Enterprise Omniscience

NBC’s Bob Sullivan published a very nice piece of reporting Wednesday on an Equifax company called The Work Number, which collects detailed information about the paychecks of 30 percent of the U.S. workforce and then uses it for various purposes, including selling it to debt collectors and financial services firms wanting to do “risk management” of their customers.

Essentially, The Work Number operates like a kind of collective, with employers providing data to the company in exchange for the ability to use its database to more easily verify the past employment of job applicants. From Sullivan’s reporting, the company seems to have conveyed the impression, at least, among most involved parties that they only share salary data with the subject’s knowledge and permission—but it’s not actually following that policy.

Clearly there’s a huge informed consent angle to this story. Companies should not be exposing such personal information about their employees without both informing them and getting their consent.

But I think there’s another angle as well. That is the fact that corporations and government agencies are trying to use electronic communications for the same purposes that political activists and other individuals have done: to connect together, organize, compare notes, share experiences, and create collective knowledge.

Anti-fracking activists, for example, might compare notes about water tests, and what company officials are telling them at different meetings across the country. Photographer’s rights activists can share information about police misbehavior towards photographers. And citizens can even do things such as use an app to share information about the location of police DUI checkpoints, a controversial but ultimately legitimate exercise of free speech.

Such distributed-knowledge capabilities have been much celebrated when it comes to helping individuals to organize politically, but here we have an example of how they are having the opposite effect—shifting power away from individuals and towards institutions in a very real way. This Equifax salary data collective is similar to other consumer-data collectives, in which (as I discussed here) companies share their customer information with aggregators in return for the opportunity to pull out rich, cross-merchant profiles of those same customers. Or how landlords share data with each other through computerized renter blacklists.

An example of this in the government context is illuminated by the travel rights activist Edward Hasbrouck, who obtained his Automated Targeting System (ATS) records from the Customs and Border Protection agency via a Privacy Act lawsuit. As Hasbrouck details in this presentation, the documents he received show that the government is not only keeping extensive, detailed travel data on all his international travel since 1992, but that the ATS system also allows border guards to write free-text notations in our permanent government travel record. In his own records, Hasbrouck found notations such as:

• PAX [i.e. passenger] VERBALLY DECLARED FOOD. 1. APPLE WAS SEIZED. BREAD WAS INSPECTED AND RELEASED. NO CIVIL PENALTY ISSUED

• PAX ATTENDED COMPUTER CONFERENCE IN BERLIN AND THEN TRAVELED AROUND EUROPE AND ASIA TO VISIT FRIENDS…. PAX IS SELF EMPLOYED “ENTREPRENEUR” IN COMPUTER SOFTWARE BUSINESS.

• PAX HAS MANY SMALL FLASHLIGHTS WITH POT LEAVES ON THEM. HE HAD A BOOK ENTITLED DRUGS AND YOUR RIGHTS

In short, Hasbrouck found this database contained records not only of an American’s precise travels, friends’ phone numbers, car license plates, timestamped IP addresses, hotel reservations, and much else—but also details of things he said to agents about his travel and about his life, and even details on the books he was reading and other First Amendment-protected content such as the designs on his flashlights.

The creation of these kinds of systems, whether in the government or commercial context, has enormous implications. Once upon a time, we might approach a government agent who has a frightening amount of power over us, such as a border guard, with trepidation. But if you had a bad encounter at the border, at least it was a one-shot deal. Now, your encounters can be permanently recorded and become available to all subsequent agents and can keep coming back to haunt you.

This greatly increases their power, and reduces yours. For example, suppose an agent is rude or abusive toward you. How do you respond—as a proud, free citizen who refuses to submit to unjustified treatment, or as a cowering subject, afraid to attract the wrath of some petty martinet? Given the fact that rising to your own defense might prompt some notation in your permanent file and produce ongoing bad repercussions, a person today is more likely to shut up and just take the abuse. That’s a shift in power from you to them.

Basically, these kinds of systems are improving the “intelligence” of the organizations that create them, and in several ways.

1. They’re allowing organizations to carry out distributed observations of your behavior across space and time, recording your actions with many different agents in many different times and places, pulling together your disparate activities into one coherent record.
2. They’re allowing organizations to create a memory of your activities. I’ve written before about the concept of “enterprise amnesia” in the context of customer service; what these systems do is eradicate such amnesia.
3. They allow not only particular bureaucracies to monitor and remember your activities at a new level, they can also allow such intelligence to reach across organizations. That is what we are seeing with this Equifax product, which essentially plugs companies in to each other and gives them a distributed memory of employees’ histories. That can be especially frightening as it raises the prospect of individuals being blacklisted across entire areas or industries, and removes competition, diversity, and localism as remedies for those who have been mistreated.

The bottom line is that we’re not only seeing the end of enterprise amnesia, we’re facing the prospect of enterprise omniscience.

By making it easy to connect and share information, the information revolution is making new forms of activism and resistance possible—but it’s also shifting power in the other direction too. These contrasting dynamics will be one of the great ongoing power struggles we’re going to see as technology continues to rewire our civilization. Stories such as Equifax’s employee surveillance collective are a reminder that privacy protection is all about one big question: who’s going to have power.