President Trump, Populist Politics, and the Prospects for Privacy

I was on a panel on Wednesday at the Computers, Privacy, and Data Protection conference in Brussels on the topic of “Populist Politics and the Prospects for Privacy”.

Through no fault of the organizers, who were extremely accommodating of my last-minute proposal for this panel after the US elections, we had less time than we had hoped for. There’s video of the session, but I was rushed and probably not always clear.

[My pussy hat — the symbol of the Women’s Marches last weekend after Trump’s inauguration — was popular at CPDP. Photo by kind permission of Wendy M. Grossman. Thanks to Suzanne and another Wendy for knitting and giving me the hat!]

By popular request, below the jump is a summary of the main points I tried to make.

(For those interested in more detail, I’ve posted my notes on issues I would have liked to raise, if we had more time. I’ve also posted a separate article at PapersPlease.org on President Trump’s executive order repudiating the EU-US agreement on transfers of PNR data from the EU to the US government.)

1. Government or commercial privacy invasion?

Trump, Trumpism, and similar populist authoritarian leaders and movements (more technically defined as “fascist”, as my fellow panelist Jay Stanley of the ACLU noted) are a threat to more than our privacy, of course.

But with respect to privacy, the first question is whether the greater threat is of privacy invasion by the government under Trump, or of privacy invasion by businesses unleashed by Trump Administration policies.

For several reasons, I think it’s the latter.

Trump differs from his allies in the “mainstream” Christian-fundamentalist conservative and reactionary wing of the Republican Party on some issues. But one of their main points of alignment is their commitment to “get government regulators off the backs of businessmen”.

Trump’s opposition as a billionaire to government regulation of commercial entities is even more fervent and absolutist than that of the Reagan Revolutionaries.

Privacy protections are among the government regulations opposed by Trump and his allies.

There is no chance that any new Federal privacy protection legislation will be enacted in the next four years. There will be no enforcement by the Trump Administration of the limited existing Federal law that could be applied to consumer privacy.

I heard some people saying otherwise at CPDP. Some of them knew they were lying, to promote their economic or political interests. Others were sincerely self-deluded. But they are wrong. Trump has made his intentions clear with respect to deregulation, and he has the votes in Congress to carry them out. Aggressive rollback of any obligation imposed by government on businesses to respect consumers’ privacy is part and parcel of that deregulatory agenda.

US corporations now know — notwithstanding the propaganda their spokespeople and shills were putting out at CPDP — that the Trump Administration will not, in practice, take any action against even egregious violations by businesses of individuals’ privacy. The practices of US corporations have been bad (not that corporations in the rest of the world have been much better). But they will get worse, much worse, now that all concern about possible government sanctions is gone.

As for foreign governments, privacy or data protection laws — like other consumer protection, environmental, climate change, or labor laws — will be treated by the Trump Administration as interference with its “America First” trade policy. Countries that attempt to enforce such laws against US companies will be subjected to retaliatory US trade sanctions. And any call on the US to conform to international norms will be responded to as an existential attack on US sovereignty.

2. Xenophobia

A common feature of Trump’s type of authoritarian populism is a xenophobic rhetoric of “us versus them” that scapegoats foreigners and supposedly foreign values as the source of national problems.

“If we could just get rid of the foreigners in our midst (as I define them, regardless of how long they have lived here) who are taking our jobs and corrupting our values, we could restore our economic power and our rightful place in the world and make [insert country name] great again” summarizes the campaign pitches of candidates including Hitler, Trump, Erdogan, Farage, Le Pen, and many others.

Privacy-invasive measures of surveillance and profiling are seen by xenophobes as necessary to identify the concealed sources of alien ideologies and foreign influences, to separate the loyal from the disloyal, and to root out and guard against the entry of those who don’t subscribe to the values the regime defines as part of the national identity. In the US, for example, every Red Scare has defined Communism as “un-American” and atheist, and has included round-ups and deportation of those blamed for infecting the nation with this allegedly contagious and “foreign” ideological plague.

The extremes of the US government’s attack on privacy under the Trump Administration will be directed at foreigners and anyone who associates with them or crosses international borders. Most native-born US citizens have never had a passport, never crossed an international border, and never been in a place where most people speak a different language, use a different currency, or worship a different god or gods or — god forbid — no god at all. To many of Trump’s more isolated and isolationist supporters, internationalism is un-American and international travel is per se suspicious.

Trump has made some of his priorities for privacy invasion and profiling of foreigners and international travellers clear in his campaign slogans, which include “extreme vetting” of immigrants and a promise to “Build the Wall” between the US and Mexico.

What will “extreme vetting” and “build the wall” mean in practice?

Vetting of individuals — reviewing dossiers of personal information to decide how to treat them — is inherently privacy invasive. The US government already practices extreme vetting of immigrants and all border crossers, including US citizens: The DHS obtains and retains a complete mirror copy of their airline reservations (“Passenger Name Record”), combines it with whatever data about the person it can aggregate from government and commercial sources, and feeds the whole mess through a black box of secret pre-crime profiling and scoring algorithms that decides whether to send a “Boarding Pass Printing Result” to the airline giving it permission to transport the person, or to take other action such as ordering more intrusive search or questioning or having police detain the traveller. The default is “no” — silence from the government means denial or transport

So how can this get more extreme? The only obvious way to expand the system is to include or connect the vetting system to more extensive (and less reliable) sources of personal information, such as additional government databases and “garbage in, garbage out” commercial data aggregators. I expect Trump to do that through both the Automated Framework for Intelligence (for immigrants and foreign-citizen visitors) and the Automated Targeting System (for all international travellers and border crossers including US citizens).

Both AFI and ATS have been exempted from most of the requirements of the Privacy Act, and that certainly won’t change under Trump. Both the algorithms and the data inputs will remain secret.

As for the wall, Trump can’t build it by executive order. Mexico isn’t going to pay for it, and Congress would have to appropriate the money. And there is already a physical wall along much of the US-Mexico border.

What Trump can and probably will do is raise the height of the “virtual wall” by increasing the volume of personal data collected about border crossers, and expanding the current real-time profiling and permission system from airline flights and vehicular border crossings to individual pedestrians.

He could also increase the dataveillance of Mexican citizens and other foreigners within the US,through measures such as expansion of existing (but not always enforced, because businesses depend on undocumented workers) requirements for ID documents, proof of “lawful presence”, and reporting of transactions to the government for routine activities within the US: employment, health care, transportation, banking, etc. While justified on grounds of immigration law enforcement, those requirements will — and already do — result in control and monitoring of US citizens as well.

Finally, he could push the virtual borders back further away from the physical boundaries of US territory by expanding and globalizing the use of carrier sanctions that induce airlines and other commercial transport companies to act as (unqualified) asylum judges and deny passage to those the US deems undesirable, without the accountability that would attach to decisions made by government officials. (I’ll be posting a separate article about this problem, which predates Trump but which he is likely to continue and expand.)

3. Rule by fiat

Populist rule is personal rule, and The Donald doesn’t like to delegate authority.

To support Trump or a similar leader is to trust them to make the right decisions for the nation. That doesn’t call for deliberation or compromise. I expect that Trump will make as much use as he can of executive orders to avoid the need for Congressional approval or the delay and inconvenience of consulting even his own party supporters. Those who criticize rule by decree will be denounced as un-American obstructionists, and Trump will call on his supporters to retaliate against them.

The power of the US Presidency with respect to the legislative and judicial branches of government has expanded steadily since at least the New Deal of Franklin D. Roosevelt, under both Republican and Democratic administrations. The party in power in the White House always wants to give the President more power to use against Congressional opposition or judicial resistance. That was certainly true of President Obama, whose legal defense of executive authority and whose use of Executive Orders to work around a hostile Congress created precedents and tools that have now been handed over to President Trump.

Everything Obama has done by Executive Order, Trump can and will undo by Executive Order.

What will that mean for privacy under the Trump administration?

In the absence of either strong Federal privacy law or effective mechanisms in the US for judicial enforcement of Constitutional and international treaty protections for privacy, several key aspects of privacy in the US are matters of executive discretion, rather than enforceable legal rights.

In particular, both the so-called Privacy Shield and the EU-US agreement on transfers of Passenger Name Record (PNR) data from the European Union to the US government depend on the exercise of administrative discretion by US Federal agencies and on non-treaty “promises”, “commitments”, “undertakings”, and executive orders by the Obama Administration.

These are not binding on President Trump, and there is no reason to expect Trump do anything just because Obama said he would do it. With Trump’s inauguration, the EU-US PNR agreement and Privacy Shield are dead letters. The only questions are (a) whether the Trump administration will officially renounce them, or whether it will simply ignore them, and (b) what Europeans will do about that.

[A few hours after this panel at CPDP, President Trump issued an Executive Order which forbids the DHS from fulfilling the US “undertakings” in the PNR agreement. For a more detailed analysis of this Executive Order and its implications for the PNR agreement, see my article on PapersPlease.org, “Trump repudiates agreement with EU on PNR data”.]

Populists rely on trust in the infallible ability of the Leader to discern the national will as a substitute for the rule of law or judicial oversight. But Trump cannot, and should not, be trusted.

In the absence of trust or of reliable checks and balances within the US, it is more important than ever to look closely at the mechanisms for auditing and enforcement of compliance with otherwise non-binding Presidential press releases and executive orders that can be rescinded or ignored at whim.

It is more important than ever to insist that international commitments be ratified as treaties, and that those treaties contain explicit enforcement provisions that do not depend on further action (such as the enactment of additional implementing legislation, or voluntary submission to international jurisdiction — something Trump will never do) to obtain compliance or enforce sanctions.

Failing that — and the likelihood that Trump would sign, or the current Senate would ratify, any privacy treaties is nil — one thing that can help is mandatory permanent and unchangeable logging of access to personal data. The right to an accounting for disclosures to third parties is often considered a footnote to the right of access to personal data about oneself. But access logging is essential to oversight or enforcement of policy restrictions on access. Without access logs, we will all have to trust Trump to do what he says — and he shouldn’t be trusted. If third-party access or use can’t be prevented, access logging (and subject access to those logs) can be critical to the ability of data subjects to defend against and mitigate the damage from disclosure of their data.

4. Resistance

We can argue about whether there should have been more opposition to Trump and his political movement sooner, what forms it should have taken or should now take, or why there was so much less opposition to many of the same policies when they were being pursued by the Obama administration.

But the unarguable fact is that Trump’s election has prompted the emergence of a women-centered grassroots opposition movement of unprecedented scale, scope, spontaneity, and strength.

Even Nixon’s re-election didn’t provoke such massive and immediate protest, despite widespread revulsion at Tricky Dick’s policies and political methods. The closest parallel in my lifetime to the reaction to Trump’s election and inauguration was the movement that developed against President Reagan — like Trump, a media figure with no policy expertise and extreme views rooted in ideology rather than fact.

Reagan was better than Trump mainly in that Reagan delegated much of his authority to aides and advisors who acted in a relatively “normal” although extremely reactionary manner. Trump hasn’t delegated as much authority or given his aides the ability to rein in his whims and temper tantrums.

More significantly in this context, while the largest single political gathering in US history — more than a million people include me and many of my friends at a rally for unilateral US nuclear disarmament in Central Park in New York City on 12 June 1982 — was a response to the fear that Reagan would start a nuclear war that would destroy life on earth, that movement took a year and a half after Reagan’s election to reach its peak.

More people than that took part in the Women’s Marches last Saturday on the first day of Trump’s Presidency. The largest of those marches, in Los Angeles, was estimated by the police at 500,000 and by the L.A. Times — not a liberal institution — at 750,000. Numbers of marchers in several other cities were over 100,000, with the total number of marchers nationwide estimated at three to five million.

Time will tell, but I think it is profoundly important, and a sign of progress, that the Women’s Marches (like their symbol the pink “pussy hats”) were (a) women-centered and women-led although they brought out many men and (b) not organized through any existing or centralized organizations, but through informal grassroots online and offline social networks.

That women-centered and spontaneous character will, I think, be the greatest strength of the “Dump Trump” movement. Pussy hats are not a joke. Trump’s boast that if you are a rich man, you can assault any woman with impunity, is not a side issue. Feminism is anti-fascist.

There are also encouraging signs of resistance among some of the workers in Silicon Valley, government agencies, and elsewhere whose active collaboration — not mere acquiescence — will be needed by Trump to carry out his agenda.

Trump’s opponents are primed to pour into the streets in their pussy hats at the next outrage.

The question is not whether, but when, and on what specific issue, that will come.