Yes, you are under surveillance

In "private" online forums, at malls, and even at home, someone is tracking you

By Julia Angwin

SHARON AND BILAL couldn't be more different. Sharon Gill is a 42-year-old single mother who lives in a small town in southern Arkansas. She ekes out a living trolling for treasures at yard sales and selling them at a flea market. Bilal Ahmed, 36, is a single, Rutgers-educated man who lives in a penthouse in Sydney, Australia. He runs a chain of convenience stores.

Although they have never met in person, they became close friends on a password-protected online forum for patients struggling with mental health issues. Sharon was trying to wean herself from anti-depressant medications. Bilal had just lost his mother and was suffering from anxiety and depression.

From their far corners of the world, they were able to cheer each other up in their darkest hours. Sharon turned to Bilal because she felt she couldn't confide in her closest relatives and neighbors. "I live in a small town," Sharon told me. "I don't want to be judged on this mental illness."

But in 2010, Sharon and Bilal were horrified to discover they were being watched on their private social network.

It started with a break-in. On May 7, 2010, PatientsLikeMe noticed unusual activity on the "Mood" forum where Sharon and Bilal hung out. A new member of the site, using sophisticated software, was attempting to "scrape," or copy, every single message off PatientsLikeMe's private "Mood" and "Multiple Sclerosis" forums.

PatientsLikeMe managed to block and identify the intruder: It was the Nielsen Co., the media-research firm. Nielsen monitors online "buzz" for its clients, including drugmakers. On May 18, PatientsLikeMe sent a cease-and-desist letter to Nielsen and notified its members of the break-in.

But there was a twist. PatientsLikeMe used the opportunity to inform members of the fine print they may not have noticed when they signed up. The website was also selling data about its members to pharmaceutical and other companies.

The news was a double betrayal for Sharon and Bilal. Not only had an intruder been monitoring them, but so was the very place that they considered to be a safe space.

Even worse, none of it was necessarily illegal. Nielsen was operating in a gray area of the law even as it violated the terms of service at PatientsLikeMe. And it was entirely legal for PatientsLikeMe to disclose to its members in its fine print that it would sweep up all their information and sell it.

WE ARE LIVING in a Dragnet Nation — a world of indiscriminate tracking where institutions are stockpiling data about individuals at an unprecedented pace. The rise of indiscriminate tracking is powered by the same forces that have brought us the technology we love so much — powerful computing on our desktops, laptops, tablets, and smartphones.

Before computers were commonplace, it was expensive and difficult to track individuals. Governments kept records only of occasions, such as birth, marriage, property ownership, and death. Companies kept records when a customer bought something and filled out a warranty card or joined a loyalty club. But technology has made it cheap and easy for institutions of all kinds to keep records about almost every moment of our lives.

The combination of massive computing power, smaller and smaller devices, and cheap storage has enabled a huge increase in indiscriminate tracking of personal data. The trackers include many of the institutions that are supposed to be on our side, such as the government and the companies with which we do business.

Of course, the largest of the dragnets appear to be those operated by the U.S. government. In addition to its scooping up vast amounts of foreign communications, the National Security Agency is also scooping up Americans' phone calling records and Internet traffic, according to documents revealed in 2013 by the former NSA contractor Edward Snowden.

Meanwhile, commercial dragnets are blossoming. AT&T and Verizon are selling information about the location of their cellphone customers, albeit without identifying them by name. Mall owners have started using technology to track shoppers based on the signals emitted by the cellphones in their pockets. Retailers such as Whole Foods have used digital signs that are actually facial recognition scanners.

Online, hundreds of advertisers and data brokers are watching as you browse the Web. Looking up "blood sugar" could tag you as a possible diabetic by companies that profile people based on their medical condition and then provide drug companies and insurers access to that information. Searching for a bra could trigger an instant bidding war among lingerie advertisers at one of the many online auction houses.

IN 2009, 15-YEAR-OLD high school student Blake Robbins was confronted by an assistant principal who claimed she had evidence that he was engaging in "improper behavior in his home." It turned out that his school had installed spying software on the laptops that it issued to the school's 2,300 students. The school's technicians had activated software on some of the laptops that could snap photos using the webcam. Blake's webcam captured him holding pill-shaped objects. Blake and his family said they were Mike and Ike candies. The assistant principal believed they were drugs.

Blake's family sued the district for violating their son's privacy. The school said the software had been installed to allow technicians to locate the computers in case of theft. However, the school did not notify students of the software's existence, nor did it set up guidelines for when the technical staff could operate the cameras.

An internal investigation revealed that the cameras had been activated on more than 40 laptops and captured more than 65,000 images. Some students were photographed thousands of times, including when they were partially undressed and sleeping. The school board later banned the school's use of cameras to surveil students.

On April 5, 2011, John Gass picked up his mail in Needham, Mass., and was surprised to find a letter stating that his driver's license had been revoked. "I was just blindsided," John said.

John is a municipal worker — he repairs boilers for the town of Needham. Without a driver's license, he could not do his job. He called the Massachusetts Registry of Motor Vehicles and was instructed to appear at a hearing and bring documentation of his identity. They wouldn't tell him why his license was revoked.

When John showed up for his hearing, he learned that the RMV had begun using facial recognition software to search for identity fraud. The software compared license photos to identify people who might have applied for multiple licenses under aliases. The software had flagged him and another man as having similar photos and had required them to prove their identities.

John was a victim of what I call the "police lineup" — dragnets that allow the police to treat everyone as a suspect. This overturns our traditional view that our legal system treats us as "innocent until proven guilty."

The most obvious example of this is airport body scanners. The scanners conduct the most intrusive of searches — allowing the viewer to peer beneath a person's clothes — without any suspicion that the person being scanned is a criminal. In fact, the burden is on the individual to "prove" his or her innocence, by passing through the scanner without displaying any suspicious items.

John Gass luckily was given a chance to plead his case. But it was an absurd case. He was presented with a photo of himself from 13 years ago.

"It doesn't look like you," the officer said.

"Of course it doesn't," John said. "It's 13 years later. I was a hundred pounds lighter."

John presented his passport and his birth certificate, and his license was reinstated. But the officers wouldn't give him any paperwork to prove that it was reinstated. He wanted a piece of paper to show his boss that he was okay to drive again.

John filed a lawsuit against the RMV, claiming that he had been denied his constitutionally protected right to due process. The RMV argued that he had been given a window of opportunity to dispute the revocation because the letter had been mailed on March 24 and the license wasn't revoked until April 1. John didn't pick up his mail until April 5. The Suffolk County Superior Court granted the RMV's motion to dismiss. Gass appealed, but the appellate court also ruled against him.

John felt betrayed by the whole process. He now is very careful around state police because he worries that he won't be treated fairly. "There are no checks and balances," he said. "It is only natural humans are going to make mistakes. But there is absolutely no oversight.

THESE STORIES ILLUSTRATE a simple truth: Information is power. Anyone who holds a vast amount of information about us has power over us.

At first, the information age promised to empower individuals with access to previously hidden information. We could comparison shop across the world for the best price, for the best bit of knowledge, for people who shared our views.

But now the balance of power is shifting, and large institutions — both governments and corporations — are gaining the upper hand in the information wars, by tracking vast quantities of information about mundane aspects of our lives.

Now we are learning that people who hold our data can subject us to embarrassment, or drain our pocketbooks, or accuse us of criminal behavior. This knowledge could, in turn, create a culture of fear.

Consider Sharon and Bilal. Once they learned they were being monitored on PatientsLikeMe, Sharon and Bilal retreated from the Internet. Bilal deleted his posts from the forum. He took down the drug dosage history that he had uploaded onto the site. Sharon stopped using the Internet altogether and doesn't allow her son to use it without supervision.

They started talking by phone but missed the online connections they had forged on PatientsLikeMe. "I haven't found a replacement," Sharon said. Bilal agreed: "The people on PLM really know how it feels."

But neither of them could tolerate the fear of surveillance. Sharon said she just couldn't live with the uncertainty of "not knowing if every keystroke I'm making is going to some other company," she said. Bilal added, "I just feel that the trust was broken."

Sharon and Bilal's experience is a reminder that for all its technological pyrotechnics, the glory of the digital age has always been profoundly human. Technology allows us to find people who share our inner thoughts, to realize we're not alone. But technology also allows others to spy on us, causing us to pull back from digital intimacy.

When people ask me why I care about privacy, I always return to the simple thought that I want there to be safe, private spaces in the world for Sharon and Bilal, for myself, for my children, for everybody. I want there to be room in the digital world for letters sealed with hot wax. Must we always be writing postcards that can — and will — be read by anyone along the way?