胡佛研究所-私人数据公共监管（英）-2021-28正式版

AHOOVERINSTITUTIONESSAYPrivateData/PublicRegulationBARRYFRIEDMANAegisSeriesPaperNo.ꢀ2105IntroductionPolicecollectinformation—thatiswhattheydo,andtheycouldnotdoitwithouthelp.Nodoubtfromthebeginningofpolicing,officershaverelieduponprivatepartiestoaidtheirinvestigations.Tipsterstip,snitchesarepaid,andwell-meaningdenizenssharetheinformationtheypossess.Atcrimescenes,policecollectthenamesofpeoplewhomayhaveꢀseensomethingandfollowuponthoseleads.Andforthemostpartthishasbeen,andꢀremains,unregulated.Buttherehasbeenaseachange,broughtuponusbytechnology,achangesodramaticithastransformedpolicingitself.Increasingly,theinformationpolicecollectisdigital.Fewersearchwarrants,morerequestsfororderstoharvestmetadata.Purchasinglargepoolsofprivatedatafromdatabrokers.Capturinglocationinformationinvariousways.Tappingintoanetworkofprivatesecuritycameras.Andsoon.Sometimespolicecollectthedatathemselves.Moreoftentheygatheritfromthirdparties.Theydosofromvolunteers,bypurchase,andbycourtorder.1Thedigitalnatureofthedataallowsittobeacquiredinbulk.Ratherthanjustfocusingonthetargetofaparticularinvestigation,thegovernmentcangathertheinformationindiscriminatelyaboutlargeswathsofthepopulationorevenaboutallofus.2ThiswastheꢀcasewiththeNationalSecurityAgency’scollectionofourtelephonemetadata,butitalsoisthecaseatthelocallevelbyautomatedlicenseplatereaders.3Theusesofthisdataaresobroadthatitisnotjustwhatwetraditionallythinkofasthe“police”whogatherthedata,butavarietyofgovernmententitiesinvolvedinpublicsafetyandlawenforcement.Bulkdatacollectionhasallowedlawenforcementtoshiftitsfocusfromareactiveinvestigativestancetoaproactiveanddeterrentone.Thepolicelonghaveinvestigatedparticularcases,withsuspectstheyhadinmindorweretryingtoidentify.4Now,governmentagenciesutilizelargedatabasestopredictwherecrimewilloccur,orminethemforevidenceofcriminality.5Thisoccurswithoutaparticularsuspectinmindandisaimedmorebroadlyattheentirepopulationorasegmentofit.Nodoubtthisdatacollectionhasvalue,butpreciselyhowmuchisanopenquestion,andmaydependinpartonitsuse.Forexample,datacollectedfromthirdparties,suchasgeneticinformation,hashelped—tosolvecoldcases.6FacialrecognitionwasvitaltoidentifyingtheinsurrectionistsofJanuaryꢀ6,2021.7Theseareinvestigativeuses.Here,the2valueisplain,buttheextentofthatvalueunknown.Theutilityofbulkdatacollectionforpredictiveordeterrentpurposesisfarmoreuncertain.8Intruththereisfartoolittleassessmentoftheutilityofthesenewtechniques,forwhateverpurposetheyaredeployed.Butonethingisclear:placingthismuchpersonaldatainthehandsofthegovernmenthasitscosts.Itendangersourpersonalsecurity,andoursenseofprivacy.Itthreatensourrighttoassociate,includingforpoliticalactivity.Itputsenormouspowerinthegovernmenttocontrolbehavior.Andtoooftenthecollectionisdisproportionatelyofpeopleofcolor.I’mgoingtomakeanovelargumentthat,ifadopted,wouldallowforcapturingthebenefitsofdata-drivenpolicing,whilemitigatingitscosts.Myargumentisthatgovernmentagenciesthatengageinpolicingcannotcollectdigitaldata,particularlyaboutindividualsforwhomthereisnosuspicionofwrongdoing,withoutasufficientregulatoryschemeinplace.Thus,ifthesepracticesaretocontinue,legislativebodiesmuststepinandadoptregulation.What’snovelaboutmyargumentisthatIframeitinconstitutionalterms.I’mnotjustarguingthatregulationisdesirableasanormativematter.Mypreciseclaimisthatasamatterofconstitutionallaw,unauthorizedandunregulatedbulkdigitalcollectionofsurveillancedatasimplymaynotoccur.Absentsuchauthorizationandregulation,courtsshouldinvalidatesuchcollection.Morebluntly:withorwithoutcourtintervention,governmentagenciesinvolvedinthepolicingfunctionshouldceaseimmediatelywhattheyaredoinguntilsufficientauthorizationandregulationisinplace.Isupportmyargumentbyshowingthatinmanycontexts,underanumberofconstitutionalamendments,whengovernmentseekstocollectpersonalinformation,courtsimposeasetof“requisites”beforesuchcollectionismandatedorupheld.Theserequisitesincludethatthecollectionofdataisstatutorilyauthorized,thatitfurthersalegitimategovernmentpurpose,thatcollectionisminimizedtoprotectprivacyandpersonalsecurity,thataccesstothedataissafeguarded,andthatjudicialreviewisavailabletochallengethecollection,retention,anduseofsuchdata.Notethatvirtuallyallofthisismissingfromtoday’scollectionofsurveillancedatabygovernment.Thatiswhatmustchange.Iamnotarguinggovernmentcannotcollectthedata,butthatbeforeitdoes,authorizationandregulationbyademocraticallyaccountablebodyisessential.Thisputsthedecisiontocollectthedata,andminimalsafeguardsattendantthereto,inproperhands,ratherthanlettinggovernmentpolicingofficialssimplydecideforthemselves.AlthoughIhopeithasverybasicnormativeappeal,myargumentisacomplexonewithanumberofmovingpieces.I’mnotgoingtohavethespacetolayitallouthere,butIamdoingsoinotherwork.9InPartI,Iwilldescribethephenomenonofwidespreaddigitalsurveillancedatacollectionthatdrawsmyattention.InPartII,IwillsketchoutmyBarryFriedman•PrivateData/PublicRegulation3argument,brieflybutinfull.PartIIIthenwillhoneinonthebodyofconstitutionallawcentraltomyargument,thecasesIdescribejustabove.PartIVwillall-too-brieflytouchonrelatedpartsoftheargumentandconclude.IIwanttobeginbybrieflydescribingthedevelopmentsthatmotivatethepaperandtohighlighttwoparticularaspects.First,althoughmanyhaveexpressedalarmthatprivatecompaniesarecollectingandaggregatingenormousamountsofdataaboutus,governmentsarebuildingsimilardatabasesontheirownforlawenforcementpurposes.Theremaybebenefitstoallthis,buttheresurelyarecosts.Yet,second,theConstitutionaspresentlyconstrued—particularlytheFourthAmendment—hasprovenoflittlevalueinregulatingthepracticeofdatacollection,retention,anduse.Intheabsenceofconstitutionalregulation,therehasbeensomelegislativeintervention,butfarlessthanisnecessarytocoverthefieldorbringgovernmentsurveillancedatacollectionunderthecontrolitrequires.I.APolicingagenciesatthenationalandlocallevelarebuildingvastdatabasestokeeptabsonusall.TheFBIisconstructinganenormousbiometricdatabasethatwillincludefacialimages,irisscans,voiceandpalmprints.10NewYorkisoneofseveralcitieswithanextensiveDomainAwarenesssystem,whichcollectsandaggregatesinformationfromanetworkthatincludesover9,000cameras,500licenseplatereaders,anddatafromgovernmentdatabases.11Nolongercontentwithusingstate-runandregulatedDNAdatabases,localdepartmentshavebeguncreatingtheirownversions,snatchingDNAinanywaytheycangetit:bysurreptitiouslynabbingbeveragecupsfrompeopletheysuspect,toaskingconsentfromvictimsorpeopletheywishtoclearininvestigations,andthenretainingit.12ThepoliceusetechnologylikefromthecompanyCellebritetovacuumuptheꢀcontentsofcellphonesduringroutinesearches,andhoarditforlateruse.13Notcontentwiththeirowndatacollectionefforts,however,policingagenciesincreasinglyarerelyingonprivatedatasourcestomonitororprovideinformationaboutthepublicforthem.OneofthelargestistheCLEARdatabasemaintainedbyThomsonReuters,whichadvertisesCLEARasa“[p]owerfulpublicrecordstechnology”that“bringsallkeycontenttogethertoprovideintelligentanalyticsinoneenvironment.”14Thatdatabasecompilesextensiveinformationonpeople’scredit,employment,andsoforth.ArecentstorytoldhowICEwasusingCLEARtotraceundocumentedindividualsusingutilityusageinformation.15ThomsonReutersisnotalone;anotherrecentnewsstoryrelatedhowICEapparentlyisswitchingdatavendors,movingovertothedatabaserunbyLexisNexis.16Databasesthattrackourlocationareparticularlyillustrativeofthepublic-privatepartnershipsinthisspace.Automatedlicenseplatereaders(ALPRs)provideanexcellentexample.ALPRssitonpolicecarsorothervehicles,oraremountedinfixedlocations,andHooverInstitution•StanfordUniversity4theysuckinthelicenseplatesofmotoristsaroundthem,geolocatingwherethosecarsareatthatmoment.17OriginallythepointofALPRswastocomparethereadstoa“hotlist,”suchastodetectstolenvehicles.18Butlawenforcementagenciessoondecidedtherewasvalueinretainingthereadsincasetheyprovedusefullaterinacriminalinvestigation.19ManydepartmentsnowuseALPRsextensively,bothtocreatehugedatabasesofwhereautomobileshavebeenwhen,andtogeofencetheircommunitiessotheyknowwhoiscomingandgoing.Axon,theleadingU.S.sellerofbodycamerasandTasers,isreleasinganewdigitalALPRsystemthatturnsordinarypolicecardashcamsintopowerfultoolsthatcancollectreadsfromtrafficacrossthreelanes,frontandback,aspolicecarsmoveonpatrol.20TheLAPDhasadatabaseofsome320millionlicenseplatesthatitstoresforatleastfiveyears.21MyrtleBeach,SouthCarolina,keepstabsonvisitorswithALPRcamerascoveringallexitandentrancepointstotheshoretown.In2019thosecamerascapturedalmost40millionreads.22Butpolicingagencieshaveexpandedtheircapabilitiessubstantiallybylinkingupwithprivatevendorstocreateanetworkoftrackingandtracingcapability.TheindustryleaderinthisspaceisVigilant,ownednowbyMotorolaSolutions,whichadvertisesandmakesavailabletopolicingagenciesadatabaseofover500billionstoredgeo-locatedrecords.Vigilant’sdatabaseisfedwithlicenseplatereadersattachedtorepotrucks,butalsogarneredfrompolicingagenciesthatturntheirinformationover,ofteninreturnforaccesstothelargerpoolofdata.23I.BThesepublic-privatepartnershipsmayhaverealadvantagesforpolicingagenciesandforpublicsafety,butonepervasiveprobleminthisareaisthelackofanysystemicattempttoidentifythosebenefits.CopswillofferupanecdotesaboutthetimeALPRevidencehelpedcrackacase,butwedon’tknowiftheALPRwasessential,orhowvaluableitproved,letalonehowoftenthatwasthecase.Therearewell-knownexamplesabouthowrelianceonthird-partydatahelpedcracknotoriouscoldcases,suchasthatoftheGoldenStateKiller.24Buthowoftendoesthishappen?Ifwearegoingtoallowthegovernmenttocreateorrelyonthirdpartiestoprovidehugeaggregateddatabases,itseemsincumbentupongovernmenttoprovethevalue.Iwillreturntothispointbelow.Fornow,though,Iwanttofocusontheharmsfromthissortofdataaggregation,becausetheyarewhatmakethecaseforregulation.Ifbenefitswereuncertainbutharmsnonexistent,ouronlyconcernwouldbethepotentialsquanderingofgovernmentresources.Theloudpushbackweheartodayagainstgovernmentcollectionanduseofprivatedatasuggestsmuchmoreisatstake.First,therearethethreatsfromerrorsinthesedatabases,andthougherrorisasmallword,thedangerhereisenormous.ThesemistakescausepeopletobecomelawenforcementBarryFriedman•PrivateData/PublicRegulation5involved,andthenewsatpresentisalltooclearabouttherisksthosepoliceencounterspose.Atbesttheyareanintrusiononlibertyandpsychologicallystressful;atworsttheyendupinpoliceshootingsorotherusesofforce.AlbertFlorencewaspickedupforanoutstandingwarrantonafinethathadbeenpaidbuterroneouslyrecordedasopen.“Hespentsevendaysinjail”and“wasstrip-searchedtwice”inthattime.25RobertJulian-BorchakWilliamssufferedasimilarfalsearrest,thistimebecauseafacialrecognitionalgorithm(withahumansupposedlyintheloop)wronglyID’edhimforshopliftingfromahigh-endboutique.Despitehisdenyingtheimagewashimhespent30hoursinjail,andhiswifehadtoclaiman“emergency”tohisemployerlestherisklosinghisjob.26Itisimpossibletoknowthemagnitudeofthese“errors,”butonecanreasonablyestimatethattherearetensifnothundredsofthousandsofstaleorerroneouswarrantssittingindatabaseswaitingtoresultinawrongfularrest.27Second,there’smisuseofthedatabases,justthekindofthingyou’dexpectwhenyouleavehugestoresofpersonalinformationlyingabout.Alegislativeauditfoundthatoverhalfofthe11,000lawenforcementpersonnelwhosearchedtheMinnesotaDepartmentofPublicSafetydriverdatabaseconductedsearchesthatwere“questionable.”28Alltoooftentherearestoriesofpolicingpersonneldippingintothedatabasestospyonpeoplewithwhomtheyhavepersonalissues—frequentlystalkingintimatepartners.29Third,andperhapsmostimportant,allowinggovernmenttoaccumulateandhaveeasyaccesstodetaileddossiersonallofusthreatensourpersonalandcollectivesecurity.30Therearealwaysthoseeagertoargueitcan’thappenhere,butitcan—andtoooftenithas.Fordecades,aspartofitsCOINTELPROoperation,theUnitedStatesintelligencecommunitynotonlykepttabsontheCivilRightsandWomen’sRightsmovements,butalltoooftenattemptedtointerveneinwaysthatwereinsidioustodemocracy.31“Fusioncenters”—federallysupportedstateandregionalintelligence-gatheringhubs,oftenrelyingonprivatelycollecteddata—repeatedlyhavebeencaughtspyingonentirelylawfulFirstAmendmentactivity.32Evenifweacceptedthepurityofgovernmentwatchers—asIdo,forexample,oftheNationalSecurityAgency’svastdatagrabrevealedbyEdwardSnowden—it’sinconceivablethatwewantgovernmenttohaveaccesstoallthisdatawithoutpublicdebateandadequateregulation.Althoughthissortofsurveillancecanfalluponallofus,it’sundeniablythecasethatwhenthegovernmentdeterminestocollectanduseinformationagainstpeople,there’sagoodchancethosewhosuffermostwillbeBlackandbrown.33It’snotasurprisethatRobertWilliamsandAlbertFlorencewereBlack.34I.CThesimplefactisthatmostgovernmentsurveillancedatacollection,bypolicingagenciesorviathirdparties,isprofoundlyunder-orunregulated.TheConstitutionaspresentlyinterpretedoffersalmostnoprotectiontothesortofwidespreaddatacollectionbytheHooverInstitution•StanfordUniversity6government.35Thereissomelegislationinthisspace,suchasthefederalElectronicCommunicationsPrivacyActandvariousstateandlocallaws,butmostofitisalreadyoutdated,andingeneralwhatpoliceandprivatedatacollectorsdohappenswithoutanyregulation.AsBenjaminWitteswrites,aptly,“[m]ostofthisdataisnotplausiblyprotectedbytheFourthAmendment.Muchofitisnotprotectedbyanylawatall.”36Absentasmallnichedoctrineof“privatesearches”theConstitutiondoesn’tapplyatallwhenthegovernmentacquirespersonalinformationfromprivateparties.TheConstitutionforthemostpartbindspublicactors,notprivateones.Theprivatesearchdoctrineholdsthatunlessaprivateentityeffectivelywas“deputizedbystateofficialsexante,”tosearchorseize,thegovernmentwillnotbeheldaccountablefortheaction.37Asoneoftheleadingcasesinthespaceputit,theFourthAmendmentappliesonlyto“governmentalaction;itiswhollyinapplicable‘toasearchorseizure,evenanunreasonableone,effectedbyaprivateindividualnotactingasanagentoftheGovernmentorwiththeparticipationorknowledgeofanygovernmentalofficial.’”38Thelargerdifficultyisthatevenifthegovernmentiscollectingbulksurveillancedata,theFourthAmendment—theonlyconstitutionalprovisionthatdoesanyworkinthisspace—stillhasverylittletosayaboutit.39Ironically,theSupremeCourtincasesinvolving“innovationsinsurveillancetools”hastakentoinsistingthatnomatterwhatelsetheAmendmentmayormaynotdo,it“assure[s]preservationofthatdegreeofprivacyagainstgovernmentthatexistedwhentheFourthAmendmentwasadopted.”40Thatisnotremotelytrue.ThethresholdtriggersfortheFourthAmendmentarethatpoliceconductmustbea“search”or“seizure,”andmostsurveillancedatacollectionnevergetspastthispoint.41First,mostofwhatyoudoinpublic,whichistosaycouldconceivablybeviewedbysomeoneinpublic,isꢀnotdeemedasearch.42So,forexample,intwinnedcases—UnitedStatesv.KnottsandUnitedStatesv.Karo—theCourtheldthatusingabeepertotracksomeonetotheendpointofajourneyonthehighwayswasnota“search.”43Second,underthe“third-partydoctrine”anythingthegovernmentcollectsthatyouhavegivenovertoathirdpartyalsoisnotasearch.44Thatincludesbankrecords,phonenumbersdialed,papersgiventoanaccountant,etc.IntworelativelyrecentcasestheSupremeCourthasheldthatlong-termlocationtrackingcanconstituteasearch,butlikeallexceptionsthesecasesprovetheruleofconstitutionalneglect.InUnitedStatesv.JonesthejusticesreliedonthephysicaltrespassofinstallingaGlobalPositioningSystem(GPS)onacartocollectinformationasthebasisforconcludingitwasasearchandthatawarrantwasrequired.45Moreimportantforpresentpurposes,fivejusticesinJones—concurring—heldthebetteranalysiswasthatlong-termlocationtrackingwasasearch,evenifthesortofshort-termtrackingatissueintheKnottsandKarocaseswasnot.46Then,inCarpenterv.UnitedStates,thejusticesconcludedthatusingacourtordertoacquiresevendaysormoreofcellsitelocationinformationalsowasasearch.47BarryFriedman•PrivateData/PublicRegulation7Thosedecisionswereastepintherightdirection,butitwasababystepatbestandleavesmostofwhatweareconcernedaboutuncoveredbytheFourthAmendment,evenifthepolicethemselvescollectit.First,notetheweirdlinesbeingdrawn:30daysofGPStrackingistoomany;sameforsevendaysofCSLI.Thejusticesaregraspingatstrawstogetinvasivedigitaldatacollectionundercontrol,buttheyreallyarestruggling.Second,asJusticeKennedy,dissentinginCarpenter

rightfullypointsout,whylocationtrackingandCSLI,butnotalltheotherdatagivenovertothirdparties,likeourcreditcardpurchase,orbankrecords,orbillsfromtherapistsandmedicalclinics?48There’snodecentanswertothisquestionandthemajorityofferednone.Thejusticesarenotoblivioustotheproblem;theyjustdon’thaveasolution.TheCarpenterdecisionwasfullofalarmaboutwhatthesesortofdatagrabscouldaccomplish.TheChiefJustice—writingforthemajority—described“theseismicshiftsindigitaltechnology”49thattodayallowthegovernmentto“achieve[]nearperfectsurveillance.”50Notjustinthehereandnow,hepointedout,butretrospectively.“[T]heGovernmentcannowtravelbackintimetotraceaperson’swhereabouts,”giving“policeaccesstoacategoryofinformationpreviouslyunknowable.”51Andnotjustforcriminalsuspects—“thisnewfoundtrackingcapacityrunsagainsteveryone.”52Manycommentators,andeventhejusticesthemselves,havecalleduponlegislativebodiestostepinandregulatesurveillancetechnologies,butforthemostpartthesortofdatacollectiondiscussedhereisentirelyunregulated.Somestateshavelawsgoverninglicenseplatereaders;mostdonot.TherearestatelawsgoverningDNAdatabases,butpolicingagencieshavecircumventedthembycreatingunregulatedlocalones.53Thedatabrokerbusinessisforthemostpartunregulated.SotootheuseofmobileforensicdataterminalslikeCellebrite.Thelistofwhatreceivesnoregulationfarexceedswhatregulationthereis.IIIngeneral,therightanswertothevacuumsurroundinggovernmentsurveillancedatacollectionislegislation,notconstitutionallaw.Datacollectionofthesortwearediscussinghasmanyfacets,allofwhichrequireregulation.Hereisashortlistofthingsthatneedtobeaddressed,anditishardtoseeconstitutionallawdoingthetrick:Whatdatacanbecollected?Onwhom?Howlongcanitberetained?Whatisthepredicateforaccessingthedata?Whatisthesecurityforthedatastorage?Whatsortofauditingshouldtherebe.Andsoon.Thesearenotthesortoffine-grainquestionsconstitutionallawaddresses.Legislationcanandshould.Theproblemisthatlegislatorshavelittleincentivetopassthesortoflegislationthatisneeded.Doingsowillangerpowerfulpoliceorprosecutionlobbiesorleavethemvulnerabletolaterclaimsthattheyweresoftoncrime.Thereisavastliteratureonthis.54Anditiswhymostofthecollectionofsurveillancedataremainsunregulated.HooverInstitution•StanfordUniversity8Whatconstitutionallawcoulddoismotivatelegislativeaction.Twothingstendtoovercomelegislativeinertiatodonothing:highlysalientcasesthatmotivatethepublictocallforregulation,andcourtdecisionsthatforcelegislation.AnexampleoftheformerishowthereactiontoEdwardSnowden’srevelationscausedCongresstoadopttheUSA-FreedomAct,takingthedataoutofNSAhandsandrequiringacourtordertoaccessit.55AnexcellentexampleofthelatterishowtheSupremeCourt’sdecisionsinBergerv.NewYork56andKatzꢀv.UnitedStates57motivatedthefederalwiretappinglaw.58WhatIwanttoargueisthatconstitutionallawnotonlycouldmotivatesuchlegislativeregulationofsurveillancedatacollection,butthatitmust.Itwould,ineffect,operateasa“penaltydefault”rule,changingthestatusquofrom“collect,andlegislaturescanregulateiftheywish”to“beforeanygovernmentagencycancollectthisdata,theremustbelegislativeregulation.”59Therearefourpartstomyargument,allofwhicharecomplexintheirownright.I’venotgotthespacetodiscussthemallfullyinthispiece.Iintendtohoneinonthefirstpartoftheargument,andsummarizetherest.ButbeforeIdo,Iwanttolayoutthefullargumentbriefly,sothatitsarcisclear.First,inmanyotherareasinwhichgovernmentcollectsinformationaboutprivateindividuals,theConstitutionlaysoutasetof“requisites”beforethatdatacollectioncanproceed.CasesariseundervariousclausesoftheConstitution(includingtheFourthAmendment).Theyariseinthecriminalandinthecivilcontext.Theyinvolvecollectionbythefederalgovernment,butalsobystateandlocalgovernments.Acrossalltheseareasthereisaremarkablecommonalityofwhatcourts—andespeciallytheSupremeCourt—saymustbeinplaceforthecollection,retention,anduseofthedatabythegovernment.Courtsrequirethatdatacollectionbeauthorized,thatitbeforalegitimatepurpose,thatthecollectionfurtherthatpurpose,thatwhenprivacyisatstaketheneedfortheregulationoutweighthecostsofintrudingonprivacy,thattherebeproceduresinplacetominimizeunnecessarycollection,andtosafeguardagainstinappropriatedisclosure.Second,theonlyreasonthatgovernmentsurveillancedatacollectionescapestheembraceofordinaryconstitutionallawisbecause—aswesawabove—thecollectionitselfisnotconsideredtoimplicatetheConstitutionatall.Thesecondpartofmyargumentisdirectedatthisclaim.Theshortansweristhatconstitutionallawevolvesconstantlyinthefaceoftechnologicalchange,especiallyintheareaofgovernmentsurveillance.AsI’veindicatedabove,wiretappingwasentirelyoutsidetheConstitution,untiltheSupremeCourtpivoted.Sotoowithlocationtrackingonopenroads.TherearemanyotherexamplesandFourthAmendmentlawisfullofthem.WhatIshowinotherworkisthattherearenofewerthansixdifferentwaystobringbulkdigitalsurveillancedatawithintheConstitution,noneofthemrevolutionary.60Andthatthecostofdoingsoisnottoimpedecollectionbythegovernment,butonlytorequireitoccurpursuanttolegislativeregulation.BarryFriedman•PrivateData/PublicRegulation9Theargumentthusfarspeakstogovernmentcollectingdataonindividuals,nottoprivatecompaniesdoingso,whichraisesthequestionofwhatshouldhappeninthelatterinstance.Manytodayarecallingforregulationofprivatedatacollection,forexamplebydatabrokers.Itseemsappropriatetoconsidersuchregulation,butthatisneithermymissionherenordoIthinkitwillbeadequatetotheproblem.Yes,ThomsonReuters,LEXIS,andalltherestshouldberegulated.Butmanyentitiesthatarenotconsideredprimarilyinthedatabusinessnonethelessarearichsourceofdataforlawenforcement.Thebetteransweristoregulatelawenforcementitself,anditsaccesstosuchdata.Thatisthethirdstepinmyargument.Whichistosay,ingeneraltermstheconstitutionalargumentIꢀamadvancinghereshouldapplytogovernmentacquisitionofsurveillancedata,nomatterwhethergovernmentacquiresthedataitself,orgetsitfromthirdparties.Thedetailsmaydiffer—undoubtedlytheyhaveto.Butasthesurveyofcasesinwhichwewillsoonembarkmakesclear,theconstitutionalrequisitesapplywhetherthegovernmentcollectsdatabywayofsubpoena,othercourtorder,administrativeprogram,orlegislativeprogram.Finally,thereisthequestionofwhatpreciselyconstitutionallawshouldrequireoflegislativebodies.Whataretherequisitesofconstitutionallawregardinggovernmentcollectionofsurveillancedata?Onceagain,fullexplicationoftheanswerswillhavetoawaitotherwork,butsuperficiallytheanswersarenotcomplicated,andwillemergefromthecasesIdiscussnext.Theyaretheveryrequisitesidentifiedabove,fromlegislativeauthorizationtogatherholdandusethedata,tohowitissecured.Thecaselawmakesallofthisreasonablyclear.Sothat’stheargument:beforegovernmentcancollectsurveillancedatainbulk,theConstitutionrequiresanadequateregulatoryscheme.ThisfollowslogicallyfromthecasesI’mabouttodiscussatsomelength.Itwor