2021 Annual Report: Checking the Power of Surveillance and Data Sharing

Photo collage - on the left, a person wearing headphones checks their wearable on their wrist. On the top right, a poster carrying the message "Democracy Stands. The Constitution Stands" is taped to a cityscape in front of the U.S. Capitol. On the middle right, a person holds their credit card while entering their information into a browser on a laptop. On the bottom right, a row of students works in a classroom filled with computers. — Photo collage – on the left, a person wearing headphones checks their wearable on their wrist. On the top right, a poster carrying the message “Democracy Stands. The Constitution Stands” is taped to a cityscape in front of the U.S. Capitol. On the middle right, a person holds their credit card while entering their information into a browser on a laptop. On the bottom right, a row of students works in a classroom filled with computers.

In a world where so many aspects of daily life rely on technology, privacy and security protections are more important than ever. These protections are essential not only to combat theft and exploitation of users’ data, but also to give people the peace of mind that they can communicate privately and freely, without fear of surveillance. Whether you’re a customer using online banking, a patient seeking online health counseling, a social justice organizer, or a whistleblower connecting with a reporter, protected communications matter – particularly for activists, journalists, and people from marginalized groups.

For years, CDT has fought for individuals’ ability to access strong end-to-end encryption. In 2021, we continued to grow the Global Encryption Coalition, which CDT co-founded in 2020 as a network of allies focused on responding to government efforts to undermine encryption around the world. We led a broad international coalition of over 90 civil society organizations to successfully pressure Apple to reaffirm its commitment to protecting its millions of users with end-to-end encryption. The company quickly recalibrated its flawed approach to child safety, so as to avoid punishing or surveilling the minors that use its services, and avoid the risk that governments could abuse certain features by compelling Apple to detect content deemed objectionable. Through our work with the Global Encryption Coalition, we were able to convince the Belgian government to drop a proposal that would have required tech companies to build backdoors into their encrypted services. The first Global Encryption Day – October 21, 2021 – featured 70 events worldwide, and resulted in 168 organizations signing the Global Encryption Day statement calling on governments and the private sector to reject efforts to undermine encryption. More than 2.4 million people viewed Global Encryption Day resources, including those urging people to switch to using services and products protected by strong encryption.

At a time of growing authoritarianism around the world, CDT advocated for policies that limit the reach of dangerous surveillance technologies.

At a time of growing authoritarianism around the world, CDT advocated for policies that limit the reach of dangerous surveillance technologies. Following revelations that the NSO Group’s Pegasus spyware was used to surveil activists, journalists, and heads of state, we called on governments around the world to regulate the export, sale, and use of technology being used to break into cell phones and other digital devices, and establish or strengthen means of redress for people who are harmed by unlawful surveillance. States have a human rights obligation to check the power of the private surveillance industry, whose products and services cause people worldwide to engage in self-censorship, and which operates without adequate legal frameworks, oversight, safeguards, or transparency.

Student activity monitoring tools are another example of surveillance impacting society: original CDT research published in 2021 found that the tools being used by schools to monitor students’ activities on devices inhibit students’ self-expression, and leave parents and teachers concerned about unintended consequences like disproportionate discipline or “outing” of LGBTQ+ students. Because of the serious privacy and equity risk these tools pose, we recommended that schools minimize the data collected, maintain control of the data they share with vendors, and avoid the dangerous path taken by some school districts who have shared student data with law enforcement.

CDT also dug into a growing and worrisome practice in the surveillance industry – the accessing by law enforcement of vast troves of information gathered by private data brokers.

This year, CDT also dug into a growing and worrisome practice in the surveillance industry–the accessing by law enforcement of vast troves of information gathered by private data brokers. Federal intelligence and law enforcement agencies are sidestepping Fourth Amendment and statutory requirements for obtaining sensitive information on individual Americans, spending millions of dollars to purchase it from data brokers and leaving little in the way of public paper trails. Because this practice has become widespread, and limits on the availability of commercially-acquired information are few and far between, we called on Congress to close the loophole in the Electronic Communications Privacy Act that allows law enforcement to acquire communications data commercially without adequate legal process.

An essential step to truly safeguarding consumers’ privacy is passage of meaningful federal privacy legislation, which again remained elusive in 2021. CDT continued its calls for a comprehensive, effective, and enforceable federal privacy law that holds companies responsible and promotes consumer trust. In addition to efforts in Congress, CDT engaged with the National Telecommunications & Information Administration’s proceeding on discriminatory uses of data, which we believe should be addressed and included in any privacy bill. We also continued our work focusing on specific high-risk subject areas, such as our work with the eHealth Initiative (now Executives for Health Innovation) to develop strong standards to protect consumers’ health data, and the launch of our new project on technology and workers’ rights.

The unregulated or underregulated collection, use, and sharing of data — whether by governments or companies — disproportionately burdens marginalized people and chills the rights to free expression and association. CDT is leading the fight to check it on all sides.