoondecidedtherewasvalueinretainingthereadsincasetheyprovedusefullaterinacriminalinvestigation.19ManydepartmentsnowuseALPRsextensively,bothtocreatehugedatabasesofwhereautomobileshavebeenwhen,andtogeofencetheircommunitiessotheyknowwhoiscomingandgoing.Axon,theleadingU.S.sellerofbodycamerasandTasers,isreleasinganewdigitalALPRsystemthatturnsordinarypolicecardashcamsintopowerfultoolsthatcancollectreadsfromtraf?cacrossthreelanes,frontandback,aspolicecarsmoveonpatrol.20TheLAPDhasadatabaseofsome320millionlicenseplatesthatitstoresforatleast?veyears.21MyrtleBeach,SouthCarolina,keepstabsonvisitorswithALPRcamerascoveringallexitandentrancepointstotheshoretown.In2019thosecamerascapturedalmost40millionreads.22Butpolicingagencieshaveexpandedtheircapabilitiessubstantiallybylinkingupwithprivatevendorstocreateanetworkoftrackingandtracingcapability.TheindustryleaderinthisspaceisVigilant,ownednowbyMotorolaSolutions,whichadvertisesandmakesavailabletopolicingagenciesadatabaseofover500billionstoredgeo-locatedrecords.Vigilant’sdatabaseisfedwithlicenseplatereadersattachedtorepotrucks,butalsogarneredfrompolicingagenciesthatturntheirinformationover,ofteninreturnforaccesstothelargerpoolofdata.23I.BThesepublic-privatepartnershipsmayhaverealadvantagesforpolicingagenciesandforpublicsafety,butonepervasiveprobleminthisareaisthelackofanysystemicattempttoidentifythosebene?ts.CopswillofferupanecdotesaboutthetimeALPRevidencehelpedcrackacase,butwedon’tknowiftheALPRwasessential,orhowvaluableitproved,letalonehowoftenthatwasthecase.Therearewell-knownexamplesabouthowrelianceonthird-partydatahelpedcracknotoriouscoldcases,suchasthatoftheGoldenStateKiller.24Buthowoftendoesthishappen?Ifwearegoingtoallowthegovernmenttocreateorrelyonthirdpartiestoprovidehugeaggregateddatabases,itseemsincumbentupongovernmenttoprovethevalue.Iwillreturntothispointbelow.Fornow,though,Iwanttofocusontheharmsfromthissortofdataaggregation,becausetheyarewhatmakethecaseforregulation.Ifbene?tswereuncertainbutharmsnonexistent,ouronlyconcernwouldbethepotentialsquanderingofgovernmentresources.Theloudpushbackweheartodayagainstgovernmentcollectionanduseofprivatedatasuggestsmuchmoreisatstake.First,therearethethreatsfromerrorsinthesedatabases,andthougherrorisasmallword,thedangerhereisenormous.ThesemistakescausepeopletobecomelawenforcementBarryFriedman?PrivateData/PublicRegulation5involved,andthenewsatpresentisalltooclearabouttherisksthosepoliceencounterspose.Atbesttheyareanintrusiononlibertyandpsychologicallystressful;atworsttheyendupinpoliceshootingsorotherusesofforce.AlbertFlorencewaspickedupforanoutstandingwarrantona?nethathadbeenpaidbuterroneouslyrecordedasopen.“Hespentsevendaysinjail”and“wasstrip-searchedtwice”inthattime.25RobertJulian-BorchakWilliamssufferedasimilarfalsearrest,thistimebecauseafacialrecognitionalgorithm(withahumansupposedlyintheloop)wronglyID’edhimforshopliftingfromahigh-endboutique.Despitehisdenyingtheimagewashimhespent30hoursinjail,andhiswifehadtoclaiman“emergency”tohisemployerlestherisklosinghisjob.26Itisimpossibletoknowthemagnitudeofthese“errors,”butonecanreasonablyestimatethattherearetensifnothundredsofthousandsofstaleorerroneouswarrantssittingindatabaseswaitingtoresultinawrongfularrest.27Second,there’smisuseofthedatabases,justthekindofthingyou’dexpectwhenyouleavehugestoresofpersonalinformationlyingabout.Alegislativeauditfoundthatoverhalfofthe11,000lawenforcementpersonnelwhosearchedtheMinnesotaDepartmentofPublicSafetydriverdatabaseconductedsearchesthatwere“questionable.”28Alltoooftentherearestoriesofpolicingpersonneldippingintothedatabasestospyonpeoplewithwhomtheyhavepersonalissues—frequentlystalkingintimatepartners.29Third,andperhapsmostimportant,allowinggovernmenttoaccumulateandhaveeasyaccesstodetaileddossiersonallofusthreatensourpersonalandcollectivesecurity.30Therearealwaysthoseeagertoargueitcan’thappenhere,butitcan—andtoooftenithas.Fordecades,aspartofitsCOINTELPROoperation,theUnitedStatesintelligencecommunitynotonlykepttabsontheCivilRightsandWomen’sRightsmovements,butalltoooftenattemptedtointerveneinwaysthatwereinsidioustodemocracy.31“Fusioncenters”—federallysupportedstateandregionalintelligence-gatheringhubs,oftenrelyingonprivatelycollecteddata—repeatedlyhavebeencaughtspyingonentirelylawfulFirstAmendmentactivity.32Evenifweacceptedthepurityofgovernmentwatchers—asIdo,forexample,oftheNationalSecurityAgency’svastdatagrabrevealedbyEdwardSnowden—it’sinconceivablethatwewantgovernmenttohaveaccesstoallthisdatawithoutpublicdebateandadequateregulation.Althoughthissortofsurveillancecanfalluponallofus,it’sundeniablythecasethatwhenthegovernmentdeterminestocollectanduseinformationagainstpeople,there’sagoodchancethosewhosuffermostwillbeBlackandbrown.33It’snotasurprisethatRobertWilliamsandAlbertFlorencewereBlack.34I.CThesimplefactisthatmostgovernmentsurveillancedatacollection,bypolicingagenciesorviathirdparties,isprofoundlyunder-orunregulated.TheConstitutionaspresentlyinterpretedoffersalmostnoprotectiontothesortofwidespreaddatacollectionbytheHooverInstitution?StanfordUniversity6government.35Thereissomelegislationinthisspace,suchasthefederalElectronicCommunicationsPrivacyActandvariousstateandlocallaws,butmostofitisalreadyoutdated,andingeneralwhatpoliceandprivatedatacollectorsdohappenswithoutanyregulation.AsBenjaminWitteswrites,aptly,“[m]ostofthisdataisnotplausiblyprotectedbytheFourthAmendment.Muchofitisnotprotectedbyanylawatall.”36Absentasmallnichedoctrineof“privatesearches”theConstitutiondoesn’tapplyatallwhenthegovernmentacquirespersonalinformationfromprivateparties.TheConstitutionforthemostpartbindspublicactors,notprivateones.Theprivatesearchdoctrineholdsthatunlessaprivateentityeffectivelywas“deputizedbystateof?cialsexante,”tosearchorseize,thegovernmentwillnotbeheldaccountablefortheaction.37Asoneoftheleadingcasesinthespaceputit,theFourthAmendmentappliesonlyto“governmentalaction;itiswhollyinapplicable‘toasearchorseizure,evenanunreasonableone,effectedbyaprivateindividualnotactingasanagentoftheGovernmentorwiththeparticipationorknowledgeofanygovernmentalof?cial.’”38Thelargerdif?cultyisthatevenifthegovernmentiscollectingbulksurveillancedata,theFourthAmendment—theonlyconstitutionalprovisionthatdoesanyworkinthisspace—stillhasverylittletosayaboutit.39Ironically,theSupremeCourtincasesinvolving“innovationsinsurveillancetools”hastakentoinsistingthatnomatterwhatelsetheAmendmentmayormaynotdo,it“assure[s]preservationofthatdegreeofprivacyagainstgovernmentthatexistedwhentheFourthAmendmentwasadopted.”40Thatisnotremotelytrue.ThethresholdtriggersfortheFourthAmendmentarethatpoliceconductmustbea“search”or“seizure,”andmostsurveillancedatacollectionnevergetspastthispoint.41First,mostofwhatyoudoinpublic,whichistosaycouldconceivablybeviewedbysomeoneinpublic,is?notdeemedasearch.42So,forexample,intwinnedcases—UnitedStatesv.KnottsandUnitedStatesv.Karo—theCourtheldthatusingabeepertotracksomeonetotheendpointofajourneyonthehighwayswasnota“search.”43Second,underthe“third-partydoctrine”anythingthegovernmentcollectsthatyouhavegivenovertoathirdpartyalsoisnotasearch.44Thatincludesbankrecords,phonenumbersdialed,papersgiventoanaccountant,etc.IntworelativelyrecentcasestheSupremeCourthasheldthatlong-termlocationtrackingcanconstituteasearch,butlikeallexceptionsthesecasesprovetheruleofconstitutionalneglect.InUnitedStatesv.JonesthejusticesreliedonthephysicaltrespassofinstallingaGlobalPositioningSystem(GPS)onacartocollectinformationasthebasisforconcludingitwasasearchandthatawarrantwasrequired.45Moreimportantforpresentpurposes,?vejusticesinJones—concurring—heldthebetteranalysiswasthatlong-termlocationtrackingwasasearch,evenifthesortofshort-termtrackingatissueintheKnottsandKarocaseswasnot.46Then,inCarpenterv.UnitedStates,thejusticesconcludedthatusingacourtordertoacquiresevendaysormoreofcellsitelocationinformationalsowasasearch.47BarryFriedman?PrivateData/PublicRegulation7Thosedecisionswereastepintherightdirection,butitwasababystepatbestandleavesmostofwhatweareconcernedaboutuncoveredbytheFourthAmendment,evenifthepolicethemselvescollectit.First,notetheweirdlinesbeingdrawn:30daysofGPStrackingistoomany;sameforsevendaysofCSLI.Thejusticesaregraspingatstrawstogetinvasivedigitaldatacollectionundercontrol,buttheyreallyarestruggling.Second,asJusticeKennedy,dissentinginCarpenter

rightfullypointsout,whylocationtrackingandCSLI,butnotalltheotherdatagivenovertothirdparties,likeourcreditcardpurchase,orbankrecords,orbillsfromtherapistsandmedicalclinics?48There’snodecentanswertothisquestionandthemajorityofferednone.Thejusticesarenotoblivioustotheproblem;theyjustdon’thaveasolution.TheCarpenterdecisionwasfullofalarmaboutwhatthesesortofdatagrabscouldaccomplish.TheChiefJustice—writingforthemajority—described“theseismicshiftsindigitaltechnology”49thattodayallowthegovernmentto“achieve[]nearperfectsurveillance.”50Notjustinthehereandnow,hepointedout,butretrospectively.“[T]heGovernmentcannowtravelbackintimetotraceaperson’swhereabouts,”giving“policeaccesstoacategoryofinformationpreviouslyunknowable.”51Andnotjustforcriminalsuspects—“thisnewfoundtrackingcapacityrunsagainsteveryone.”52Manycommentators,andeventhejusticesthemselves,havecalleduponlegislativebodiestostepinandregulatesurveillancetechnologies,butforthemostpartthesortofdatacollectiondiscussedhereisentirelyunregulated.Somestateshavelawsgoverninglicenseplatereaders;mostdonot.TherearestatelawsgoverningDNAdatabases,butpolicingagencieshavecircumventedthembycreatingunregulatedlocalones.53Thedatabrokerbusinessisforthemostpartunregulated.SotootheuseofmobileforensicdataterminalslikeCellebrite.Thelistofwhatreceivesnoregulationfarexceedswhatregulationthereis.IIIngeneral,therightanswertothevacuumsurroundinggovernmentsurveillancedatacollectionislegislation,notconstitutionallaw.Datacollectionofthesortwearediscussinghasmanyfacets,allofwhichrequireregulation.Hereisashortlistofthingsthatneedtobeaddressed,anditishardtoseeconstitutionallawdoingthetrick:Whatdatacanbecollected?Onwhom?Howlongcanitberetained?Whatisthepredicateforaccessingthedata?Whatisthesecurityforthedatastorage?Whatsortofauditingshouldtherebe.Andsoon.Thesearenotthesortof?ne-grainquestionsconstitutionallawaddresses.Legislationcanandshould.Theproblemisthatlegislatorshavelittleincentivetopassthesortoflegislationthatisneeded.Doingsowillangerpowerfulpoliceorprosecutionlobbiesorleavethemvulnerabletolaterclaimsthattheyweresoftoncrime.Thereisavastliteratureonthis.54Anditiswhymostofthecollectionofsurveillancedataremainsunregulated.HooverInstitution?StanfordUniversity8Whatconstitutionallawcoulddoismotivatelegislativeaction.Twothingstendtoovercomelegislativeinertiatodonothing:highlysalientcasesthatmotivatethepublictocallforregulation,andcourtdecisionsthatforcelegislation.AnexampleoftheformerishowthereactiontoEdwardSnowden’srevelationscausedCongresstoadopttheUSA-FreedomAct,takingthedataoutofNSAhandsandrequiringacourtordertoaccessit.55AnexcellentexampleofthelatterishowtheSupremeCourt’sdecisionsinBergerv.NewYork56andKatz?v.UnitedStates57motivatedthefederalwiretappinglaw.58WhatIwanttoargueisthatconstitutionallawnotonlycouldmotivatesuchlegislativeregulationofsurveillancedatacollection,butthatitmust.Itwould,ineffect,operateasa“penaltydefault”rule,changingthestatusquofrom“collect,andlegislaturescanregulateiftheywish”to“beforeanygovernmentagencycancollectthisdata,theremustbelegislativeregulation.”59Therearefourpartstomyargument,allofwhicharecomplexintheirownright.I’venotgotthespacetodiscussthemallfullyinthispiece.Iintendtohoneinonthe?rstpartoftheargument,andsummarizetherest.ButbeforeIdo,Iwanttolayoutthefullargumentbrie?y,sothatitsarcisclear.First,inmanyotherareasinwhichgovernmentcollectsinformationaboutprivateindividuals,theConstitutionlaysoutasetof“requisites”beforethatdatacollectioncanproceed.CasesariseundervariousclausesoftheConstitution(includingtheFourthAmendment).Theyariseinthecriminalandinthecivilcontext.Theyinvolvecollectionbythefederalgovernment,butalsobystateandlocalgovernments.Acrossalltheseareasthereisaremarkablecommonalityofwhatcourts—andespeciallytheSupremeCourt—saymustbeinplaceforthecollection,retention,anduseofthedatabythegovernment.Courtsrequirethatdatacollectionbeauthorized,thatitbeforalegitimatepurpose,thatthecollectionfurtherthatpurpose,thatwhenprivacyisatstaketheneedfortheregulationoutweighthecostsofintrudingonprivacy,thattherebeproceduresinplacetominimizeunnecessarycollection,andtosafeguardagainstinappropriatedisclosure.Second,theonlyreasonthatgovernmentsurveillancedatacollectionescapestheembraceofordinaryconstitutionallawisbecause—aswesawabove—thecollectionitselfisnotconsideredtoimplicatetheConstitutionatall.Thesecondpartofmyargumentisdirectedatthisclaim.Theshortansweristhatconstitutionallawevolvesconstantlyinthefaceoftechnologicalchange,especiallyintheareaofgovernmentsurveillance.AsI’veindicatedabove,wiretappingwasentirelyoutsidetheConstitution,untiltheSupremeCourtpivoted.Sotoowithlocationtrackingonopenroads.TherearemanyotherexamplesandFourthAmendmentlawisfullofthem.WhatIshowinotherworkisthattherearenofewerthansixdifferentwaystobringbulkdigitalsurveillancedatawithintheConstitution,noneofthemrevolutionary.60Andthatthecostofdoingsoisnottoimpedecollectionbythegovernment,butonlytorequireitoccurpursuanttolegislativeregulation.BarryFriedman?PrivateData/PublicRegulation9Theargumentthusfarspeakstogovernmentcollectingdataonindividuals,nottoprivatecompaniesdoingso,whichraisesthequestionofwhatshouldhappeninthelatterinstance.Manytodayarecallingforregulationofprivatedatacollection,forexamplebydatabrokers.Itseemsappropriatetoconsidersuchregulation,butthatisneithermymissionherenordoIthinkitwillbeadequatetotheproblem.Yes,ThomsonReuters,LEXIS,andalltherestshouldberegulated.Butmanyentitiesthatarenotconsideredprimarilyinthedatabusinessnonethelessarearichsourceofdataforlawenforcement.Thebetteransweristoregulatelawenforcementitself,anditsaccesstosuchdata.Thatisthethirdstepinmyargument.Whichistosay,ingeneraltermstheconstitutionalargumentI?amadvancinghereshouldapplytogovernmentacquisitionofsurveillancedata,nomatterwhethergovernmentacquiresthedataitself,orgetsitfromthirdparties.Thedetailsmaydiffer—undoubtedlytheyhaveto.Butasthesurveyofcasesinwhichwewillsoonembarkmakesclear,theconstitutionalrequisitesapplywhetherthegovernmentcollectsdatabywayofsubpoena,othercourtorder,administrativeprogram,orlegislativeprogram.Finally,thereisthequestionofwhatpreciselyconstitutionallawshouldrequireoflegislativebodies.Whataretherequisitesofconstitutionallawregardinggovernmentcollectionofsurveillancedata?Onceagain,fullexplicationoftheanswerswillhavetoawaitotherwork,butsuper?ciallytheanswersarenotcomplicated,andwillemergefromthecasesIdiscussnext.Theyaretheveryrequisitesidenti?edabove,fromlegislativeauthorizationtogatherholdandusethedata,tohowitissecured.Thecaselawmakesallofthisreasonablyclear.Sothat’stheargument:beforegovernmentcancollectsurveillancedatainbulk,theConstitutionrequiresanadequateregulatoryscheme.ThisfollowslogicallyfromthecasesI’mabouttodiscussatsomelength.Itwor