Danielle Citron on The Fight for Privacy

Audio of this conversation is available via your favorite podcast service.

Danielle Citron is the inaugural Jefferson Scholars Foundation Schenck Distinguished Professor in Law at the University of Virginia School of Law, where she teaches and writes about information privacy, free expression and civil rights. She is the vice president of the Cyber Civil Rights Initiative, a nonprofit devoted to fighting for civil rights and liberties in the digital age, and in 2019 she was named a MacArthur Fellow for her work on cyberstalking and intimate privacy. Her latest book, The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age, published by W.W. Norton and Penguin Vintage UK, was released this month.

I had the chance to speak to Danielle, who also serves on the Tech Policy Press masthead, about the book and the arc of her career.

What follows is a lightly edited transcript of the discussion.

Justin Hendrix:

Can you tell the listeners just a little bit about the Cyber Civil Rights Initiative if they haven't heard of it? Of course, we've had Mary Anne Franks on this podcast in past, but for today's listener.

Danielle Citron:

Yes, of course. Dr. Franks is the president and one of our co-founders of the Cyber Civil Rights Initiative. We were founded in 2013 and the principal goal at the time was to combat what we were then and continue to call non-consensual pornography. So a particular type of intimate privacy violation. Our founder, Holly Jacobs, had been wrestling since 2009, 2010 with an X who had basically smeared the internet and her Google CV with nude images and videos of her engaged in sex acts all over the internet.

She was a graduate student at the time and some of those videos had her former last name, which was quite distinct with the suggestion that she was available for sex and that she was sleeping with her students. Mary Anne and I started talking to Holly in 2009, 2010, when she was first experiencing it and she said, "What do I do?"

We realized at the time, of course there wasn't a law that would ban non-consensual pornography in the state. That was true of nearly every state in the United States. There are only three states that banned into any form of intimate privacy violation that involved the non-disclosure of intimate images. So when Holly got ready to start talking publicly about her story, after she had changed her name to a quite generic name, one that she shared with a popular author so that she would get hidden, that is her former life would recede and she would take on this new quiet generic life.

She sort of declared bankruptcy on that old self. Unfortunately, she felt forced to, and her dean at her law at her school asked her to. We founded an organization to combat what we conceived of and understood as a civil rights violation. So I'd written an article called Cyber Civil Rights and we decided as a group, "Let's call the organization that." Because it wasn't just going to be about combating non-consensual pornography, it was going to be about the recognition that the exploitation of one's personal life online could be used to drive you offline. And so often who we would be driving offline and making disempowering, not only of their voices but their economic opportunities would be women and minorities.

So we started this organization to combat non-consensual intimate imagery and we've expanded our work. So we begin in 2013 and no doubt Dr. Franks wrote the first model statute and she posted it on our blog at Concurring Opinions. We wrote a law review article called Criminalizing Revenge Porn in 2014. We started the project of changing the law, first changing hearts and minds because everyone wanted to call it revenge pornography, which in some sense blamed the victim.

It was revenge and it was your fault. We felt, A, we had to pivot and change how we thought about it. At the time we wanted to talk about it as an intimate privacy violation, or surely I did, but we knew we had to frame it in a way that lawmakers would understand it. So we began calling it non-consensual pornography. We founded the organization together and to change the laws around the country. We've done a bang up job, I have to say.

Justin Hendrix:

How many states so far?

Danielle Citron:

48 states, the District of Columbia and two territories now ban the practice. So Mary Anne crafted a brilliantly narrowly designed law that as we started working state for state with lawmakers, our first experience was with the Maryland. Senator John Cardin and I, Mary Anne and I agreed that I would work with... Because I was there on the ground, I'd work with the Maryland ACLU. And together, we'd draft a law together that we would take Mary Anne's statute and then we would come together and compromise.

The Maryland ACLU agreed that if we succeeded, what came out of committee was the law that we... Our input. But we had drafted together that the ACLU, my partner would stand down and that I would go and testify on behalf of the bill at Annapolis. It comes out of committee broken. Well, too narrow and too broad because the folks unfortunately in the committee, they weren't lawyers. They didn't understand that we had worked so hard to craft a bill that would pass strict scrutiny, that we could stand behind that we felt really comfortable with, that we thought narrowly targeted invasions of intimate privacy that weren't newsworthy, but that was capacious enough to get at the practice.

So unfortunately, the bill passes. That's always the story. The bill passes. It's a misdemeanor. I don't testify on its behalf and Tony Holness, my partner testifies against it. So in a way we have this auspicious weird start, but what has been really rewarding is to see that the hard work that Dr. Franks has done with lawmakers state for state, legislature for legislature, testifying. We have seen bills that we feel really good about, particularly the Illinois statute. And every bill that we've worked on, the ones that have gone up to their state's highest courts and been constitutionally challenged, they've survived strict scrutiny and come out the other side.

And that's true of five states. So we're feeling good about the work that we've done, but we've expanded it. It's not just our organization fights for the civil rights and liberties of all. We want to create opportunity online and we fight against abuse that deters people from enjoying all those opportunities.

Justin Hendrix:

That story and that trajectory is a great way to anchor how you've got into these issues and where you're coming from. And also I think your influence over these discussions, particularly in the United States. 17 years working on privacy issues. This is your second book. First one, Hate Crimes in Cyberspace. Very renowned. And I'm sure you've enjoyed speaking opportunities on its back for many years. But now The Fight for Privacy: Protecting Dignity, Identity and Love in the Digital Age. In the intro, you take us back all the way to 1890 Samuel Warren, Louis Brandeis. Why do you start there?

Danielle Citron:

Right. Because the story of privacy in the United States, I could have began with in the 1770s when we start protecting postal privacy and we start thinking about banning eavesdropping, which was then thinking about practices of the 1780s and '90s. The eavesdropping in someone's house, listening under the eaves, we could have started there of course. But Warren and Brandeis write this magnificent article called The Right to Privacy that calls for a right that recognizes that each and every one of us has to draw boundaries around our domestic life.

I'm going to use the way they frame it, that the sacred precincts, I'm quoting them, around our domestic lives, should be ours, that what they say, "What's whispered in the closets shouldn't be proclaimed from the rooftops." And they were writing in response to the emergence of the Penny Press combined with the, called detective snap cameras, Kodak's first cheaper version of a camera that we can easily bring with us and take pictures on the streets of the everyday person.

And what they were responding to were concerns that the Penny Press was splashing stories about people's private lives, the details, I'm quoting them, of their sexual lives on the front pages in ways that were unwanted, that exposed the inviolate personality to inspection that no one desired, that not only were individuals harmed, they argued, but society was belittled. What mattered was perverted. And that what they wanted to do was carve out a tort, a privacy tort that would enable people to sue.

And they said, "Listen, this isn't so unusual." They said, "This tort grows out of a long history of the right to ones in violent personality, to be free from assault, to be free from battery, to protect your intellectual property." They argued that that was a part of the right to personality and that the recognition of this new tort wasn't something crazy, it was consistent with the way the common law moved and developed and that it was the next right move.

But the reason why I focus on Warren and Brandeis is because their story is a story of intimate privacy. It's a story about the importance of privacy around our bodies, our health, our homes, our innermost thoughts and feelings, their emotions, our closest relationships. And so at the heart of my book is a story about why intimate privacy is a foundational right, it's a moral right. In my view it ought to be understood as a human and civil. And it begins truly with the magnificent article of Warren and Brandeis. And the backstory.

So often we misunderstand why Warren and Brandeis write their article and historians have written about the Warren family. And Samuel Warren had a gay brother who was living with his partner named John Marshall, but not the John Marshall, and living in Oxford with other men. And his brother, Ned was a prolific letter writer. He shared his interests, his love of Greek art, often like nude art of nude men.

Sam Warren was worried for his brother's sake that his letters would be shared without permission, that his homosexuality would be disclosed at a time where not only it was stigmatized, but in England he lived in Oxford was criminalized. And of course, and let's not kid ourselves, he also had his own concerns for his own social identity. The Warren family name. They lived in Mount Vernon in Boston. It was quite fancy. They ran all the art. They were very involved in the art world and a distinguished law firm partner.

Of course his social esteem that his reputation also, he was concerned about his family's name and reputation. So the story of intimate privacy, I begin with Warren and Brandeis because the story that I'm telling is one of a foundational privacy value that has everything to do with the dignity of our personal and intimate and love lives. That is Ned Warren deserved intimate privacy. His brother so enlisted the law partner to write this famous law review article. And it began protection, legal protection and tort that I think we can draw from, that we can learn from.

Justin Hendrix:

Yet here we are 130 odd years later and you say that the denial of intimate privacy amounts to a massive legal, social and moral failing. You point to the entrenchment of the notion that the bodies of women and minorities are not your own. And you say we are still struggling for a common language for how we think about the freedoms that intimate privacy enables.

Danielle Citron:

Law can be... It can develop in ways that are quite stunted and certainly the promise of the inviolate personality, the right to privacy that Warren and Brandeis fought for, developed in fits and starts but was recognized over time, but sometimes gets co-opted by the own the forms. And so Prosser kind of reduced this in 1960, reduces the privacy towards the four quite narrow torts that meets some of our problems of the digital age, but not all of them.

The ways in which companies amass, exploit, sell, share and sell to data brokers, the most intimate information about when we have our periods and don't have our periods who we're sleeping with, whether we orgasm, what adult videos we watch, forgive me, but this is the kinds of things that we're sharing and browsing and reading. All of that intimate information, the privacy torts just don't capture.

And in the United States we treat intimate data and its collection and sale as a consumer protection matter, which basically means we can collect and share and sell, so long as we don't lie about it, so long as we have some privacy policy hidden in some bottom of some web page, which basically, as Woody Hartzog will say, are anti-privacy policies. That's the reason why we're failing. We're failing ourselves, that without comprehensive data protection, without treating intimate privacy as a civil, which means that we would treat it as if we're the caretakers of it, individuals, companies, governments, that we've almost let technology run amok, and we have not brought the discipline,

The lessons of Warren and Brandeis have been lost. We almost need to bring them and re-understand them and reimagine them. And so that's why it's not that we didn't have the tools to think about it, we actually have lots of the tools to think about intimate privacy and why it mattered for autonomy, identity, for self-respect, social respect, for love, for equality. We have the tools, but law hasn't developed in the way that it ought to and I lay out a blueprint for how it should be protected.

Justin Hendrix:

You maybe slightly apologized, or maybe there's a warning there about content related to pornography or sexual detail. But in the book, I mean you go into some detail about pornography as advertising gold, intimate data as advertising gold, the data brokers that even specialize in our intimate life. I was struck by some stories that were novel to me at least even of women changing their address as a result of the invasion of information snatchers and photographers particularly you point out in China. But there are other examples as well.

Danielle Citron:

For the book, I interviewed 60 people from the United States, the UL, Australia, Israel, India and Iceland. So I got a broad picture and I work really closely with the South Korean digital sex crime information commissioner as well as other government actors including the UK reform commission on intimate image abuse. And so the story is very much a global story.

Misogyny is a thread that has cultural resonance society for society. So the ways in which when you go to a public bathroom in South Korea, it used to be that you'd have to bring a kit with you so that you'd fill in the holes in the bathroom and you'd wear a mask. This was before the pandemic, so you'd hide your face because it was hard. There were really no public bathrooms where there weren't hidden cameras that then would stream to the internet to sites that have very uncreative names like hidden cam or hidden camera.

That story of South Korea and they called it molka, kind of a jokey term for hidden camera before they changed the way they understood and described it. That story is the same story of Singapore, the upskirt, down blouse phenomenon sextortion. The video voyeurism and non-consensual taping and posting to the internet. All different kinds of intimate privacy violations are bread and butter of Japan. The term dick pic is often the term that we use in Japanese for the subway.

It's so common to receive an unwanted dick pic on the subway. In Japan, we refer to the term subway as dick pic. "Where are you going, dick pic?" Which you mean is the subway. It is the same story of the United States. It is the same story of Iceland. It's the same story of India and Israel. So in talking to so many women. The folks that I interviewed were predominantly female. They were predominantly sexual and gender minorities. When I talked to men, they were often gay men.

I interviewed women of color. Do you know what I'm saying? From all these different parts of the world, and the stories that resonate... So may I, Justin, describe an experience because I think it's really helpful to describe an experience that honestly will stand in for so many that I think can help our listeners and the folks engaged in our world and tech policy press understand. If you don't mind, I'm going to just-

Justin Hendrix:

Please.

Danielle Citron:

Okay. So Joan, and that's not her real name, it's a name that she chose for herself for this story. Joan was a recent graduate of law school and she was practicing at a firm and traveled for work. She had stayed in a hotel, when she returned, she received an email from someone who the email sender's name was notabadguy2 too. And the email had a link to a video and it said, "Watch. I won't share this with anyone else if you share more nudes with me in 24 hours."

So she watches it and it's a video of her from the hotel showering and urinating, going to the restroom. It's posted on PornHub. Embedded in the video is her full name. So she calls her favorite professor at law school who's one of my favorite people who calls me. I called Joan. I say, "Joan, you're not sending him... This is what we call an attempt at sextortion." I mean, she knew she wasn't going to send him anything but she was so rattled.

I said, "Let's figure out what happens in 24 hours. Let's see what happens. I've been through this movie before. Sometimes they do follow up on threats and sometimes they don't. So let's see." So in 24 hours the person made good on the threats, had mined all of her LinkedIn contacts and sent the video from a spoofed account that looked like it came from Joan. Because her LinkedIn contacts had her law school colleagues and her law firm colleagues, her partners, her associates, people she was working with.

And in the video that looked like it came from her, it was something like, "Watch this. See me. This is my favorite state of being," or something. And the next day she had to go talk to her partner. The people she was working with at the firm to say, "I'm so sorry. That wasn't me." As she explained to me that the way she saw in her own eyes a vision of herself was that she knew they saw her naked, that she would never be Joan fully integrated, beautiful self.

She would always just be her breast and vagina. You know what I'm saying? She couldn't shake that feeling. And not only did the person send it to all of her LinkedIn contacts to the extent that the person could find email addresses, also then seated on countless adult sites. So an adult finder sites where the person said Joan's full name and that she had anonymous sex... She was interested in anonymous sex and had raped fantasies and come find her.

So she then was inundated with texts and emails. She asked PornHub to take the video down and every time this happened three times, they would take it down and then it would go back up. And notabadguy2 would write and say, "I see you, bitch. Send me more videos. They're going to keep coming up if you don't." And he kept putting them up. At some point, PornHub just didn't return her emails.

Now, most of the other sites, there were hundreds of other sites, she and her then fiance and I'll explain this sort of story of this lovely human being who is her partner tried to contact all of these sites. Most do not respond because Section 230 of the Decency Act means that they don't have to respond. She doesn't own the copyright in the photos and they're otherwise immune from responsibility.

So no one responds except one site hosted, she figures out in Russia and the person said, "I'll take down the videos if you send me more nudes." So what's the fallout? The fallout is Joan had said to me, "How do I ever move jobs? I live on a knife's edge. I could de-index it in Google searches of my name, but he keeps putting them up." We assume it's a he because it's more often a he, right? Just in our studies as we know from CCRI research.

So it's almost inescapable. And then she has the experience of so many victims, which is she completely changes how she looks. And either for a lot of victims it's gaining lots of weight or it's losing lots of weight, and she drastically lost weight. So she went to CrossFit every night after work at 10:00 PM, whatever time she was able to finish work and she would work out like a fiend.

She also had to friend walk her to and fro... Or her partner to and fro her apartment because she's so terrified of who would recognize her on the street. She also, in this resonates with so many victims' experiences. She got a tattoo. Her explanation to me was like, "And it was of her grandmother's name." She said, "This is my body now. It's not this person's."

It unnerved her. Her sense of safety was thrown. She had PTSD. Every time her phone would be wonky, she would text me with sheer terror to say he's back. And I would say, "Just hold on." You know what I mean? It dogged her. She Googled herself all the time. They put off their wedding for three years because she said, "I can't have a wedding with people having seen that video."

So she had this amazingly wonderful partner. But Joan's experience is so many people's experience. It speaks to us for all the ways that she shut down all our social media accounts. She was totally silenced like bye-bye LinkedIn, bye-bye Facebook where she hung out with all of her high school friends. She cut off all contact.

Justin Hendrix:

There's another example in the book you give of Peter Strzok and Lisa Page who of course were kind of, I guess characters that emerge onto the stage in the political discourse around the investigation into Russian interference and the 2016 election. And this is kind of a window into, I don't know, the inadequacy of any redress. Later in the book you bring up, of course, the example of Pamela Anderson Lee, Bret Michaels. There are other examples sort of sprinkled in of similar types of circumstances and individuals who've had to deal with these types of things.

Danielle Citron:

What I think is really important about Pete Strzok and Lisa Page's experiences that when you face privacy inventions at the hands of the government, the Department of Justice calling in reporters in the thick of the night after 8:00 PM, Isgur Flores, the DOJ spokesperson to say, "Come, look at text messages sent between two FBI..." Really the best counterintelligence official in the country, Pete Strzok and Lisa Page counsel to the GC of the FBI, Andy McCabe and say, "Come, look at their text messages. They're inappropriate. They were having an affair." And these text messages, these 375 text messages, which you can only look at, you can't take with you, you can't replicate, show that they were having an affair and that they disparaged the president.

The next day they were... It was really within hours slashed over every page. And the president seized on those stories and then defined Page and Strzok as traitorous FBI lovers. They were traitors. They were tweet after tweet after tweet. Their private text messages, which should have only... They were meant for each other. They're really about work, but they also were about their family and their lives, and some about their relationship and their political feelings.

The FBI has a policy is you can have political views and you could say them publicly and privately. They worked on both the Clinton email investigation as well as Crossfire Hurricane, which was the investigation into Trump's campaigns, ties to Russia. And so that's why Trump and the Department of Justice make their love relationship and their text messages fodder for the internet, and ultimately change the arc of both of their lives.

Lisa can no longer be an FBI. She resigned. She can no longer work for the government, which was her love. She was a government lawyer through and through. Pete Strzok was the country's by all accounts best counterintelligence agent of the country. And stop, he's fired. Clearly it all political nonsense.

So the destruction at the hands of private actors, it's very hard to shake that imprimatur. If you search either one of them now, it is pages and pages of conversations of them as traitorous to the government. And still to this day, if you listen to Fox News, Pete Strzok is constantly discussed. Same with Lisa Page. So I just should note for readers that I am the pro bono expert for both Page and Strzok in their Privacy Act lawsuit against the Department of Justice.

So I say them the book, I just want to make clear that... And it's true for so many of the victims that I talk to in this book that I'm on their side. Their experience is one that I see their harm so vividly. So just want to make clear that I am their pro bono expert in their case. Two separate cases, Privacy Act cases against Department of Justice that violated by my life, the Privacy Act and I'm an expert on harm. But the Privacy Act commits the government to keeping our files confidential.

With some narrow exceptions, including routine use. But it ain't no routine use to tell reporters at night and disclose text messages. You needed to get their permission. So the kinds of abuses that we see individuals engage in like Joan and the hotel employee, and we see it with government actors. When it's a government actor like Trump and the Department of Justice, that imprimatur is unshakeable, right? Rana Ayyub experienced it with the Modi government with deep fake sex video that spread all over the internet. And as you said, Pamela Anderson Lee and Bret Michaels, their sex video was exploited by a manager and then monetized by a corporate actor. So companies, governments, individuals are privacy violators and law lets them get away with a lot of it.

Justin Hendrix:

So let's talk about the law's inadequacy. You've already focused in on Section 230 of the Communications Decency Act. You've talked about in the book of course how the sort of judiciary's interpretation of 230 doesn't square with perhaps the original intent of the lawmakers that drafted it and passed it. And in the present day, I suppose after your book had already gone to print, we now see cases before the Supreme Court that may have some bearing on this question. You say we're at a pivotal moment. Where are we at the moment on the law?

Danielle Citron:

So let's take at the content layer, the sites that traffic and abuse. They're like 9,500 websites devoted to intimate image abuse. And let's just take any ordinary website whether it's Facebook, Twitter, et cetera. So Section 230 affords them... And the title of the relevant part of the statute that we're going to talk about, it says Good Samaritan blocking and filtering of offensive content.

So the idea was behind Cox and Wyden's inspiration and they wanted to ensure that interactive computer services, the term they used would be able to moderate content because they knew federal agencies couldn't remotely keep up with what was going on online especially the early years of message boards, Prodigy, AOL. They were like, "We want to provide an incentive for them to be able to moderate either leave up or take down content." But to endeavor to do that and to give them an ability, a legal shield so they could take down offensive content. Those are the words of the statute, not mine.

And the laws you said, Justin, where is the law now? The law has been interpreted so broadly so that even sites that solicit, encourage and keep up clear intimate privacy violations that profit from it, they also enjoy the immunity from responsibility. So sites like texxxan.com, so with triple X in it, thedirty.com. Sites that traffic in gossip as well as intimate privacy violations, they get to enjoy the immunity as well.

So we're at this moment where we've seen some courts try to cabin that very over broad interpretation of Section 230, which also at the time immunized Backpage, even though Backpage was making it... They were structuring the architecture of the site so that cops would have a very difficult time finding that minors are being trafficked like making invisible words, child, teen, things like that. Even if their architecture was so changed by the site, they were also immune from responsibility for child sex trafficking.

So we had some changes in the law in FOSTA and SESTA. But as it stands, it's really still broadly interpreted. Courts have tried to ratchet it back a little bit. There's like some findings about products liability claims that are now being permitted to proceed in a case involving Snapchat. And there's also this smaller split in the circuits about whether algorithmic moderation and recommendation systems that make money, whether they also enjoy that is the act of recommending content whether that is going to enjoy the legal shield.

As you said, things are changing. The Supreme Court since the book went to press granted cert on Gonzalez v. Google, which it's a twin case. It's a case against Twitter as well as YouTube for promoting terrorist videos by families of people who are killed in terrorist attacks in Israel. So it's two issues. One, Section 231 involves the anti-Terrorism act, which has civil penalties for facilitating and providing aid, including information about promoting terrorist organizations.

Okay. So I'm not in love with this case. I think why take this one? Believe it or not, Justice Thomas was so right in his dissent in the Malwarebytes case. He dissents from a denial of cert where he says Section 230C1 has been interpreted in such an overbroad fashion as to retreat from its original purpose. And I'm with him. But this is not the case.

What I worry is that if indeed, I'm not sure they're going to decide it on 230 grounds, maybe it's just this terror... Who knows how this is going to shake out. But if indeed the court finds that any time we algorithmically amplify content for profit in some manner related to profit, that that is then we're taking out Section 230 immunity.

I think that just means 230 is gone because the entire internet is algorithmically moderated. My spell check is. Right? Search engines, everything is. So I don't know how that doesn't mean we disassemble 230 and I am not one of those people who wants to get rid of it. I want it, keep it, but exclude bad actors like sites that encourage solicit, or keep up intimate privacy violations. They're bad Samaritans. They're out.

I think sites when faced with intimate privacy violations have a duty of care and Congress can prescribe that duty of care. I have a new article called How to Fix Section 230 that goes ahead and tells Congress how to do it. I don't want to get rid of 230. It's given us a lot of great things. But I also think it needs to go back to its original purpose of immunizing the Good Samaritan. And particularly for problems we know about like intimate privacy violations that are costly to civil rights and civil liberties.

Justin Hendrix:

230 is not the only opportunity to address these things. You have a chapter on the removal of various other legal barriers and other forms of redress. Perhaps we could take a quick tour of those.

Danielle Citron:

I'd love that because when you ask about 230, 230 is I think an important example of when we shift to thinking about intimate privacy as a civil right, what that means is that... Let me just... Civil rights are legal rights that each and every one of us enjoys because they're essential for human flourishing and civic engagement and citizenship. The modern civil rights laws crucially include protections against discrimination.

But the earliest understanding of civil rights was a right that we all enjoy to work for education. We all enjoy a right to intimate privacy. It gives us two things by viewing it as a civil right practical and expressive. So the practical piece is when you call something a civil right, it means you can't violate it or trade it away without a good reason. Profits ain't good enough, right? Because it's fun, individuals. It ain't good enough. You need a really good reason.

It also means when you are the steward of intimate data, when you collect intimate data, whether it's a site operator, an individual, a business, a government, when you consider something a civil right, it means you're the caretaker of that right, that is you have responsibilities as the guardians of those rights.

So for companies, if you're the guardian of intimate data that means sometimes you can't collect it. If you don't necessarily need it strictly speaking for your product or service, you don't collect it. A civil right to intimate privacy for businesses would also mean you've got duties of loyalty. And this I rely on Woody Hartzog and Neil Richards work. We have duties of care and duties of non-discrimination. And this is without question and stop, you can't sell it. You cannot sell intimate privacy. I don't care.

You want to sell your intimate data, go do it until you couldn't go do it to a first party. But that party cannot sell it to a third party. I don't care what you've so indicated. There's practical value in making the shift to civil rights, that is implications for government collecting our intimate data, for companies and for individuals. But there's also a really important expressive payoff because law is our teacher. It's a blunt instrument, but it is our guide. It can become and should become the law within us.

And once that happens, it says to victims, "You matter that your intimate privacy is a paramount importance. We're not going to abandon you." Law enforcement isn't going to say, "Turn your computer off, boys will be boys." Right? They'll know it's a civil right that is sacred and they have sacred duties of care and of guardianship. It says to companies, "You can't hand over fist collect intimate data. You have responsibilities. You're the stewards." And it tells them when they design their tools and services that the beta test mindset is out.

We have this ethos in Silicon Valley, which is build it, we'll deal with harm later. We just build it. It's a builder's mentality and we don't care what happens. Now, that's not how we really build things in the real world. But Silicon Valley seems to think that's how we do it. And that would end. That would have to end. The lesson would be, you have to realize that what you're doing is building something that's ultra hazardous. Really, really, really valuable but really dangerous. You are the stewards of people's intimate data. So it would flip how we view all of this.

Justin Hendrix:

You say you want these companies to become data guardians, in fact. I was struck by the distinction you make between the original cyber libertarian ideologies of Silicon Valley versus where we've ended up today, which is of course very, very different place. Even though some of the individuals that run these companies invest in these companies, continue to somehow believe that they're still, I don't know, pursuing those utopian goals while at the same time they've obviously made themselves very, very wealthy doing some very different sorts of things.

Danielle Citron:

What's interesting though is that it's privacy for me but not for thee. Right? So went to Zuckerberg's house for dinner. He had a series of dinners and he would have the head of safety who I work really closely with, Monika Bickert and a few other academics. I think he had a few of these. But I sat next to him around a small table. When you get to his house, you can't see it. The car drops you off. Or this is his former house, which I think he's recently sold and now he lives somewhere else. But in his house that he lived in 2000, I guess this was '16 or '17 when I went, it was like just a hedge. So you didn't know it was a house. It was this huge hedge and you get dropped off.

I was standing there with Sarah Roberts. We looked at each other and we were like, "Where's the house?" And a hedge opens. It was actually quite a lovely, normal house. It wasn't a mansion or anything, God bless. It's a beautiful lovely house. But he had bought the property around the houses next to him so that the house is completely obscure. You don't know it's a house. It's like a forest.

So he's happy to claim privacy for himself, but not for other people. So actually just find the whole thing so twisted like buying an island in Hawaii, the idea that these folks, they don't allow... I mean this is by stories you read and Wired. By all accounts, so many Facebook employees don't allow their own kids be anywhere near screens because... I forgot the name of the fellow who shared this with us. But you know that because it's so addictive and because it can be so confidence undermining.

I know because I've got two 20-year-old women in my family. We talk long and hard before they got on Facebook and they waited until they were 14 because I said it's a big responsibility and you got to feel okay about yourself because there's a whole lot of ways in which you feel crappy like seeing other people being so beautiful and you're just a normal and perfect person.

So it's amazing though they all carve out privacy for themselves, these ultra wealthy folks, but will exploit us. As Shoshana Zuboff would say we are the extractive raw material. Her wonderful book on surveillance capitalism. So I feel like, Justin, when I wrote this book, I built it on the shoulders of lots of amazing scholars and that's Anita Allen and Shoshana Zuboff and Julie Cohen, and Woody Hartzog and Neil Richards, and Ari Waldman.

I could go on and on. But anytime one writes, we write together in the privacy field. We are a shared effort. So I always want to shout out Michelle Goodwin. Think about all the people. They are folks who have really taught me so much. Cara Bridges, Simone Brown, that I tried to integrate... You know what I'm saying? Like capture their insights. So important. And of course Dr. Mary Anne Franks, who's like my partner. As we joke, we're best friends or we're partners in deterring crime.

Justin Hendrix:

Well, let me also... Thinking about Dr. Franks and just one of the thing I should ask you about on the legal landscape, which is the First Amendment, which of course is incredibly important in this book and something you come back to again and again around how various interventions perhaps can survive scrutiny as you say.

Danielle Citron:

Yes. Okay. As we think about the challenge of regulating intimate privacy violations vis-a-vis individuals. So often the intrusions on seclusion. You don't have a right to tape me in my bathroom. It's often a less concerning First Amendment problem. But where the difficulties of course are where the intersection between intimate privacy and disclosure, public disclosure of private facts.

And if you write these laws narrowly enough where what we're doing is criminalizing or providing civil penalties to information that's shared in confidence or in circumstances where you deserve a right to privacy, whether it's sex videos, social security numbers, biometric information, the Privacy Act has criminal penalties, HIPAA has criminal penalties. What makes your nude body so different?

ACLU makes this argument that we shouldn't have facial recognition software, that we shouldn't record people's faces in public and I'm totally with them. So they argue my vagina should be. A photo of me taken naked is the most absurd argument ever. In the Cyber Civil Rights Initiative, we've defended and filed amicus briefs in defense of laws that criminalize the practice because we wrote them. Mary Anne helped write them so narrowly and so astutely.

They've been upheld. They've gone through the crucible of strict scrutiny and survived. So yes, we are limited in what we can do. If you think about the values that underlie free expression, autonomy, self-governance, figuring out who we are, the world we want to live in, the kind of counter speech ideas. We meet falsehoods with truths and let it all bubble to the top, but at least give us that opportunity to blow off steam. All the different sort of reasons why we care about free speech.

There's really no response to a nude photo. What am I going to say? That's not my nude body? And in fact that's my coerced sexual expression. And to think about the corporate recommendations that I make right around less collection, no sale. We can adopt those regulations narrow enough so that an anti-discrimination commitments, so long as we do it with care, we absolutely can do it consistently with First Amendment case law because it frees us to speak.

I have a piece coming out in the Journal of Free Speech Law called Intimate Privacy is a Precondition to Free Speech and that's just what it is. They go hand in hand, intimate privacy and free speech. I can't sexually express myself unless I think people are going to keep my images confidential or my communications and texts confidential. And that includes the companies that are faring and storing my messages.

Justin Hendrix:

You are in some ways pushing for a cultural change here. It's not just legal, it's not just the practices of companies, it's not just perhaps fiddling with this law or that, but you want to create a different kind of context.

I was struck by the example you gave of Congressman Matt Gaetz showing nude photos on the floor of the house in Congress in the lack of pushback from his colleagues that speaks to what norms are even in what many Americans, I suppose would regard as a hollowed place. How do we get from here to there? There's, I don't know, a lot sort of... You say we've made a lot of progress in the last decade, but how far do we have to go?

Danielle Citron:

No, it's true. We've made some progress. We've made some progress in South Korea. We've made some progress thanks to AG Harris when she was the attorney general in California. Made some progress in the UK. We've seen progress. But our problem fundamentally are cultural and social attitudes, which is that my vagina is not mine. That is the bodies of women and sexual, gender minorities and non-whites are stigmatized and not their own. And that has to change. It changes with each and every one of us.

For Representative Gaetz... that wonderful Alexandra Petri piece when she talked about it in the Washington Post said, "Why didn't people say, what are you doing, you vile beast?" That's first of all someone young because we know he's slept with young women, young meaning teenage women. It's been alleged. But let's say it's people of age. What are you doing sharing nude photos of women that you've slept with? What are you five years old? You have no self-discipline or care, or humanity? And people didn't do that.

So we need to teach old, young, everybody about respect for one another. We need to bring humanity into the calculus. We need to talk about why intimate privacy is so important and cherished, why we shouldn't shame other people for sport. There's some things about privacy that aren't necessarily shared culturally, but the themes of intimate privacy are pretty resonant around the globe. And also, it's violation, right? Because of gender norms and invidious attitudes about the other.

So we have a long way to go. In 2014, I thought, "Oh, we have really changing stuff." We have this task force with AG Harris. We were changing the way companies like Google de-index, made a decision in Bing and to de-index intimate images in searches of people's names. That was big. It's like here we were.

Then 2015 and the Trump campaign happens and hate is normalized on platforms. And Russia, disinformation is the game of 2007 and '08. The disinformation vis-a-vis Estonia and Georgia, and shutting down websites. It's not like a new thing, disinformation. Intimate kompromat is how Putin is in power. He released a sex tape, which was fake of the prosecutor who's going after Yeltsin's family for fraud. And so Yeltsin was like, "Okay, you're my successor."

So intimate kompromat and intimate privacy violations are nothing new, but we've got to... I thought we were making all this progress and then all of a sudden hate speech and hateful bigotry becomes really normalized. So normalized that in my town now, and I wasn't here yet, but in 2017, August, I think it's '17 or '15, the streets of Charlottesville, three blocks from my house were "Jews will not replace us."

And people who wear no masks, no hoods, this is like no hiding. White shirts, khakis full out like I'm here and marching the streets of Charlottesville with... Whatever. I forgot what they're called, the tiki torches. Proud. So I guess we have a long way to go. And what's really fascinating is my first book was about cyberstalking. I watch the incel and men's rights movement evolve. As I'm studying and writing about for cyber civil rights, I wrote it in 2008 and writing about ways in which women and girls, and minorities being targeted online by these weird niche websites like 4Chan, Auto Admit.

Those folks become a movement, the men's rights movement and incels. They then become vast. It's the same actors. The wacky thing is that the actors who were tormenting, Kathy Sierra, this is my first book, computer programmer, this guy, Weev, Andrew Auernheimer, he's goes after this woman writing about how programming is creative. Can you imagine like, "How dare she?" Like spreading her social security number and defaming her and saying that she's a prostitute and death and rape threats.

That dude was now the head of Daily Stormer with Andrew Anglin. Do you know what I'm saying? So the actors that I'm documenting of cyber mobs in 2009, they're kids, but they're in their 20s, early 20s. They're tormenting people online and they say for fun because it's for the lulls, right? But they're tormenting people and they're doing it in bigoted ways. They grow up and become neo-Nazis and part of the far right in a political movement that leads to one's sex.

So the thread lines are stunningly strong and stronger than they were when I first started writing about them. So I feel like last night I gave a talk at UVA Law School, my students, and they were like, I was like, "Yeah, I'm going to end with some dystopia sadly." Any time I give a talk, I'm going to be like, "All right, I'm going to depress us for a little bit. I'll try to inspire us, but we got a lot of work." You're right Justin? We have a lot of work to do.

Justin Hendrix:

Well, if were to get there, I assume that books like yours will be a blueprint for the type of cultural change that we've got to have, the type of legal change that we've got to have. Danielle, thank you so much for speaking to me about the book, and I'd encourage everybody out to go out and take a read of it. Your local book seller or whatever online source that you may use to get your eBooks. What's the next book? Are you already working on it or are you...

Danielle Citron:

Yeah. Oh my golly, not yet. But I have long been thinking about sexual slander and the ways that women in particular as a national security problem that lies in disinformation, in particular women in minorities are unfortunately another kind of huge area to combat. So if I have a next book, maybe that's it. My agents asked me and I'm like, "I'm not sure." But I tend to write a lot of articles and then if I can't stop writing about something, that's my book. You know what I mean? I love writing law review articles. So if I have four or five articles, I keep going and keep expanding. That's when I know I have my next book.

Justin Hendrix:

Well, I hope the publication of the book won't be the only reason we have a chance to talk again.

Danielle Citron:

Oh, same.

Justin Hendrix:

Thank you so much.

Danielle Citron:

Thank you so much for having me and for all you do for Tech Policy Press. It's awesome.