Macchiarulo, Anthony 10/5/2018 for Educational Use Only
Total Page：16
File Type：pdf, Size：1020Kb
Anthony Macchiarulo 185 West Broadway New York, NY 10013 November 9, 2018 VIA E-MAIL: [email protected] National Telecommunications & Information Administration U.S. Department of Commerce 1401 Constitution Ave., N.W., Room 4897 Washington, D.C. 20230 Phone: (202) 482-7002 Re: Docket No. 180821780-8780-01; New Approach to Consumer Data Privacy Dear NTIA Privacy RFC: I am writing to request the National Telecommunications & Information Administration (“NTIA”) research the implementation of artificial intelligence (“AI”) and Radio-frequency identification (“RFID”) technology on global supply chain systems to prevent against international hardware espionage. More specifically, I am writing to request the expansion of AI and RFID research to support the NTIA manage consumer privacy risk. I propose goals for setting the broad outline for the direction that federal action should take in expanding AI and RFID and details as to how these goals can be achieved. Although consumer privacy is violated through software conduits, invasion of privacy through hardware and the global supply chain are not given enough attention. The NTIA needs to pay more attention to the risk hardware traveling along the global supply chain poses to consumer privacy. By researching AI and RFID, the NTIA will be able to meet their goals of developing policy on issues related to the internet economy and help manage consumer privacy risk. 1 I. Foreign Espionage Bloomberg reported how Chinese spies reached thirty U.S. companies, including Amazon.com, Inc. (“Amazon”) by compromising America’s supply chain. Amazon acquired a company named Elemental Technologies (“Elemental”) in 2015 to create servers for Amazon Prime Video Services. Elemental had these servers manufactured in China from a company named Super Micro Computer, Inc. (“Super Micro”). In one of Amazon’s third-party product tests of Elemental’s servers, they found a tiny microchip seeded onto the server’s hardware that was not part of the product’s original design. This small chip was able to tell the device to communicate with one of several anonymous computers elsewhere on the internet that were loaded with more complex code. The tiny microchip was able to compromise one of the largest companies in the world, which in turn compromised the privacy of all users of that service. Super Micro has relationships with many multinational corporations such as Apple, Inc. Super Micro’s manufacturing plants were backdoor gateways for foreign espionage. The chip was so microscopic that it was difficult for the naked eye to detect. Elemental had contracts with the Olympic Games, the International Space Station, and the Central Intelligence Agency. Through Super Micro, Chinese spies had access to global privacy data. Large corporations and institutions are hubs of individual consumer privacy data. These corporations and institutions collect sensitive data on their customers, which in turn become exposed to spies.1 An AI scanner or RFID tag would have detected the espionage well before leaving the manufacturing facility. Tracking hardware with AI and RFID technology throughout every stage 1 Jordan Robertson and Michael Riley, The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies, Bloomberg (Oct. 4, 2018), https://www.bloomberg.com/news/features/2018- 10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies (last visited Oct. 8, 2018). 2 of the supply chain will protect consumer privacy. Shifting policy to allow for companies or logistic providers to track every movement of hardware from manufacturing to delivery between vendors, storage units, operations, and consumer distribution will prevent foreign privacy attacks. II. The Fourth Amendment The fourth amendment protects and encourages this type of surveillance of consumer privacy. The fourth amendment provides the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures. No warrants shall be issued without probable cause, particularly describing the place to be searched, and the persons or things to be seized.2 In Florida v. Riley, the supreme court held there is no reasonable expectation the contents of a greenhouse were protected from public or official inspection of a helicopter with the naked eye. Here, the inspection of technological hardware with the use of AI and RFID should not be used to violate the privacy of company’s products but aid in the protection of these products.3 The Federal government will need a warrant to implement AI scanners and RFID tags into logistic freight and the supply chain. In Kyllo v. United States, the court held where police obtain information about the inside of a home without physical intrusion, using a device not normally used by the public, the police action constitutes a fourth amendment search and is unreasonable without a warrant.4 Therefore, I recommend gaining access to warrants as part of the harmonization of global logistics traceability agenda proposed. The court in U.S. v. Lacy, held a 2 U.S. Const. Amend. IV. 3 Florida v. Riley, 109 S.Ct. 693 (1989). 4 Kyllo v. U.S., 121 S.Ct. 2038 (2011). 3 general warrant that specifies “the computer” and not anything more specific is okay.5 Here, a general warrant should be sufficient. Although the court in U.S. v. Carey, held the government cannot use a legitimate warrant to search a computer for evidence of illegal drug distribution to search for pornography.6 The court in U.S. v. Campos, held legitimately searching for child pornography, a specific warrant need not force you to stop at the two images that started the investigation.7 Here, a specific warrant for AI to scan hardware of any criminal activity or a warrant to place RFID tags on all products should not be a violation of the fourth amendment because it is just the starting point of traceability and violations discovered after the fact are no longer a violation of the fourth amendment but an aid to consumer privacy. The court in Carpenter v. U.S. held tracking person’s movements and location through extensive cell-site records is intrusive and a violation of fourth amendment rights.8 Here, the tracking of products for personal security is not a violation of fourth amendment rights because it is no intruding on personal movements but searching for criminal behavior in hardware on a macro scale. Using AI and RFID technology on company specific products is for protection and is not the goal to intrude on the personal movements of consumers. Rather, the goal is to help consumers understand where and how their products are being manufactured. By creating this type of transparency, it will benefit the compliance with each sector’s general guidelines of privacy. 5 U.S. v. Scott Douglas Lacy, 119 F.3d 742 (9th Cir 1997). 6 U.S. v. Carey, 551 F.2d 309 (10th Cir 1999). 7 U.S. v. Campos, 237 Fed.Appx. 949 (5th Cir 2007). 8 Carpenter v. U.S, 108 S.Ct. 316 (1987). 4 III. Notice and Choice In the U.S., major privacy acts are sectoral. A few examples include The Children’s Online Privacy Protection Act (“COPPA”)9, The Gramm–Leach–Bliley Act10, and The Health Insurance Portability and Accountability Act (“HIPAA”).11 Notice refers to providing consumers with information about how their data is used. This is usually found in a privacy policy. Consumers should be given notice of an entity's information practices before any personal information is collected from them. Choice refers to giving consumers options to control how their data is used. Here, there was no notice or choice when foreign spies compromised Amazon’s servers. Two widely used notice and choice acts across the U.S. are the California Online Privacy Protection Act (“CalOPPA”) and the California Consumer Privacy Act. CalOPPA requires privacy statements be conspicuous.12 The California Consumer Privacy Act gives consumers the right to know who and where their data is being used and for what reason.13 Here, with AI and RFID technology, consumers would be able to track every stage of the distribution process, where every piece of hardware is located at any time, how it is being built, and by who. Giving consumers notice and the power of choice by way of AI and RFID technology is in conformance with CalOPPA and the California Consumer Privacy Act. Implementing AI and RFID technology, the NTIA can help protect against violations of sectoral privacy regulations. 9 The Children’s Online Privacy Protection Act. 10 The Gramm–Leach–Bliley Act 11 The Health Insurance Portability and Accountability Act. 12 The California Online Privacy Protection Act. 13 The California Consumer Privacy Act. 5 IV. General Data Protection Regulation (“GDPR”) The GDPR protects and encourages this type of surveillance of consumer privacy. Although privacy laws in the U.S. are sectoral, the global supply chain must comply with the GDPR and global privacy regulations. The GDPR relates to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. Article I of the GDPR requires “The free movement of personal data within the European Union (‘Union”) be neither restricted nor prohibited for reasons connected with the protection of natural persons.” 14 Here, AI and RFID technology will protect against free movement restrictions. Article III of the GDPR provides for territorial scope. The GDPR covers all individuals within the European Economic Area (“EEA”). The GDPR operates much like a long-arm statute, where companies need to comply with European community law and national law, just like companies have to comply with federal and state laws. The GDPR raises questions about International data flows.