0:00 Thank you. All right. My name is Steve McCown and I am a commissioner on the Utah
0:08 Privacy Commission. I'm also chief architect of Anonomy Labs. And I'd like to
0:15 talk to you about surveillance and tracking today and what SEDI does to get
0:21 in the way of that. Years ago, I worked for the US Department of Energy as
0:28 basically a computer hacker. And one of my assignments was to work on compromising
0:35 cell phones. Another part of my assignment was what they call open source
0:40 intelligence. And this is the collection and analysis of data gathered from open
0:46 sources, think internet, and in order to produce actionable intelligence. And in
0:52 that capacity, I was able to be given target sites and and pull together enough
1:00 information from the internet that resulted in classified reports. So the
1:06 first I wanted to look and see when the first open source intelligence was taking
1:12 place and this is January of 1862. A publication called Harper's Weekly was
1:20 publishing articles about force movements during the US Civil War. And as you can
1:28 see here, the text talks about a general's expeditions and where the troops were
1:36 going, what assets he had. And while the specific targets were secret, they also
1:44 were able to surmise where they were going. They went so far as to draw
1:48 pictures of the target locations and the forces attacking the other forces. In
1:57 modern times, let's talk about surveillance for modern times. So how do
2:02 email marketers know when to call you? So sometimes, and this happened to me
2:07 personally, I was reading an email and within five minutes of reading the email,
2:11 I received a call from the sender of the email and I engaged them in conversation
2:16 to find out how they were doing this. Here's an example, one of many examples of
2:24 what we call tracking beacons. So what they'll do, an email is simply like a web
2:30 page. It's an HTML-based email these days. And they'll put a one-by-one pixel
2:37 transparent image on there. And for those of you who know HTML, there's a little tag
2:45 called image that's supposed to load an actual image. And instead of loading an
2:50 image, what it does is it contacts the internet and pings a web service. And that
2:55 web service can do a variety of things and you can add a variety of information,
3:00 username, email address, GPS location, whatever you can get your handle, whatever
3:07 you can get a hold of and your email client allows, you can then send that off.
3:13 So that's a modern example of open source intelligence. And this leads us into what
3:21 we call surveillance capitalism, which is a concept in political economics which
3:27 denotes the widespread collection and commodification of personal data by
3:31 corporations. It's not limited to corporations. Governments can do this too
3:36 and there can be collaboration between the two. A couple of interesting points about
3:41 surveillance capitalism is that it operates without meaningful mechanisms of
3:46 consent. It just happens to you. And you can lose your self-determination through
3:53 the manipulation of advertising and other practices that might happen as a result of
4:00 this. Duke University with West Point University with the Army, they did a study
4:08 back in 2023 about data brokers and the sale of data on US military personnel. So
4:15 data brokers using these kinds of methods were able to collect sufficient
4:19 information that it became of interest to foreign entities. And so as part of the
4:25 study, they were able to approach the data brokers originating from either US domains
4:31 or .Asia domains and purchase information on US service members and veterans. And
4:39 when they ordered in bulk, it was about 12 to 32 cents per record that you could get
4:47 on US military members. Think of all the things we do on social media and how that
4:53 might be used as we heard this morning for blackmail in order to invoke espionage.
4:59 This is a real problem yet it's also the way the web kind of operates these days.
5:06 Their recommendations were federal privacy legislation and also to restrict the
5:13 collection of data on current and former military personnel. So how SEDI helps
5:20 protect our identity. So one of the things, if you look back to SB 260, it
5:28 says in a couple of lines in here, the state-endorsed digital identity enables an
5:35 individual to selectively disclose elements of an individual's identity. So
5:42 taking the driver's license as an example, when you go to a government entity, say
5:47 the Department of Motor Vehicles, you don't really have an expectation of
5:51 privacy. You're going there to give your information in order to get a driver's
5:56 license credential. So we don't really have an expectation of privacy in that
6:00 regard just by the nature of that interaction. However, when we go to the
6:05 bank, you don't need to give your height and your weight and your donor status and
6:09 all that kind of stuff. And so you can selectively disclose what the bank
6:14 requires. Then if you go shopping on Amazon or somewhere other than payment
6:19 information, they need your name and they need your address to ship whatever it is
6:24 you're buying. They don't need your driver's license number. And so over the
6:30 summer, Apple has allowed MDLs to be used for website logins. And that may create
6:36 some very unintended side effects about the transfer of information.
6:43 Another aspect of SB260 is asserting with zero correlation. So part of the one of
6:51 the lines in that bill says verify that the individual's age satisfies an age
6:57 requirement without revealing the individual's age or date of birth. So for
7:03 example, if I were to go to the Department of Alcoholic Beverage Services, which is
7:10 where you buy liquor here in Utah, the assertion you need to make is I'm 21 or
7:16 older. That's what's required in the law. You don't have to give your name, your
7:21 address, or any other information. There should be a way to give only the
7:26 information that is required. And that's what SEDI is after. So when I go to a
7:32 concert at the Delta Center and I want to use that neat fancy digital ticket, I need
7:40 to be able to assert that I purchased a ticket that I am authorized to get in
7:44 having paid my money and so forth without having to give all the other information
7:50 that may sometimes come with digital credentials. I want this to be a process
7:56 of least disclosure, not full disclosure. Now, when I go to the hardware store as a
8:05 veteran myself, I'm offered a 10% discount and I get that by scanning everything on
8:12 my driver's license. That includes obviously that I am a veteran, which is on
8:17 my status. It includes whether I'm a donor, my height, my weight, my address,
8:22 all these things that are unnecessary for that transaction. So SETI gives you a
8:30 choice. Here's a quote from the US Supreme Court from back in 1995. It says,
8:38 anonymity is a shield from the tyranny of the majority. It thus exemplifies the
8:44 purpose behind the Bill of Rights and the First Amendment in particular. to protect
8:49 unpopular individuals from retaliation at the hand of an intolerant society. Now,
8:55 whether you're on the left or the right, this should resonate with you, maybe for
8:59 different reasons. But this is a really important principle because if we don't
9:05 enable you to disclose only the information that's required in an
9:11 untrackable sense in some situations, what we will end up with is what's Scott
9:18 McNeely from Sun Microsystems said back in 1999, you have zero privacy anyway, get
9:26 over it. And so SEDI is giving you the choice of what you disclose and when you
9:34 disclose it and they put that choice in the hands of the holder. So that's what I
9:40 would hope that you would take away with and you would go back to your respective
9:45 companies, departments and states and and pose this to your constituents because we
9:52 want a private identity system that keeps individuals safe. So thank you very much.
10:01 Max Max Max Max Max Max Max Max