Regulation interacts with intellectual-property exclusivity in socially problematic ways by encouraging secrecy at the expense of innovation, efficiency, and competition. In the extensive scholarship on intellectual property and innovation, the role of regulation has gone largely unexplored. This Article is the first to theorize how regulation empowers intellectual property generally, to explain why this strengthening is problematic for trade secrecy but not for patents, and to offer the solution of regulator-enforced disclosure.
When a regulator defines a product or a process, it becomes much harder to invent around that product or process. Any associated intellectual-property exclusivity thus gets much more powerful. When the FDA approves a new drug, patents covering that chemical become much costlier to invent around because similar but non-identical chemicals lack the tremendous benefit of FDA approval. This patent/regulation interaction, however, can be noted and explicitly addressed by policy, as in the case of the Hatch-Waxman Act, which facilitates generic drug entry once drug patents expire. Regulation strengthens trade secrecy too, but more problematically. Biologics, which comprise the most innovative and expensive drugs today, are the path-dependent result of complex, secret manufacturing processes. Meeting the FDA’s definition of a biologic requires reverse-engineering its complex, secret process, making trade secrecy much more valuable and stifling competition and innovation. In such situations, regulation can push firms to choose secrecy over patents in precisely those socially important industries, like drugs, medical devices, and pesticides, where disclosure is most important.
Where regulation creates problems, however, it also offers the hope of a solution. Regulators are in a strong position to require disclosure directly: regulated firms have strong incentives for candor, regulators have the necessary expertise, and regulatory incentives can offset the costs of disclosure. More effective regulator-mediated disclosure would increase oversight and enable cumulative innovation, while retaining incentives for invention in regulated industries.'Why Privacy and Accountability Trump Security' by Adam D. Moore comments
In this paper I will argue that establishing and maintaining practices promoting privacy and accountability will typically trump security concerns. While it is true that in specific instances security may outweigh privacy, this is not true once we glance upward to the level of practices. Along the way I will present and critique four prominent pro-security arguments entitled: “Just Trust Us,” “Nothing to Hide,” “the Consent Argument,” and “Security Trumps.”Moore argues
Imagine you live in a world where each individual is responsible for his or her own security. This world is full of risks, from thieves, thugs, and extortionists to grifters, Ponzi-scheme artists, and hustlers. Also, imagine that you are not very good at providing security for yourself and decide to outsource this important task. Surveying the possibilities, you find that by moving to different areas, there are several distinct options.
In the Thomas Hobbes security zone, individuals are monitored around the clock without regard to privacy, liberty, or property. Total transparency and access yield nearly complete security. Using facial-recognition technology, virtual frisking, big data and predictive analytics, and video recorders, along with a host of other known and secret technologies, each individual is monitored and recorded around the clock. The chief security officer, known as Mr. Leviathan, is virtually unaccountable for how he conducts his business and is not subject to the sorts of intrusions common to typical Thomas Hobbes policy holders. Moreover, Mr. Leviathan is more or less free to pick fights with other security providers in other zones, upgrade surveillance equipment, and militarize his security forces at the expense of policy holders.
John Locke Inc., the primary competitor to Thomas Hobbes, falls at the other extreme. In the John Locke zone, security is promoted by protecting individual rights to life, liberty, property, and privacy. With a known and written law, recourse to impartial judges, and robust accountability provisions, basic rights are set aside only in rare cases. When rights are set aside, automatic and public review processes inform everyone of the reasons for some action or policy. Moreover, security officers are not free to start fights with other security agencies and are subject to the same sorts of rights and penalties as other John Locke policy holders.
While fictional, there are some interesting lessons to be learned by engaging in this sort of thought experiment. If you had to pick between these security agencies, which one would you choose and why? Arguably, if these were the only two choices, the obvious winner is the John Locke agency. There are lots of reasons. The most compelling, in my view, is that the Thomas Hobbes agency itself becomes a security threat. Without robust accountability, it would be hard to maintain that giving this sort of power to some company or government promotes, rather than undermines, individual security. Criminals, terrorists, or grifters are nowhere near as dangerous as Thomas Hobbes style governments. There are too many examples for us to deny Lord Acton’s dictum that “power tends to corrupt, and absolute power corrupts absolutely.” If information control yields power and total information awareness radically expands that power, then we have good reason to pause before trading privacy for security.
Also note how security is tied to accountability and to the overall legitimate functions of an agency or state. Simply put, the more a state does for us, the more power it will likely need to complete its tasks. Standing against this increase in power will be the accountability provisions necessary to protect security. Giving a security provider a big gun with no or few accountability protections will debase security.
But this is exactly what we have been doing in the United States for decades. Consider the National Security Agency’s current bulk collection of data under PRISM, which would have remained secret had it not been for the whistleblowing of Edward Snowden. Or consider abandoned programs such as the Terrorist Information and Prevention System (TIPS) and Total Information Awareness (TIA), which were attempts by the US government to circumvent Fourth Amendment privacy protections. Proposed new legislation, such as the Cyber Information Sharing and Protection Act (CISPA), would expand both surveillance authority and secrecy for our government agencies.
In response to these concerns, security officials typically offer one of four different arguments. According to the “just trust us” argument, we should let those in power decide the correct balance between privacy, accountability, and security. A second view minimizes privacy interests by calling into doubt the activities privacy may shield. This view, called “nothing to hide,” maintains that individuals should not worry about being monitored. Only those who are engaged in immoral and illegal activity should worry about government surveillance. A third strand, similar to the “nothing to hide” argument, is the view that “security trumps.” This latter account holds that security interests are, by their nature, weightier than privacy claims. Security is about life, limb, and property, and these interests will nearly always trump privacy or accountability concerns. Ken Himma, in this volume, defends a “security trumps” position. The final argument centers on consent. Many individuals voluntarily offer information, even private information, on social media sites, email, web pages, blogs, smartphones, and the like. By engaging in these activities, we are consenting that others may watch. The “consent” argument maintains that citizens have agreed to be monitored.
After presenting each of these arguments in more detail, an analysis and critique will be offered. While perhaps compelling at first glance, each of these arguments has serious flaws and should be rejected. The reason privacy and accountability trump security is because without the appropriate balance between these three important values, there can be no robust security.'Information Fiduciaries and the First Amendment', a draft UC Davis Law Journal article by Jack Balkin, develops the theory of information fiduciaries.
Balkin explains
This article introduces the concept of an information fiduciary to explain how many different kinds of privacy protections can be consistent with the First Amendment.
An information fiduciary is someone who, because of their relationship with another, assumes special duties with respect to the information they obtain in the course of the relationship. Traditional information fiduciaries include professionals with special skills like doctors and lawyers. Clients cannot easily observe and monitor what professionals do and are dependent on professional expertise; moreover, professionals expect and encourage clients to have confidence in them. Lacking knowledge, skill, and the ability to monitor, clients must trust that these fiduciaries will not abuse their position and misuse the information they obtain from their clients.
For similar reasons, many online service providers and cloud companies should be considered as information fiduciaries with respect to their customers, clients, and end users. They keep their operations secret and they encourage end-users to trust them; moreover, end-users do not understand and cannot monitor how their information will be used in the future.
The duties of this new class of digital information fiduciaries may differ from and be more limited than those of traditional fiduciaries. Permissible regulations depend on the nature of their businesses and the kinds of trust and confidence they encourage from their end-users and clients. Governments may impose privacy regulations to enforce these fiduciary obligations without violating the First Amendment.
Similar reasoning explains how courts should modify the third-party doctrine in Fourth Amendment law. People should have a reasonable expectation that those who owe them fiduciary duties of trust and confidence will not betray them to third-parties, including the government. If new digital online service providers are information fiduciaries, end-users should have reasonable expectations of privacy in at least some of the information shared with them. Hence governments must show probable cause and/or obtain a warrant to access this information. The same reasons that governments may protect personal information under the First Amendment also provide justifications for a reasonable expectation of privacy under the Fourth Amendment.
