THE TWO-TIERED ETHICS OF ELECTRONIC DATA PROCESSING
Edmund F. Byrne, Indiana/Purdue University at Indianapolis
Who owns electronic data, and under what conditions may another take them for his or her own use without being considered a thief? The electronic data processing (EDP) industry's answer to these questions is that electronic data belong to no one before they are collected but once collected they are property, so only those who take collected data without authorization are stealing. Personal privacy is unquestionably involved in the original taking; but the major EDP users routinely sacrifice such concerns to the preeminence of private property. But, I argue, this selective approach to the claims of private property is built on assumptions more readily associated with conquest than with a community of equals. 1
In particular, the major EDP users operate under four questionable as- sumptions: (1) that at no point in the process do electronic data belong to their subjects; (2) that electronic data are not a public good; (3) that the major collectors and their consumers are not free riders; but (4) others are if they use what has been collected without paying. Though inconsistent if laid out on a level playing field, these assumptions are mutually tenable if ownership rights are reduced to the prerogatives of power. But this two-tiered ownership system creates a rule of law in behalf of the strong while leaving the weak in a state of nature in other words, a two-tiered ethics of EDP.
This two-tiered ethics is arguably efficient; but, I contend, it is not equitable. To support this contention, I will assess the current state of affairs by drawing on two concepts familiar to political economists: public goods and free riders; but I will add a third concept to their repertoire: the Reluctant Samaritan.
l. Taking, in a Bifurcated Polity
It is generally considered wrong to take something that belongs to someone else. If the taker is acting in behalf of a group, however, the status of the group makes a difference. A taker is more likely to be praised if doing so, say, for a respected intelligence agency than if in the service of a pariah organization. If the group is, or is acting for, a major corporation, some may complain; but its actions will be socially tolerated if they are consistent with the principles of market liberalism. 2
Market liberalism divides society into a public sphere and a private sphere and justifies this division by the complementary ways in which each serves the interests of private property. This assignment of political preeminence to private property tends to exempt owners from responsibility for non-owners; and anything can in principle be owned. But not everything is worth owning: goods are not worth owning if an owner's costs exceed benefits. If the benefits are nonetheless desirable, an alternative to purely private ownership may be constructed.
Public goods (PGs), according to economists, are by nature nonexcludable: if available to payers, they are available to nonpayers as well; hence, according to a traditional argument, their fair distribution requires government intervention, notably by means of taxation and law enforcement. So the economist's concept of a public good has a negative connotation: government is involved only by default. This negative connotation is, however, misleading. If equal distribution is considered a necessary condition for a PG, then none exists (even the most commonly cited example, national defense, manifestly benefits some more than others); but if the equal distribution requirement is dropped, then all goods are in some respect PGs because none is perfectly excludable. So some government (private, if not public) would seem to be a necessary condition for effective ownership of any goods. This is especially so because of the free rider problem.
To an economist, a free rider is one who receives a benefit without helping to cover its costs. A free rider is not a thief, in any moral sense, because the free rider takes some of a PG which by definition is not exclusively owned; but such taking is an obstacle to equitable distribution. To a market liberal, then, if there were no free riders, there might be no need for government; thus is the free rider a construct with which to justify government intervention to defenders of absolute market hegemony. That being its function, however, its applicability is imprecise. After all, we all enjoy benefits for which we do not pay. The powerful in particular enjoy exceptional benefits without necessarily having contributed anything to make their enjoyment possible. The powerless are por- trayed as having few resources to contribute, but they do contribute to others' benefits by enduring both exclusion from, and spill-over costs of those benefits. So a more equitable ethic than is currently in favor would reconsider what counts as a contribution and thus who really rides free. This can be clarified by revising the traditional concept of a Good Samaritan.
A Good Samaritan, traditionally understood, is a voluntary surrogate payer for benefits not otherwise available to a nonpaying other. According to this definition, almost everyone is a Good Samaritan with regard to others, most commonly, one's children, but, through institutionalized arrangements, strangers as well. It assumes, however, that the existing distribution pattern is fair so a Good Samaritan's giving is gratuitous. This puts have-nots in an unenviable position; so market liberals sometimes encourage haves to perform acts of compassion. Gratuitous compassion cannot be relied on, though, to meliorate substantially a maldistribution of private property. It is therefore tempting to revise the Good Samaritan concept to include reluctant, disempowered contributors to others' well-being in short, Reluctant Samaritans. Yielding to this temptation, however, would undermine the market liberal concept of a free rider. Three observations will suggest why this is so.
First, nonpayers have access to many imperfectly excludable benefits for which no one can contribute commensurably. Indeed, most benefits we enjoy require no commensurate contribution (our very existence, for one; a war-free habitat and personal autonomy for others). In particular, we all ride free on the contributions, intentional or not, of preceding generations.
Second, a nonpaying free rider presupposes a payee whose identity is, however, indeterminate. If this payee is construed as being public, the nonpayer might perhaps be a tax evader; if the payee is construed as private, the nonpayer might be a thief. But the former identification is precluded by the public good requirement, and the latter, by the required indeterminacy of obligation. If thieves and tax evaders be alternatively discounted at the extremes, a free rider might mean only one who can, but chooses not to, pay for a benefit that the market cannot effectively provide (say, by voting against a tax). If the nonpayer's ability to pay is built into the definition of a free rider, however, then the free rider is by definition richer and more powerful than the Reluctant Samaritan.
Third, no property is immune from a free rider problem: owners are threatened by takers as varied as stagecoach robbers, shoplifters, inside traders, and hostile takeover artists. To keep such losses from exhausting the potential for gain, owners may limit them (say, by enhancing human or technical security) or distribute their impact (say, by insuring providers or increasing charges to consumers). Governments in particular are persuaded to distribute exclusivity costs across their entire population: via taxes, civil and criminal sanctions, and concerted efforts to eliminate noncompliant competitors. Such public loss distribution seldom assures equal access to benefits, but often exacts disproportionate contributions from those denied access. 3 Exclusivist thinkers often stereotype these "least advantaged" as lazy and antisocial; more inclusivist thinkers (e.g., John Rawls) acknowledge that some intra-societal envy may be justified. Historically, the potential for social disruption is one of the principal reasons for safety net policies that have become the welfare state, a system of benefit distribution built politically on rejection of free rider thinking and collectivization of the Good Samaritan. 4
As these observations suggest, I think the concept of a Reluctant Samar- itan merits further development. Here, however, I propose only to explore how it challenges the bifurcated way in which ownership of EDP is being treated.
2. Ownership and Control of EDP
Computers have no moral principles. Their users do, as much as people in general; but until the recent emergence of an encryption technology that can guarantee government intrusion, few computer experts have been concerned about the vulnerability of data subjects to harmful use of EDP. 5 This might not matter if each user remained isolated with his or her computer. But the ever more communicatory computer makes both the collection of and accessibility to data subject to technological variations on the free rider theme.
Data that enhance either wealth or power are ever easier to collect. So privacy-based objections to their collection give way pragmatically to a property rights debate with regard to their storage and retrieval. For no available means of restricting access is foolproof enough to exclude noncontributing users: technological (especially software) defenses against hackers or virus-planters, though ingenious, are pregnable. So electronic data are a public good in the economist's sense that by their very nature use of them cannot be restricted to payers. This is true, as noted, with regard to any so-called private property; but it is singularly true of data the value of which is a function of its accessibility.
Accessibility is enhanced by, if not dependent on, transmissibility. But this makes transmitted electronic data subject to all the old gold shipper's security problems: it is the stage coach robber revisited, but on a vastly more consequential scale. Protective technology now as then is inadequate. Whether moving gold bullion or electronic funds, neither a human nor a technological armed guard can guarantee the security of in-transit goods. So shippers look to punitive sanctions and enough enforcement to bolster the value of compliance. But if an intruder can hide behind the electronic equivalent of a face-concealing mask, the free rider rides again.
In the absence, then, of reliable technological security, data that are storable or transmittable electronically are declared to be private property, the taking of which is subject to sanctions. But might tends to determine what is right. So the rules imposed on comparatively powerless individuals are seldom applied as rigorously to powerful institutions: purse-snatchers may be imprisoned, but brokerage firms found to have defrauded people of hundreds of millions of dollars are comparatively lightly fined. Similarly, sanctions are assigned asymmetrically with regard to electronic data.
The rules for data gathering leave subjects in a Hobbesian state of nature and exempt collectors from Locke's reminder to leave enough and as good for others. The individual interloper is disparaged as a threat to capitalist values. Meanwhile, the most consequential laborers in the EDP vineyard are businesses and governments, whose agents gather and transfer great masses of electronic data about people's lives with relative impunity.
Businesses seek any electronic information about actual and potential employees, competitors, and customers that may have cash value. They routinely justify their doing so in terms of benefits to the company; and, in spite of protests which on occasion are translated into lawsuits and proposals for regulatory legislation, few restrictions have been effectively imposed. 6 Inversely, they oppose giving outsiders access; but their opposition is increasingly being neutralized by electronic interlopers operating either within or beyond their workforces. 7 The intrusive hacker, once tolerated as an electronic joy rider, is now portrayed as an isolated or at best loosely affiliated individual indistinguishable from a burglar. 8 But companies' claims to confidentiality are also being challenged by shareholders, competitors, and public interest groups that have legal standing and/or technological capability to acquire information the companies would deny them. 9 This intrusive behavior might eventually render some companies' proprietary claims obsolete, as is already happening to brokerage firms because investors can now access investment information from their own computers. 10 But the major users of EDP still insist that they should be able to exclude uninvited others.
In short, the prerogatives of the gatherer are proportionate to the gatherer's power and influence. In contrast to the uninvited EDP user, a user seen to be enhancing a major institution's well-being is defended. As applied to government, this means: if EDP is used to help keep the ins in, this is a commendable use. Affirmative examples include electronic constituency profiling to "narrowcast" an elected official's targeted mailings, or, inversely, electronic networks that facilitate constituent communication with government, even to the point of tele-debating public issues. 11 A negative example is a chain letter sent out over a computer bulletin board to generate opposition to Desert Storm. The U.S. Federal Communications Commission wanted the network provider to play censor, but commercial interests warned that such assignments of liability might nip an attractive new business in the bud. 12 This concern about liability has cooled enthusiasm for an untrammeled bulletin board market in the electronic information services industry. Family-oriented Prodigy promises to keep its bulletin board clean; but other electronic networks prefer to be identified only with the medium and not with its messages. This opens the door to such electronic diversions as interactive computer sex play, which is now burgeoning in the United States but has already been suppressed by the Minitel system in France. 13 Though attention-getting, such applications are inconsequential compared with more established institutional uses of electronic data, notably "computer matching."
Through computer matching, personal information originally acquired for one purpose is gleaned for another. Sometimes the transformed information is used only by the entity that produces it. In some U.S. cities, for example, prosecutors store a suspect's answers at a bail-bond hearing, then use them in subsequent proceedings. 14 But other matchers are outsiders, such as the so-called information broker who sucks saleable data from government records by keying in on social security numbers. Antiquated and unenforceable privacy laws succumb to electronic supply and demand, regardless of possible harm to others. 15 Ethically improper? Perhaps. But why should the use of collected data be considered unethical if collecting them is not? On this point one might consult liberal theorists who debate the ethics of charging a fee for not revealing harmful information to which one is privy. 16 Personal privacy seldom prevails, however, when those claiming a need to know are political or commercial institutions. Military concerns add weight to popular insistence on data security; but even this consideration seems no longer able to contain the corporate passion for information. Restoring balance to this asymmetrical dispensation seems desirable; but this is hard to do without favoring haves over have-nots. Six reasons may be cited here.
First, complete security is not technically feasible. Computer manufac- turers used to believe that excluding unauthorized intrusions would be prohibitively expensive. But no physical or positive laws can guarantee the security of information if others want it desperately enough; and inventive hackers have demonstrated that not even systems dedicated to the global transfer of tril- lions of dollars are secure. 17 The balance sought, then, is between what is desirable and what is affordable; but affordability is relative: larger and richer companies can more easily absorb additional costs.Second, accessibility requirements limit how effectively data can be protected from outsiders. A common approach to this problem is to gradate the data. According to one proposal, they should be divided into three levels of sensitivity. 18 This proposal involves seventeen fewer categories than another which covers everything from published information to blackmail and extortion. 19 Other proposals focus on the security of the hardware-software complex or intra-organizational levels of responsibility for data protection. 20