Re: The Future of Reputation: Gossip, Rumor, and Privacy on
Posted: Mon Oct 21, 2013 7:52 pmChapter 8: Conclusion: The Future of Reputation
What will the future hold for our reputation? I have explored in this book the ways our reputations are shaped by the exposure of personal information. We love to talk about each other, and the information we circulate has profound consequences for how people are judged. In many instances, revealing another's personal information can be beneficial to society. It enables communities to enforce norms. It educates us about the lives of others. It allows us to better assess others' reputations. But it also can be problematic. Gossip can unfairly stain a person's reputation; it often exists as a bundle of half-truths and incomplete tales. False rumors can wreak havoc on reputations. And shaming can spin out of control. We cling to only a limited degree of control over our reputation, but this control can make a world of difference. By concealing information about our private lives and our violations of social taboos, and by preventing damaging falsehoods about us from circulating, we can make ourselves less vulnerable to misunderstanding, misjudgment, or unfair condemnation.
The problems escalate when anybody can spread information far and wide over the Internet. Whispering voices and babbling tongues become permanent records readily found in an online search. Increasingly, people are gossiping and shaming others online, as well as exposing their own tawdry secrets. And increasingly, people are googling one another, including employers who are using the information they find online for hiring decisions.
We are witnessing a clash between privacy and free speech, a conflict between two important values that are essential for our autonomy, self-development, freedom, and democracy. We must do something to address the problem, but if we err too much in one direction or the other, the situation could become much worse. In this book, I have attempted to provide a framework for how we can rework the law to make it a useful instrument in balancing privacy and free speech. I have suggested delicate compromises that involve making some modest sacrifices on both sides.
WHAT THE LAW CAN DO, AND WHAT IT CAN'T
Throughout history, most societies have devised ways for people to protect their reputations from gossip and rumor. We have progressed from brawls to duels to law. In the nineteenth century, in response to new technologies posing new threats to privacy, Samuel Warren and Louis Brandeis proposed a way that the law could help provide protection. Their approach, which allowed people to sue others for invading privacy, was a modest middle-ground approach, one that I argued we should continue to use today.
The alternatives are unworkable or unpalatable. A libertarian approach would leave the law out of it, but such an approach would do little to address the problem. And the threat to privacy by the increasing spread of personal information online is too significant to ignore. An authoritarian approach, which involves direct restrictions on Internet expression, would be too oppressive and stifling of free speech. Lawsuits are a middle-ground solution, one that is far from flawless, yet the best among a set of imperfect choices.
But improvements are needed in the existing law for this approach to work effectively. In the framework I have sketched in the previous few chapters, the law should encourage informal attempts at resolving privacy disputes. To do so, law must function as a credible threat yet lawsuits must be a last resort, a measure that provides redress only in egregious cases or when informal ways to resolve disputes don't exist or have failed.
We should expand the law's recognition of privacy so that it covers more situations. We must abandon the binary view of privacy, which is based on the archaic notion that if you're in public, you have no claim to privacy. Instead, we must recognize that privacy involves accessibility, confidentiality, and control. We often expose information to many others, but we nevertheless expect that it has only a certain level of accessibility. The law should also increase its recognition of duties of confidentiality. When we share information with friends, family, and even with strangers, an implicit expectation often exists that they will keep it to themselves. The law should protect and reinforce these expectations. More broadly, the law should afford people greater control over their personal information. Too often, the law clings to restrictive notions of privacy that render it impotent to address contemporary problems. For example, victims of privacy invasions must suffer further injury when pursuing legal redress when their names enter the public record; this undermines their right to pursue a remedy. People should be permitted to keep their names confidential in privacy cases. Updating and expanding the legal understandings of privacy will assuage the law's current handicaps in grappling with privacy issues.
Another part of the equation is reconciliation of the rights of free speech and of privacy. Free speech isn't absolute, and privacy can further the same goals as free speech. In many instances, we can protect both privacy and speech by allowing people to tell their stories anonymously. And a blogger who knows about a statement on his site that is defamatory or invasive of privacy should be obliged to take it down. Unfortunately, the law currently immunizes people for comments on their blogs, even when they know about the harmfulness of the information and ignore pleas to do anything about it.
Thus the law must expand in its recognition of privacy interests and reach a more careful balance between privacy and free speech, one that doesn't give free speech an undue advantage. With these changes, the law can serve to encourage people to be more aware of the consequences of their speech, and it can force people to work out disputes over defamation and invasion of privacy informally. Redefining the limits on the law's reach -- expanding the understanding of privacy, for example, and cutting back on overly broad immunities in the name of free speech -- is necessary for the law to achieve this goal.
Taking these steps, however, must be accompanied by limitations on some of the troubling costs that the law produces. Law involves many interlocking parts, and tinkering with one part can throw another part out of line. Since lawsuits can be costly and chilling of speech, we must counterbalance any expansion in the law's reach. Plaintiffs should first be required to pursue informal solutions with the spreaders of the information. A case should proceed to lawsuit only if the speaker doesn't take reasonable steps to address the harm or if the damage is irreparable. Perhaps parties should even be required to seek alternative dispute resolution before going to court. Mediation and arbitration might serve as cheaper ways to determine the merits of a person's complaint and what measures, if any, a speaker should take to rectify the situation.
My proposals for addressing the problem rectify it primarily through informal nonmonetary means. In many instances, people sue primarily for vindication and to stop the dissemination of the harmful information. Money damages are often not the primary goal. The virtue of the Internet, unlike print media, is that online content can readily be edited and names can be removed. As discussed before, in some cases, all it will take is for a person's name to be edited out of the story. [1] In other cases, the information will have spread too far for there to be a plausible way to clear it from the Internet. Where possible, the law can encourage people to work out their problems among themselves, which will often provide quick and inexpensive results. In some cases money damages might still be appropriate, but for quite a large number of situations, the pursuit of financial redress will be neither practical nor effective.
Other steps can be taken to improve the protection of privacy online. The creators of websites should be encouraged to build in mechanisms for dispute resolution and to establish meaningful ways for people to protect their privacy. For example, social network websites could require people to promise confidentiality as one of the terms of membership. The websites could have users agree to a basic set of rules for respecting others' information. In other words, people should be given choices over how to control the dissemination of their personal information, and those reading people's profiles should be aware of (and bound to) those preferences. When people take efforts to keep information limited in one domain or network, the law should strive to protect those efforts.
Another promising development is the rise of services like ReputationDefender, a company that helps people find and remove harmful information about themselves online. According to the company's website:
Such services can help make informal ways of resolving the problem more effective and efficient.
On social network websites, people share information with a network of friends. Users can make their profiles available within certain networks (their school, their friends, and so on) but not generally available to all users. The law can protect a user's ability to keep information within her social network and prevent others from betraying confidence and revealing that information to others outside the network. For example, the law could bar a prospective employer from trying to gain access to an applicant's profile uninvited.
With the appropriate improvements, the law can help us make significant headway by encouraging the development of ways to resolve disputes over privacy, rumor mongering, and shaming online. We can reach a reasonable balance between privacy and free speech. The task is complicated, as it requires a combination of legal reforms and considerable fine-tuning of the law. But with the framework I'm proposing in this book, the law can play an effective role.
The Limits of Law
There is, of course, a limit to how much the law can do. The law is an instrument capable of subtle notes, but it is not quite a violin. Part of the solution depends upon how social norms develop with regard to privacy. The law's function is to lurk in the background, to ensure that people know that they must respect confidentiality or the privacy even of people in public. In the foreground, however, norms will largely determine how privacy shall be protected in the brave new online world. In a fascinating study, the law professor Robert Ellickson went to Shasta County, a rural area in California, to study the behavior of ranchers. He discovered that many disputes arose because of stray cattle, and that although there were laws to address the issue, the ranchers had adopted their own set of norms to deal with it. For example, Ellickson noted, "Ranchers who suffer trespasses [by wayward cattle] virtually never file claims against others' insurance companies. An adjuster for the company that insures most Shasta County ranchers stated that he could not recall, in his twenty years of adjusting, a single claim by a rancher for compensation for trespass damage." A rancher would often take care of another rancher's cows that strayed onto his land until his neighbor picked them up. During that time the rancher would feed and house the cow. Although the law permitted ranchers to recover the costs for taking care of the stray cow, the ranchers never did. The norm was that you should take care of your neighbor's cow if it strayed onto your land. According to Ellickson: "People may supplement, and indeed preempt, the state's rules with rules of their own." [3] The ranchers had a well-developed system of norms, and they didn't need to resort to the law.
What do ranchers and cattle disputes have to do with the Internet? Ellickson's study illustrates a more general insight about the law and norms. The law is a puny instrument compared with norms. As the law professor Tracey Meares observes, "Social norms are better and more effective constraints on behavior than law could ever be." [4] Although the law can't supplant norms, it can sometimes help to shape them. With the ranchers, the law was something they could have resorted to if they were unhappy with the norms. But the norms worked, and the law was rarely needed.
Blogosphere Norms vs. Mainstream Media Norms
Currently, bloggers are much less restrained than the mainstream media in what they write about. The mainstream media have established ethical guidelines (albeit loose ones) to protect people's privacy, but the norms of the blogosphere are still in their infancy. In the nineteenth century, the media routinely focused on the sex scandals of politicians, but reporters and editors became much more restrained during the first half of the twentieth century. [5] As the historian John Summers observes: "Partisan rivals and 'paul pry' journalists continued to gossip uncharitably about [President Grover] Cleveland, yet both averted their gaze from his successor, Benjamin Harrison, whose moral worthiness suffered no significant assaults. The aloof William McKinley also enjoyed a gossip-free administration. So, too, did William Howard Taft and Woodrow Wilson escape from the discomfort of entering public debate about their sexual peccadilloes." [6]
Ethical codes for journalists sprang up in the early twentieth century. These codes urged that gossip about the private lives of public figures should not get front page attention, that reputations should not "be torn down lightly," that attacks on a person's reputation should not be published before the person had the opportunity to be heard, and that "a newspaper should not invade private rights or feelings without sure warrant of public right as distinguished from public curiosity." [7] President John F. Kennedy benefited greatly from the media's reluctance to report on people's private lives, as the media avoided reporting on his many sexual infidelities. [8]
Today this norm has changed, as was emphatically demonstrated by the extensive reporting on President Clinton's affairs. Although the media readily plunder the private lives of politicians, they continue to exercise great restraint with politicians' children. President Clinton actively worked to keep his daughter, Chelsea, away from the media, and the media generally cooperated. [9] When Chelsea attended Stanford University, the editors of the Stanford Daily even resolved to fire any member of its staff who disclosed information about Chelsea to the public. [10] The press has also exercised restraint for President Bush's daughters, and when one daughter was arrested for underage drinking, the media was deeply divided about the extent of coverage to give to the story. [11] These norms exist in spite of great public interest in the children's lives.
Another long-standing media norm is extending anonymity to rape victims. For example, in August 2002, two teenage girls were kidnapped and raped. While they were captive, their names and photographs were widely broadcast to assist in the search. Once they were found alive, most of the media ceased displaying their names and photographs. [12] Although this norm is widely followed, there are occasional violators, a recent example being the radio commentator who disclosed the identity of National Basketball Association star Kobe Bryant's alleged sexual assault victim. [13]
Media self-restraint is difficult to achieve because the media are far from a monolithic entity. There are many different styles of journalism, and a vast number of media entities cater to different tastes. If the New York Times will not report it, the National Enquirer will. As a result, certain segments of the media -- such as tabloids -- may routinely run stories that a majority of the media does not consider newsworthy. The media also have a tendency to follow the crowd. If one media entity begins reporting on a story, others often quickly follow suit. [14]
But the mainstream media have developed at least some norms of restraint in order to protect privacy. While the norms need shaping and strengthening, they are at least partially developed. The blogosphere has less-well-developed norms, and it needs to establish a code of ethics. People should delete offensive comments quickly if asked. People should ask permission before speaking about others' private lives. Someone who speaks about another person's private life without her consent should take steps to conceal her identity. People should avoid posting pictures of other people without getting their consent. People should avoid Internet shaming.
These rules are easier stated in theory than developed or enforced in practice. The blogosphere is growing rapidly, with people entering the online media community daily. With so many different bloggers, and with so many new ones joining the ranks each day, the norms of the blogosphere are not stable. The law can help shape norms in the blogosphere, however, by threatening to become involved if such norms don't evolve.
One of the key contributions the law can make is to foster greater awareness of the difference between the offline and online spread of information. People are viewing the Internet as a mere extension of their offline world. Many people who enter the blogosphere are using it to gossip just as they do in realspace. The boundary between online and offline is blurring, but it is an important line to keep clear. Online, information is permanent and more easily spread. The law must make the boundary between online and offline more salient in people's minds.
Establishing norms, of course, is a difficult task, and the law can do only so much. The norms of those speaking online are quite varied, and the law is unlikely to create unanimity in attitudes and behavior. We must be realistic in our expectations about what the law can do. At best, the law will be able to provide modest guidance and direction. It can nudge norms in the right direction. But the law is far from a magic elixir.
THE SELF-EXPOSURE PROBLEM
Although gossip and rumors are spread without the targets' knowledge or consent, an increasingly large number of people are putting their own personal information online. I have argued that it is justified for the law to try to stop people from gossiping about others, but how ought the law to respond to people's gossip about themselves?
The great nineteenth-century philosopher John Stuart Mill articulated a key principle that still resonates today: "The only part of the conduct of any one for which he is amenable to society, is that which concerns others. In the part which merely concerns himself, his independence is, of right, absolute." [15] In other words, if your conduct hurts others, the law should regulate it to rectify or prevent the harm. But if your conduct affects only yourself, then the law should leave you alone.
Applied to the issues discussed in this book, the law should be most involved when people are violating the privacy of other people. But it should be less involved when people are merely self-disclosing personal information. The law becomes too authoritarian if it prevents people from voluntarily revealing their own personal information.
Mill's principle, of course, isn't perfect, as our actions are rarely entirely self-contained. When teenagers expose too much of their own personal information online, it can affect their friends and families. Children's public indiscretions can embarrass their parents and siblings, and parental public indiscretions can cause humiliation to children. But by and large, although no person is an island, the law should respect people's wishes to expose themselves online if they desire.
Should anything be done about the children and teenagers who are discussing their private lives on blogs and social network sites? Children and teens are not fully mature; they might not understand the long-term consequences of what they are doing. If the law can't stop them from exposing their lives online, then is there any way to address the problem?
Do People Want Privacy Anymore?
Perhaps there isn't a problem. What if a teen's decision to expose her intimate secrets on the Web isn't the product of lack of maturity but instead is a manifestation of generational differences?
In today's world of reality television, the law professor Anita Allen wonders whether people expect privacy anymore: "Our parents may appear on the television shows of Oprah Winfrey or Jerry Springer to discuss incest, homosexuality, miscegenation, adultery, transvestitism, and cruelty in the family. Our adopted children may go on television to be reunited with their birth parents. Our law students may compete with their peers for a spot on the MTV program The Real World, and a chance to live with television cameras for months on end and be viewed by mass audiences." [16]
Beyond television, people, especially high school and college students, are rushing to post a treasure trove of data about themselves online. Perhaps the emerging generation is just not that concerned about privacy. In a survey of the users of the social network site Facebook, almost 90 percent said that they had never read Facebook's privacy policy. [17] Nearly 60 percent of Facebook users said that they weren't very concerned about privacy, with a little more than 30 percent saying that they were somewhat concerned, and only 9.7 percent saying that they were very concerned. [18] One researcher even created an automatic script that asked hundreds of thousands of Facebook users to be added as a friend, thus allowing full access to their profile information. About 30 percent said yes. As the professors Ralph Gross and Alessandro Acquisti note, these 30 percent "are willing to make all of their profile information available to a random stranger and his network of friends." [19] Studies like these suggest that although people express some concern over privacy, it is not always reflected in their behavior.
A Nuanced View of Privacy
People's views about privacy, however, are much more complicated than the rather simplistic notions of privacy in existing law and policy. If we see people exhibiting themselves before the public without inhibition, our natural reaction is to think that they obviously don't want privacy. But the reality is more nuanced. Recall the Facebook incident discussed in the previous chapter. Facebook added the News Feed feature alerting people's friends about the up-to-the-minute changes made in their profiles. And users got quite upset over this change, viewing it as invasive of privacy.
I think that two lessons can be gleaned from the Facebook incident. First, Facebook users didn't want absolute secrecy for their information; they were concerned about the extensiveness of the exposure. They wanted a certain level of exposure and were angry when the News Feed feature upset their established balance. Second, the Facebook incident may also reflect the fact that many people just don't appreciate the extensiveness of their exposure online. Although they may understand that what they put online is widely exposed, they might not really grasp the consequences.
Part of the problem is that the Internet makes it hard to visualize the breadth of our exposure. Placing information on a website and writing blog posts and comments feels more akin to chatting with friends, writing a diary, or talking on the telephone than like broadcasting live on television, publishing a novel, or addressing a crowded auditorium. This difficulty is compounded by the often ambivalent desire we have for concealment and exposure. Some teenagers have contradictory ambitions for their posts. One teenager interviewed for a story in the New York Times Magazine explained that "he wanted his posts to be read, and feared that people would read them, and hoped that people would read them, and didn't care if people read them." [20] Although at first blush the teenager's statement doesn't make much sense, its self-contradictions actually capture the ambivalent attitudes of many bloggers. Writing blog posts is exciting in many ways. It can be cathartic. It can be fun to express oneself openly. People enjoy venturing their deepest secrets, hoping for a sense of acceptance or understanding or even just a bit of attention. One blogger wrote: "Maintaining a blog with no one visiting or commenting would be [as] sad as a clown doing a show with no one watching." [21]
Blogging can be like writing a diary, only with the hope that others might read it. By blogging, you're putting yourself out there, often unfiltered and unedited. And because you can't see or touch your audience, because you blog in the solitude of your room, in front of your computer late at night, it doesn't seem like exhibitionism. There's no bright spotlight. It's just you and your computer. Blogging has an uncanny way of encouraging you to doff your inhibitions. Most of the time you wonder: Is anybody listening? Often, the answer is no. People feel as though they're exposing themselves on a stage before an empty auditorium. But with the Internet, in an instant, the spotlights could come on and the auditorium could be overflowing with people. The Electronic Frontier Foundation, in a guide to blogging safely, notes: "If you blog, there are no guarantees you'll attract a readership of thousands. But at least a few readers will find your blog, and they may be the people you'd least want or expect. These include potential or current employers, coworkers, and professional colleagues; your neighbors; your spouse or partner; your family; and anyone else curious enough to type your name, email address or screen name into Google or Feedster and click a few links." [22] A top law school recently provided blogging advice to its students: "We urge you to take the long view and the adult view of what you write. THINK about the words you send out into the world, and imagine what they would make you look like when you -- and surely some of you will -- find yourself under review at a confirmation hearing for a professional position you dearly desire." [23]
Get Me an Editor ... or Not
One of the main differences between blogs and mainstream media publications is style. Blog posts are edgy, not polished and buffed into the typical prefabricated write-by-the-numbers stock that often gets produced by the mainstream media. Discourse on the Internet is pungent. In many respects, this is a virtue. Just as the key to robust free speech is battling attempts at censorship, the key to robust blogging is, I think, battling internal censors. I often fire off posts about whatever half-baked (even quarter-baked) idea happens to be buzzing in my head at a particular moment.
But blog posts are created with no editors and published with no time delays. There's little time to cool down before sounding off. Just click the Publish button and unleash it to the world ... then think about the consequences later. It goes without saying that this is a recipe for some problems. That nude picture a teenager puts up in a moment of indiscretion -- it can be forever present, forever regretted. One girl chronicled her mental breakdown on her blog, describing her self-mutilation, sexual experiences, and family turmoil. When she thought the better of it, she removed the posts from her blog. [24]
Another part of the problem is that blogs and social network websites are the "in" technology that children have integrated into their lives. They are a means of socialization and communication. Just as conversations migrated to the telephone and then to email and instant messaging, now they are migrating to social network websites. The problem is that these sites are not designed in ways to emphasize the potential harms to privacy and other consequences. Cyberspace is the new place to hang out, the perils of exposure notwithstanding. The pressure to fit in, to do what everybody else is doing, overrides concerns about privacy.
In the end, I believe that people still want privacy, but privacy in the digital age is much more complicated than its old-fashioned equivalent. Rarely can we completely conceal information about our lives, but that doesn't mean that we don't expect to limit its accessibility, ensure that it stays within a particular social circle, or exercise some degree of control over it. Moreover, although it would be too authoritarian for the law to stop people from expressing themselves online, there are things that can be done to provide them with more protection.
THE POWER OF ARCHITECTURE
The technological design of the websites has an enormous impact on people's privacy. Lawrence Lessig and Joel Reidenberg emphasize the importance of Internet "architecture" -- the code used to structure our choices on the Web. [25] Architecture can shape people's behavior. [26] Physical architecture, such as buildings, can affect the way we live and interact with our peers. Spaces can be designed to encourage people to be more open, to communicate with each other more frequently. Or spaces can be designed to encourage solitude. Like physical spaces, virtual spaces on the Internet are also designed environments. Social network websites are a structured form of interaction, created according to rules set up by those who create the site. The design choices social network websites make will have profound effects on the way their users interact with each other.
Changing the Defaults
One of the primary problems with social network websites is that they are designed to encourage people to expose a lot of information with very little thought about the consequences. The default privacy setting on MySpace, for example, is that anybody in the public can view one's profile.
A section of the Myspace privacy settings. Under "Who Can View My Full Profile," the option selected by default is "Public."
Likewise, although Facebook allows users to restrict who can see their information, the default setting allows everybody to see it. [27] Unless a user changes the default settings, her profile will be accessible to millions of people. The default settings on many social network websites privilege openness over privacy. According to one study, although Facebook "provides users with a very granular and relatively sophisticated interface to control the searchability and visibility of their profiles," the users "tend to not change default settings." [28] In another study, two researchers concluded: "As a whole, users are familiar with the privacy features Facebook offers, and choose not to use them." [29]
Simply changing default settings might protect a lot of people. The settings or preferences screen on various websites may constitute one of the most important influences on the shape of privacy in the future. The law should not force companies to set specific defaults, but the companies should be encouraged to think about how the design of their websites affects privacy.
The Concept of "Friend"
As discussed earlier in this book, social network sites often have a very loose concept of "friend." The sites divide a person's social universe into "friends" and everybody else. Of course, a person's social network is far more complex, but it must be translated into the terms established by the social network websites. Because social network websites lack a more granular set of categories for social relationships, they encourage users to share information with others who otherwise would not be privy to it. Two scholars who study social network websites, Judith Donath and danah boyd, astutely observe: "By making all of one's connections visible to all the others, social network sites remove the privacy barriers that people keep between different aspects of their lives." To illustrate this phenomenon, they tell the story of a high school teacher who joined Friendster. To protect her privacy, she allowed her profile to be viewed only by "friends." But then one of her students found out she was on Friendster and asked to be added as a friend. This put her in an awkward position for several reasons. Her only choices were to acknowledge the student as a friend or to completely rebuff the student. No intermediate category existed for their relationship. Donath and boyd observe: "She had originally joined with some friends, many of whom had created 'crazy, fun' profiles, including suggestive testimonials, risque photographs, and references to wild times at the Burning Man festival. ... Although she could edit her own profile to be quite sedate, her friends' profiles were not. Accepting her student's friendship request would reveal her full network to her class, while saying 'no' felt rude and distancing."
We live complex lives, and we often inhabit many very different social circles. Donath and boyd note that "sometimes simply encountering people from different aspects of someone's life can be quite revealing. The discomfort can be felt both by the performer caught in two roles and the observer." [30] The difficulty with social network websites is that they view a person's relationships as one unified social network, when in fact people have a rather elaborate set of connections. Each connection involves different levels of exposure and different ways of sharing information. And while we may share information freely among one social circle, we may not want information to bleed between the different social circles we occupy simultaneously. But social network websites tear down these boundaries. They present a simplified picture of people's social network that eliminates the many nuanced barriers to information flow. To participate, people must often share information beyond the limits they would ordinarily establish in the real world.
The law shouldn't force websites to alter their design. This would be too authoritarian. But it is important for websites to consider the consequences that their architectural choices will have on the lives of millions of people.
Employer Responsibilities
Although there isn't a lot the law can do to address the self-exposure problem, the law can operate to help protect people in some limited contexts. Chris Hoofnagle, a researcher at Berkeley Law School, proposes the regulation of employers who would google prospective employees. [31] Under federal law, if an employer asks a credit-reporting agency to conduct a background check on a prospective employee, the employer has certain obligations to the applicant. For example, if information in the report dissuades the employer from making a job offer, he must reveal that to the applicant. [32] The purpose of this requirement is to allow the applicant a chance to explain. Perhaps the report was in error. Perhaps there's a reasonable explanation. With the use of search engines like Google, employers can conduct amateur background checks without any legal protections. There is no requirement that employers tell applicants that they were googled. What often happens is that an applicant is simply not called in for an interview, or if interviewed, is simply not invited back for further consideration. As we have seen, employers are increasingly using Google as well as searching social network websites to find out about applicants. But a lot of the information online isn't accurate. Another problem is that information about a different person with the same name can be mixed in. A requirement that employers who conduct online searches of applicants notify them about the search will at least give applicants a chance to be heard.
Of course, such a requirement could readily be violated. It would be difficult to prove that an employer had googled an applicant. But even if enforcement was problematic, many employers would probably respect a requirement to notify applicants. Moreover, such a rule would help establish a norm. And in such a difficult area to navigate, creating a norm would be a significant step forward.
Education
At the end of the day, if people want to expose themselves to the world, there's only so much that can be done to stop them. Self-disclosure is nevertheless a problem, as teenagers and college students are often revealing too much information and later regretting that they cannot take it back. Education is the most viable way to shape people's choices in this regard. For example, one study indicated that people have a lot of misunderstandings about who is able to search their Facebook profiles. Although most Facebook users are "aware of the true visibility of their profile ... a significant minority is vastly underestimating the reach and openness of their own profile." [33] We need to spend a lot more time educating people about the consequences of posting information online. In a survey conducted in 2006, "two thirds of parents had never talked with their teen about their MySpace use, and 38 percent of them had never seen their child's MySpace profile." [34] Teenagers and children need to be taught about privacy just like they are taught rules of etiquette and civility.
TO THE END OF THE INTERNET
A television commercial that I find immensely amusing opens with a guy surfing the Internet on his computer. He clicks the mouse, and all of a sudden, a computerized voice from his PC says: "You have reached the end of the Internet. You have seen all that there is to see." It's a commercial for high-speed broadband. The message is that the advertised broadband service is so fast that you can see the entire Internet.
Of course, the humor in this is that you can't exhaust the Internet. It's too big. Every day it grows by millions of new Web pages and blog posts. The Internet is akin to the endless library imagined by the writer Jorge Luis Borges. In his story "The Library of Babel," Borges wrote of a library with an "infinite number of hexagonal galleries." Initially, "when it was announced that the library contained all books, the first reaction was unbounded joy." But then people discovered the rub: finding the right book could take centuries, and many books were totally incomprehensible. [35] And so it is with the Internet. Unlike the hapless users of Borges's library, we Internet users have what has become known as "the search" -- the ability to use search engines like Google to help us find the information we're looking for. Google's great innovation has been not only to comb the Internet to bring back as many relevant pieces of information as possible but also to rank them in an order calculated to reflect their relative usefulness. [36]
But "the search" is just in its infancy. John Battelle, the author of a popular book on Internet searching, observes: "As every engineer in the search field loves to tell you, search is at best 5 percent solved -- we're not even in the double digits of its potential." [37] For example, a large part of the Internet has not been combed or cataloged by Google. The so-called invisible Web remains, which "comprises everything that is available via the Web, but has yet to be found by search engines." [38] Google searches the epidermis of the Web, but lots of content still remains undiscovered. [39] What will happen when the search improves?
The Internet is still quite young. In the first chapter of this book, I likened the Internet to a teenager, beginning to test out its new freedom and powers yet still in the early days of its development. The Internet is growing up rapidly, and no end is in sight. Nor is there any end to the issues in this book. Right now, the next great innovations are probably being created in somebody's dorm room or garage. After all, that's where Facebook and Google began. [40] What's ahead will be amazing. It makes me giddy with excitement to think about it -- but also a bit frightened.
Will people be blogging and using social network websites a decade from now? Who knows? But people will almost certainly be spending a lot of time online. And it is a safe bet that people will be exposing details about their lives, as well as gossiping, shaming, and spreading rumors. The technologies may change, but human nature will remain the same.
Although the Internet poses new and difficult issues, they are variations on some timeless problems: the tension between privacy and free speech, the nature of privacy, the virtues and vices of gossip and shaming, the effect of new technologies on the spread of information, and the ways in which law, technology, and norms interact. New technologies do not just enhance freedom but also alter the matrix of freedom and control in new and challenging ways.
The questions are immensely complex, and there are no easy answers. Just when we think we're smoothing problems out, new technology adds another wrinkle. But we can take steps to protect privacy if we make an effort. We must. After all, it's just the beginning.
What will the future hold for our reputation? I have explored in this book the ways our reputations are shaped by the exposure of personal information. We love to talk about each other, and the information we circulate has profound consequences for how people are judged. In many instances, revealing another's personal information can be beneficial to society. It enables communities to enforce norms. It educates us about the lives of others. It allows us to better assess others' reputations. But it also can be problematic. Gossip can unfairly stain a person's reputation; it often exists as a bundle of half-truths and incomplete tales. False rumors can wreak havoc on reputations. And shaming can spin out of control. We cling to only a limited degree of control over our reputation, but this control can make a world of difference. By concealing information about our private lives and our violations of social taboos, and by preventing damaging falsehoods about us from circulating, we can make ourselves less vulnerable to misunderstanding, misjudgment, or unfair condemnation.
The problems escalate when anybody can spread information far and wide over the Internet. Whispering voices and babbling tongues become permanent records readily found in an online search. Increasingly, people are gossiping and shaming others online, as well as exposing their own tawdry secrets. And increasingly, people are googling one another, including employers who are using the information they find online for hiring decisions.
We are witnessing a clash between privacy and free speech, a conflict between two important values that are essential for our autonomy, self-development, freedom, and democracy. We must do something to address the problem, but if we err too much in one direction or the other, the situation could become much worse. In this book, I have attempted to provide a framework for how we can rework the law to make it a useful instrument in balancing privacy and free speech. I have suggested delicate compromises that involve making some modest sacrifices on both sides.
WHAT THE LAW CAN DO, AND WHAT IT CAN'T
Throughout history, most societies have devised ways for people to protect their reputations from gossip and rumor. We have progressed from brawls to duels to law. In the nineteenth century, in response to new technologies posing new threats to privacy, Samuel Warren and Louis Brandeis proposed a way that the law could help provide protection. Their approach, which allowed people to sue others for invading privacy, was a modest middle-ground approach, one that I argued we should continue to use today.
The alternatives are unworkable or unpalatable. A libertarian approach would leave the law out of it, but such an approach would do little to address the problem. And the threat to privacy by the increasing spread of personal information online is too significant to ignore. An authoritarian approach, which involves direct restrictions on Internet expression, would be too oppressive and stifling of free speech. Lawsuits are a middle-ground solution, one that is far from flawless, yet the best among a set of imperfect choices.
But improvements are needed in the existing law for this approach to work effectively. In the framework I have sketched in the previous few chapters, the law should encourage informal attempts at resolving privacy disputes. To do so, law must function as a credible threat yet lawsuits must be a last resort, a measure that provides redress only in egregious cases or when informal ways to resolve disputes don't exist or have failed.
We should expand the law's recognition of privacy so that it covers more situations. We must abandon the binary view of privacy, which is based on the archaic notion that if you're in public, you have no claim to privacy. Instead, we must recognize that privacy involves accessibility, confidentiality, and control. We often expose information to many others, but we nevertheless expect that it has only a certain level of accessibility. The law should also increase its recognition of duties of confidentiality. When we share information with friends, family, and even with strangers, an implicit expectation often exists that they will keep it to themselves. The law should protect and reinforce these expectations. More broadly, the law should afford people greater control over their personal information. Too often, the law clings to restrictive notions of privacy that render it impotent to address contemporary problems. For example, victims of privacy invasions must suffer further injury when pursuing legal redress when their names enter the public record; this undermines their right to pursue a remedy. People should be permitted to keep their names confidential in privacy cases. Updating and expanding the legal understandings of privacy will assuage the law's current handicaps in grappling with privacy issues.
Another part of the equation is reconciliation of the rights of free speech and of privacy. Free speech isn't absolute, and privacy can further the same goals as free speech. In many instances, we can protect both privacy and speech by allowing people to tell their stories anonymously. And a blogger who knows about a statement on his site that is defamatory or invasive of privacy should be obliged to take it down. Unfortunately, the law currently immunizes people for comments on their blogs, even when they know about the harmfulness of the information and ignore pleas to do anything about it.
Thus the law must expand in its recognition of privacy interests and reach a more careful balance between privacy and free speech, one that doesn't give free speech an undue advantage. With these changes, the law can serve to encourage people to be more aware of the consequences of their speech, and it can force people to work out disputes over defamation and invasion of privacy informally. Redefining the limits on the law's reach -- expanding the understanding of privacy, for example, and cutting back on overly broad immunities in the name of free speech -- is necessary for the law to achieve this goal.
Taking these steps, however, must be accompanied by limitations on some of the troubling costs that the law produces. Law involves many interlocking parts, and tinkering with one part can throw another part out of line. Since lawsuits can be costly and chilling of speech, we must counterbalance any expansion in the law's reach. Plaintiffs should first be required to pursue informal solutions with the spreaders of the information. A case should proceed to lawsuit only if the speaker doesn't take reasonable steps to address the harm or if the damage is irreparable. Perhaps parties should even be required to seek alternative dispute resolution before going to court. Mediation and arbitration might serve as cheaper ways to determine the merits of a person's complaint and what measures, if any, a speaker should take to rectify the situation.
My proposals for addressing the problem rectify it primarily through informal nonmonetary means. In many instances, people sue primarily for vindication and to stop the dissemination of the harmful information. Money damages are often not the primary goal. The virtue of the Internet, unlike print media, is that online content can readily be edited and names can be removed. As discussed before, in some cases, all it will take is for a person's name to be edited out of the story. [1] In other cases, the information will have spread too far for there to be a plausible way to clear it from the Internet. Where possible, the law can encourage people to work out their problems among themselves, which will often provide quick and inexpensive results. In some cases money damages might still be appropriate, but for quite a large number of situations, the pursuit of financial redress will be neither practical nor effective.
Other steps can be taken to improve the protection of privacy online. The creators of websites should be encouraged to build in mechanisms for dispute resolution and to establish meaningful ways for people to protect their privacy. For example, social network websites could require people to promise confidentiality as one of the terms of membership. The websites could have users agree to a basic set of rules for respecting others' information. In other words, people should be given choices over how to control the dissemination of their personal information, and those reading people's profiles should be aware of (and bound to) those preferences. When people take efforts to keep information limited in one domain or network, the law should strive to protect those efforts.
Another promising development is the rise of services like ReputationDefender, a company that helps people find and remove harmful information about themselves online. According to the company's website:
We will find the unwelcome online content about you or your loved ones, even if it is buried in websites that are not easily examined with standard online search engines. And if you tell us to do so, we will work around the clock to get that unwelcome content removed or corrected. [2]
Such services can help make informal ways of resolving the problem more effective and efficient.
On social network websites, people share information with a network of friends. Users can make their profiles available within certain networks (their school, their friends, and so on) but not generally available to all users. The law can protect a user's ability to keep information within her social network and prevent others from betraying confidence and revealing that information to others outside the network. For example, the law could bar a prospective employer from trying to gain access to an applicant's profile uninvited.
With the appropriate improvements, the law can help us make significant headway by encouraging the development of ways to resolve disputes over privacy, rumor mongering, and shaming online. We can reach a reasonable balance between privacy and free speech. The task is complicated, as it requires a combination of legal reforms and considerable fine-tuning of the law. But with the framework I'm proposing in this book, the law can play an effective role.
The Limits of Law
There is, of course, a limit to how much the law can do. The law is an instrument capable of subtle notes, but it is not quite a violin. Part of the solution depends upon how social norms develop with regard to privacy. The law's function is to lurk in the background, to ensure that people know that they must respect confidentiality or the privacy even of people in public. In the foreground, however, norms will largely determine how privacy shall be protected in the brave new online world. In a fascinating study, the law professor Robert Ellickson went to Shasta County, a rural area in California, to study the behavior of ranchers. He discovered that many disputes arose because of stray cattle, and that although there were laws to address the issue, the ranchers had adopted their own set of norms to deal with it. For example, Ellickson noted, "Ranchers who suffer trespasses [by wayward cattle] virtually never file claims against others' insurance companies. An adjuster for the company that insures most Shasta County ranchers stated that he could not recall, in his twenty years of adjusting, a single claim by a rancher for compensation for trespass damage." A rancher would often take care of another rancher's cows that strayed onto his land until his neighbor picked them up. During that time the rancher would feed and house the cow. Although the law permitted ranchers to recover the costs for taking care of the stray cow, the ranchers never did. The norm was that you should take care of your neighbor's cow if it strayed onto your land. According to Ellickson: "People may supplement, and indeed preempt, the state's rules with rules of their own." [3] The ranchers had a well-developed system of norms, and they didn't need to resort to the law.
What do ranchers and cattle disputes have to do with the Internet? Ellickson's study illustrates a more general insight about the law and norms. The law is a puny instrument compared with norms. As the law professor Tracey Meares observes, "Social norms are better and more effective constraints on behavior than law could ever be." [4] Although the law can't supplant norms, it can sometimes help to shape them. With the ranchers, the law was something they could have resorted to if they were unhappy with the norms. But the norms worked, and the law was rarely needed.
Blogosphere Norms vs. Mainstream Media Norms
Currently, bloggers are much less restrained than the mainstream media in what they write about. The mainstream media have established ethical guidelines (albeit loose ones) to protect people's privacy, but the norms of the blogosphere are still in their infancy. In the nineteenth century, the media routinely focused on the sex scandals of politicians, but reporters and editors became much more restrained during the first half of the twentieth century. [5] As the historian John Summers observes: "Partisan rivals and 'paul pry' journalists continued to gossip uncharitably about [President Grover] Cleveland, yet both averted their gaze from his successor, Benjamin Harrison, whose moral worthiness suffered no significant assaults. The aloof William McKinley also enjoyed a gossip-free administration. So, too, did William Howard Taft and Woodrow Wilson escape from the discomfort of entering public debate about their sexual peccadilloes." [6]
Ethical codes for journalists sprang up in the early twentieth century. These codes urged that gossip about the private lives of public figures should not get front page attention, that reputations should not "be torn down lightly," that attacks on a person's reputation should not be published before the person had the opportunity to be heard, and that "a newspaper should not invade private rights or feelings without sure warrant of public right as distinguished from public curiosity." [7] President John F. Kennedy benefited greatly from the media's reluctance to report on people's private lives, as the media avoided reporting on his many sexual infidelities. [8]
Today this norm has changed, as was emphatically demonstrated by the extensive reporting on President Clinton's affairs. Although the media readily plunder the private lives of politicians, they continue to exercise great restraint with politicians' children. President Clinton actively worked to keep his daughter, Chelsea, away from the media, and the media generally cooperated. [9] When Chelsea attended Stanford University, the editors of the Stanford Daily even resolved to fire any member of its staff who disclosed information about Chelsea to the public. [10] The press has also exercised restraint for President Bush's daughters, and when one daughter was arrested for underage drinking, the media was deeply divided about the extent of coverage to give to the story. [11] These norms exist in spite of great public interest in the children's lives.
Another long-standing media norm is extending anonymity to rape victims. For example, in August 2002, two teenage girls were kidnapped and raped. While they were captive, their names and photographs were widely broadcast to assist in the search. Once they were found alive, most of the media ceased displaying their names and photographs. [12] Although this norm is widely followed, there are occasional violators, a recent example being the radio commentator who disclosed the identity of National Basketball Association star Kobe Bryant's alleged sexual assault victim. [13]
Media self-restraint is difficult to achieve because the media are far from a monolithic entity. There are many different styles of journalism, and a vast number of media entities cater to different tastes. If the New York Times will not report it, the National Enquirer will. As a result, certain segments of the media -- such as tabloids -- may routinely run stories that a majority of the media does not consider newsworthy. The media also have a tendency to follow the crowd. If one media entity begins reporting on a story, others often quickly follow suit. [14]
But the mainstream media have developed at least some norms of restraint in order to protect privacy. While the norms need shaping and strengthening, they are at least partially developed. The blogosphere has less-well-developed norms, and it needs to establish a code of ethics. People should delete offensive comments quickly if asked. People should ask permission before speaking about others' private lives. Someone who speaks about another person's private life without her consent should take steps to conceal her identity. People should avoid posting pictures of other people without getting their consent. People should avoid Internet shaming.
These rules are easier stated in theory than developed or enforced in practice. The blogosphere is growing rapidly, with people entering the online media community daily. With so many different bloggers, and with so many new ones joining the ranks each day, the norms of the blogosphere are not stable. The law can help shape norms in the blogosphere, however, by threatening to become involved if such norms don't evolve.
One of the key contributions the law can make is to foster greater awareness of the difference between the offline and online spread of information. People are viewing the Internet as a mere extension of their offline world. Many people who enter the blogosphere are using it to gossip just as they do in realspace. The boundary between online and offline is blurring, but it is an important line to keep clear. Online, information is permanent and more easily spread. The law must make the boundary between online and offline more salient in people's minds.
Establishing norms, of course, is a difficult task, and the law can do only so much. The norms of those speaking online are quite varied, and the law is unlikely to create unanimity in attitudes and behavior. We must be realistic in our expectations about what the law can do. At best, the law will be able to provide modest guidance and direction. It can nudge norms in the right direction. But the law is far from a magic elixir.
THE SELF-EXPOSURE PROBLEM
Although gossip and rumors are spread without the targets' knowledge or consent, an increasingly large number of people are putting their own personal information online. I have argued that it is justified for the law to try to stop people from gossiping about others, but how ought the law to respond to people's gossip about themselves?
The great nineteenth-century philosopher John Stuart Mill articulated a key principle that still resonates today: "The only part of the conduct of any one for which he is amenable to society, is that which concerns others. In the part which merely concerns himself, his independence is, of right, absolute." [15] In other words, if your conduct hurts others, the law should regulate it to rectify or prevent the harm. But if your conduct affects only yourself, then the law should leave you alone.
Applied to the issues discussed in this book, the law should be most involved when people are violating the privacy of other people. But it should be less involved when people are merely self-disclosing personal information. The law becomes too authoritarian if it prevents people from voluntarily revealing their own personal information.
Mill's principle, of course, isn't perfect, as our actions are rarely entirely self-contained. When teenagers expose too much of their own personal information online, it can affect their friends and families. Children's public indiscretions can embarrass their parents and siblings, and parental public indiscretions can cause humiliation to children. But by and large, although no person is an island, the law should respect people's wishes to expose themselves online if they desire.
Should anything be done about the children and teenagers who are discussing their private lives on blogs and social network sites? Children and teens are not fully mature; they might not understand the long-term consequences of what they are doing. If the law can't stop them from exposing their lives online, then is there any way to address the problem?
Do People Want Privacy Anymore?
Perhaps there isn't a problem. What if a teen's decision to expose her intimate secrets on the Web isn't the product of lack of maturity but instead is a manifestation of generational differences?
In today's world of reality television, the law professor Anita Allen wonders whether people expect privacy anymore: "Our parents may appear on the television shows of Oprah Winfrey or Jerry Springer to discuss incest, homosexuality, miscegenation, adultery, transvestitism, and cruelty in the family. Our adopted children may go on television to be reunited with their birth parents. Our law students may compete with their peers for a spot on the MTV program The Real World, and a chance to live with television cameras for months on end and be viewed by mass audiences." [16]
Beyond television, people, especially high school and college students, are rushing to post a treasure trove of data about themselves online. Perhaps the emerging generation is just not that concerned about privacy. In a survey of the users of the social network site Facebook, almost 90 percent said that they had never read Facebook's privacy policy. [17] Nearly 60 percent of Facebook users said that they weren't very concerned about privacy, with a little more than 30 percent saying that they were somewhat concerned, and only 9.7 percent saying that they were very concerned. [18] One researcher even created an automatic script that asked hundreds of thousands of Facebook users to be added as a friend, thus allowing full access to their profile information. About 30 percent said yes. As the professors Ralph Gross and Alessandro Acquisti note, these 30 percent "are willing to make all of their profile information available to a random stranger and his network of friends." [19] Studies like these suggest that although people express some concern over privacy, it is not always reflected in their behavior.
A Nuanced View of Privacy
People's views about privacy, however, are much more complicated than the rather simplistic notions of privacy in existing law and policy. If we see people exhibiting themselves before the public without inhibition, our natural reaction is to think that they obviously don't want privacy. But the reality is more nuanced. Recall the Facebook incident discussed in the previous chapter. Facebook added the News Feed feature alerting people's friends about the up-to-the-minute changes made in their profiles. And users got quite upset over this change, viewing it as invasive of privacy.
I think that two lessons can be gleaned from the Facebook incident. First, Facebook users didn't want absolute secrecy for their information; they were concerned about the extensiveness of the exposure. They wanted a certain level of exposure and were angry when the News Feed feature upset their established balance. Second, the Facebook incident may also reflect the fact that many people just don't appreciate the extensiveness of their exposure online. Although they may understand that what they put online is widely exposed, they might not really grasp the consequences.
Part of the problem is that the Internet makes it hard to visualize the breadth of our exposure. Placing information on a website and writing blog posts and comments feels more akin to chatting with friends, writing a diary, or talking on the telephone than like broadcasting live on television, publishing a novel, or addressing a crowded auditorium. This difficulty is compounded by the often ambivalent desire we have for concealment and exposure. Some teenagers have contradictory ambitions for their posts. One teenager interviewed for a story in the New York Times Magazine explained that "he wanted his posts to be read, and feared that people would read them, and hoped that people would read them, and didn't care if people read them." [20] Although at first blush the teenager's statement doesn't make much sense, its self-contradictions actually capture the ambivalent attitudes of many bloggers. Writing blog posts is exciting in many ways. It can be cathartic. It can be fun to express oneself openly. People enjoy venturing their deepest secrets, hoping for a sense of acceptance or understanding or even just a bit of attention. One blogger wrote: "Maintaining a blog with no one visiting or commenting would be [as] sad as a clown doing a show with no one watching." [21]
Blogging can be like writing a diary, only with the hope that others might read it. By blogging, you're putting yourself out there, often unfiltered and unedited. And because you can't see or touch your audience, because you blog in the solitude of your room, in front of your computer late at night, it doesn't seem like exhibitionism. There's no bright spotlight. It's just you and your computer. Blogging has an uncanny way of encouraging you to doff your inhibitions. Most of the time you wonder: Is anybody listening? Often, the answer is no. People feel as though they're exposing themselves on a stage before an empty auditorium. But with the Internet, in an instant, the spotlights could come on and the auditorium could be overflowing with people. The Electronic Frontier Foundation, in a guide to blogging safely, notes: "If you blog, there are no guarantees you'll attract a readership of thousands. But at least a few readers will find your blog, and they may be the people you'd least want or expect. These include potential or current employers, coworkers, and professional colleagues; your neighbors; your spouse or partner; your family; and anyone else curious enough to type your name, email address or screen name into Google or Feedster and click a few links." [22] A top law school recently provided blogging advice to its students: "We urge you to take the long view and the adult view of what you write. THINK about the words you send out into the world, and imagine what they would make you look like when you -- and surely some of you will -- find yourself under review at a confirmation hearing for a professional position you dearly desire." [23]
Get Me an Editor ... or Not
One of the main differences between blogs and mainstream media publications is style. Blog posts are edgy, not polished and buffed into the typical prefabricated write-by-the-numbers stock that often gets produced by the mainstream media. Discourse on the Internet is pungent. In many respects, this is a virtue. Just as the key to robust free speech is battling attempts at censorship, the key to robust blogging is, I think, battling internal censors. I often fire off posts about whatever half-baked (even quarter-baked) idea happens to be buzzing in my head at a particular moment.
But blog posts are created with no editors and published with no time delays. There's little time to cool down before sounding off. Just click the Publish button and unleash it to the world ... then think about the consequences later. It goes without saying that this is a recipe for some problems. That nude picture a teenager puts up in a moment of indiscretion -- it can be forever present, forever regretted. One girl chronicled her mental breakdown on her blog, describing her self-mutilation, sexual experiences, and family turmoil. When she thought the better of it, she removed the posts from her blog. [24]
Another part of the problem is that blogs and social network websites are the "in" technology that children have integrated into their lives. They are a means of socialization and communication. Just as conversations migrated to the telephone and then to email and instant messaging, now they are migrating to social network websites. The problem is that these sites are not designed in ways to emphasize the potential harms to privacy and other consequences. Cyberspace is the new place to hang out, the perils of exposure notwithstanding. The pressure to fit in, to do what everybody else is doing, overrides concerns about privacy.
In the end, I believe that people still want privacy, but privacy in the digital age is much more complicated than its old-fashioned equivalent. Rarely can we completely conceal information about our lives, but that doesn't mean that we don't expect to limit its accessibility, ensure that it stays within a particular social circle, or exercise some degree of control over it. Moreover, although it would be too authoritarian for the law to stop people from expressing themselves online, there are things that can be done to provide them with more protection.
THE POWER OF ARCHITECTURE
The technological design of the websites has an enormous impact on people's privacy. Lawrence Lessig and Joel Reidenberg emphasize the importance of Internet "architecture" -- the code used to structure our choices on the Web. [25] Architecture can shape people's behavior. [26] Physical architecture, such as buildings, can affect the way we live and interact with our peers. Spaces can be designed to encourage people to be more open, to communicate with each other more frequently. Or spaces can be designed to encourage solitude. Like physical spaces, virtual spaces on the Internet are also designed environments. Social network websites are a structured form of interaction, created according to rules set up by those who create the site. The design choices social network websites make will have profound effects on the way their users interact with each other.
Changing the Defaults
One of the primary problems with social network websites is that they are designed to encourage people to expose a lot of information with very little thought about the consequences. The default privacy setting on MySpace, for example, is that anybody in the public can view one's profile.
A section of the Myspace privacy settings. Under "Who Can View My Full Profile," the option selected by default is "Public."
Likewise, although Facebook allows users to restrict who can see their information, the default setting allows everybody to see it. [27] Unless a user changes the default settings, her profile will be accessible to millions of people. The default settings on many social network websites privilege openness over privacy. According to one study, although Facebook "provides users with a very granular and relatively sophisticated interface to control the searchability and visibility of their profiles," the users "tend to not change default settings." [28] In another study, two researchers concluded: "As a whole, users are familiar with the privacy features Facebook offers, and choose not to use them." [29]
Simply changing default settings might protect a lot of people. The settings or preferences screen on various websites may constitute one of the most important influences on the shape of privacy in the future. The law should not force companies to set specific defaults, but the companies should be encouraged to think about how the design of their websites affects privacy.
The Concept of "Friend"
As discussed earlier in this book, social network sites often have a very loose concept of "friend." The sites divide a person's social universe into "friends" and everybody else. Of course, a person's social network is far more complex, but it must be translated into the terms established by the social network websites. Because social network websites lack a more granular set of categories for social relationships, they encourage users to share information with others who otherwise would not be privy to it. Two scholars who study social network websites, Judith Donath and danah boyd, astutely observe: "By making all of one's connections visible to all the others, social network sites remove the privacy barriers that people keep between different aspects of their lives." To illustrate this phenomenon, they tell the story of a high school teacher who joined Friendster. To protect her privacy, she allowed her profile to be viewed only by "friends." But then one of her students found out she was on Friendster and asked to be added as a friend. This put her in an awkward position for several reasons. Her only choices were to acknowledge the student as a friend or to completely rebuff the student. No intermediate category existed for their relationship. Donath and boyd observe: "She had originally joined with some friends, many of whom had created 'crazy, fun' profiles, including suggestive testimonials, risque photographs, and references to wild times at the Burning Man festival. ... Although she could edit her own profile to be quite sedate, her friends' profiles were not. Accepting her student's friendship request would reveal her full network to her class, while saying 'no' felt rude and distancing."
We live complex lives, and we often inhabit many very different social circles. Donath and boyd note that "sometimes simply encountering people from different aspects of someone's life can be quite revealing. The discomfort can be felt both by the performer caught in two roles and the observer." [30] The difficulty with social network websites is that they view a person's relationships as one unified social network, when in fact people have a rather elaborate set of connections. Each connection involves different levels of exposure and different ways of sharing information. And while we may share information freely among one social circle, we may not want information to bleed between the different social circles we occupy simultaneously. But social network websites tear down these boundaries. They present a simplified picture of people's social network that eliminates the many nuanced barriers to information flow. To participate, people must often share information beyond the limits they would ordinarily establish in the real world.
The law shouldn't force websites to alter their design. This would be too authoritarian. But it is important for websites to consider the consequences that their architectural choices will have on the lives of millions of people.
Employer Responsibilities
Although there isn't a lot the law can do to address the self-exposure problem, the law can operate to help protect people in some limited contexts. Chris Hoofnagle, a researcher at Berkeley Law School, proposes the regulation of employers who would google prospective employees. [31] Under federal law, if an employer asks a credit-reporting agency to conduct a background check on a prospective employee, the employer has certain obligations to the applicant. For example, if information in the report dissuades the employer from making a job offer, he must reveal that to the applicant. [32] The purpose of this requirement is to allow the applicant a chance to explain. Perhaps the report was in error. Perhaps there's a reasonable explanation. With the use of search engines like Google, employers can conduct amateur background checks without any legal protections. There is no requirement that employers tell applicants that they were googled. What often happens is that an applicant is simply not called in for an interview, or if interviewed, is simply not invited back for further consideration. As we have seen, employers are increasingly using Google as well as searching social network websites to find out about applicants. But a lot of the information online isn't accurate. Another problem is that information about a different person with the same name can be mixed in. A requirement that employers who conduct online searches of applicants notify them about the search will at least give applicants a chance to be heard.
Of course, such a requirement could readily be violated. It would be difficult to prove that an employer had googled an applicant. But even if enforcement was problematic, many employers would probably respect a requirement to notify applicants. Moreover, such a rule would help establish a norm. And in such a difficult area to navigate, creating a norm would be a significant step forward.
Education
At the end of the day, if people want to expose themselves to the world, there's only so much that can be done to stop them. Self-disclosure is nevertheless a problem, as teenagers and college students are often revealing too much information and later regretting that they cannot take it back. Education is the most viable way to shape people's choices in this regard. For example, one study indicated that people have a lot of misunderstandings about who is able to search their Facebook profiles. Although most Facebook users are "aware of the true visibility of their profile ... a significant minority is vastly underestimating the reach and openness of their own profile." [33] We need to spend a lot more time educating people about the consequences of posting information online. In a survey conducted in 2006, "two thirds of parents had never talked with their teen about their MySpace use, and 38 percent of them had never seen their child's MySpace profile." [34] Teenagers and children need to be taught about privacy just like they are taught rules of etiquette and civility.
TO THE END OF THE INTERNET
A television commercial that I find immensely amusing opens with a guy surfing the Internet on his computer. He clicks the mouse, and all of a sudden, a computerized voice from his PC says: "You have reached the end of the Internet. You have seen all that there is to see." It's a commercial for high-speed broadband. The message is that the advertised broadband service is so fast that you can see the entire Internet.
Of course, the humor in this is that you can't exhaust the Internet. It's too big. Every day it grows by millions of new Web pages and blog posts. The Internet is akin to the endless library imagined by the writer Jorge Luis Borges. In his story "The Library of Babel," Borges wrote of a library with an "infinite number of hexagonal galleries." Initially, "when it was announced that the library contained all books, the first reaction was unbounded joy." But then people discovered the rub: finding the right book could take centuries, and many books were totally incomprehensible. [35] And so it is with the Internet. Unlike the hapless users of Borges's library, we Internet users have what has become known as "the search" -- the ability to use search engines like Google to help us find the information we're looking for. Google's great innovation has been not only to comb the Internet to bring back as many relevant pieces of information as possible but also to rank them in an order calculated to reflect their relative usefulness. [36]
But "the search" is just in its infancy. John Battelle, the author of a popular book on Internet searching, observes: "As every engineer in the search field loves to tell you, search is at best 5 percent solved -- we're not even in the double digits of its potential." [37] For example, a large part of the Internet has not been combed or cataloged by Google. The so-called invisible Web remains, which "comprises everything that is available via the Web, but has yet to be found by search engines." [38] Google searches the epidermis of the Web, but lots of content still remains undiscovered. [39] What will happen when the search improves?
The Internet is still quite young. In the first chapter of this book, I likened the Internet to a teenager, beginning to test out its new freedom and powers yet still in the early days of its development. The Internet is growing up rapidly, and no end is in sight. Nor is there any end to the issues in this book. Right now, the next great innovations are probably being created in somebody's dorm room or garage. After all, that's where Facebook and Google began. [40] What's ahead will be amazing. It makes me giddy with excitement to think about it -- but also a bit frightened.
Will people be blogging and using social network websites a decade from now? Who knows? But people will almost certainly be spending a lot of time online. And it is a safe bet that people will be exposing details about their lives, as well as gossiping, shaming, and spreading rumors. The technologies may change, but human nature will remain the same.
Although the Internet poses new and difficult issues, they are variations on some timeless problems: the tension between privacy and free speech, the nature of privacy, the virtues and vices of gossip and shaming, the effect of new technologies on the spread of information, and the ways in which law, technology, and norms interact. New technologies do not just enhance freedom but also alter the matrix of freedom and control in new and challenging ways.
The questions are immensely complex, and there are no easy answers. Just when we think we're smoothing problems out, new technology adds another wrinkle. But we can take steps to protect privacy if we make an effort. We must. After all, it's just the beginning.