: Code 2.0

Worms That Sniff

Worms That Sniff

A worm is a bit of computer code that is spit out on the Net and works its way into the systems of vulnerable computers. It is not a virus because it doesnt attach itself to other programs and interfere with their operation. It is just a bit of extra code that does what the code writer says. The code could be harmless and simply sit on someones machine. Or it could be harmful and corrupt files or do other damage that its author commands.

Imagine a worm designed to do good (at least in the minds of some). Imagine that the code writer is the FBI and that the FBI is looking for a particular document belonging to the National Security Agency (NSA). Suppose that this document is classified and illegal to possess without the proper clearance. Imagine that the worm propagates itself on the Net, finding its way onto hard disks wherever it can. Once on a computers hard disk, it scans the entire disk. If it finds the NSA document, it sends a message back to the FBI saying as much. If it doesnt, it erases itself. Finally, assume that it can do all this without interfering with the operation of the machine. No one would know it was there; it would report back nothing except that the NSA document was on the hard disk.

Is this an unconstitutional worm? This is a hard question that at first seems to have an easy answer. The worm is engaging in a government-initiated search of citizens disks. There is no reasonable suspicion (as the law ordinarily requires) that the disk holds the document for which the government is searching. It is a generalized, suspicionless search of private spaces by the government.

From the standpoint of the Constitution the Fourth Amendment in particular you dont get any worse than that. The Fourth Amendment was written against the background of just this sort of abuse. Kings George II and George III would give officers a general warrant authorizing them to search through private homes looking for evidence of a crime[16]. No suspicion was needed before the officer ransacked your house, but because he had a warrant, you were not able to sue the officer for trespass. The aim of the Fourth Amendment was to require at least suspicion, so that the burden of the search fell on a reasonably chosen class[17].

But is the worm really the same as the Kings general search? One important difference is this: Unlike the victims of the general searches that the Framers of our Constitution were concerned about, the computer user never knows that his or her disk is being searched by the worm. With the general search, the police were breaking into a house and rummaging through private stuff. With the worm, it is a bit of computer code that does the breaking, and (Ive assumed) it can see only one thing. And perhaps more importantly, unlike the general search, the worm learns little and leaves no damage after its finished: The code cant read private letters; it doesnt break down doors; it doesnt interfere with ordinary life. And the innocent have nothing to fear.

The worm is silent in a way that King Georges troops were not. It searches perfectly and invisibly, discovering only the guilty. It does not burden the innocent; it does not trouble the ordinary citizen; it captures only what is outside the protection of the law.

This difference complicates the constitutional question. The worms behavior is like a generalized search in that it is a search without suspicion. But it is unlike the historical generalized search in that it creates no disruption of ordinary life and discovers only contraband. In this way, the worm is like a dog sniff which at least at airports is constitutionally permissible without probable cause[18] but better. Unlike the dog sniff, the worm doesnt even let the computer user know when there is a search (and hence the user suffers no particularized anxiety).

Is the worm, then, constitutional? That depends on your conception of what the Fourth Amendment protects. In one view, the amendment protects against suspicionless governmental invasions, whether those invasions are burdensome or not. In a second view, the amendment protects against invasions that are burdensome, allowing only those for which there is adequate suspicion that guilt will be uncovered. The paradigm case that motivated the framers does not distinguish between these two very different types of protections, because the technology of the time wouldnt distinguish either. You couldnt technically have a perfectly burdenless generalized search in 1791. So they didnt technically express a view about whether such a search should be constitutionally proscribed. It is instead we who must choose what the amendment is to mean.

Lets take the example one step further. Imagine that the worm does not search every machine it encounters, but instead can be put on a machine only with judicial authorization say, a warrant. Now the suspicionless-search part of the problem has been removed. But now imagine a second part to this rule: The government requires that networks be constructed so that a worm, with judicial authorization, could be placed on any machine. Machines in this regime, in other words, must be made worm-ready, even though worms will be deployed only with judicial warrant.

Is there any constitutional problem with this? I explore this question in much greater detail in Chapter 11, but for now, notice its salient feature. In both cases, we are describing a regime that allows the government to collect data about us in a highly efficient manner inexpensively, that is, for both the government and the innocent. This efficiency is made possible by technology, which permits searches that before would have been far too burdensome and invasive. In both cases, then, the question comes to this: When the ability to search without burden increases, does the governments power to search increase as well? Or, more darkly, as James Boyle puts it: Is freedom inversely related to the efficiency of the available means of surveillance? For if it is, as Boyle puts it, then we have much to fear[19].

This question, of course, is not limited to the government. One of the defining features of modern life is the emergence of technologies that make data collection and processing extraordinarily efficient. Most of what we do hence, most of what we are is recorded outside our homes. When you make telephone calls, data are recorded about whom you called, when, how long you spoke, and how frequently you made such calls[20]. When you use your credit cards, data are recorded about when, where, what, and from whom you made purchases. When you take a flight, your itinerary is recorded and possibly profiled by the government to determine whether you are likely to be a terrorist[21]. If you drive a car in London, cameras record your license plate to determine whether youve paid the proper congestion tax. No doubt Hollywoods image of counter-terrorist units where one person sitting behind a terminal instantly tracks the life of another is wrong. But it need not be terribly wrong for much longer. It may not be easy to imagine systems that follow an individual wherever he goes, but it is easy to imagine technologies that gather an extraordinary amount of data about everything we do and make those data accessible to those with the proper authorization. The intrusiveness would be slight, and the payoff could be great.

Both private and public monitoring in the digital age, then, have the same salient feature: monitoring, or searching, can increase without increasing the burden on the individual searched. Both present a similar question: How should we think about this change? How should the protection the framers gave us be applied to a world the framers couldnt even imagine?

: 1.673. /Cache: 3 / 1