When Sara Cable was a Harvard undergraduate, she took Harvard Law School Professor Morton Horwitz’s class about the public-private distinction in the law. Now the director of data privacy and security for Massachusetts Attorney General Maura Healey, Cable says figuring out where that line falls is something she thinks about every single day.
Cable returned to campus recently to talk about those issues again. She represented Healey’s office at the AGTech Forum symposium on cybersecurity and privacy, hosted by Harvard’s Berkman Klein Center for Internet & Society. While there, she thought anew about Horwitz’s class. “Who would have thought I’d be dealing with those issues?” she says. “There was something delightfully circular about that.”
Cable was among officials from 23 offices of state attorneys general who met at HLS on February 28 and March 1 to discuss technology-driven challenges to privacy and data security that vex state regulators and threaten consumers. Twice a year, since fall 2017, the AGTech Forum series has brought together representatives from state AG offices across the country to network and learn from academics and other experts about the privacy and other concerns associated with emerging technologies. The goal is to make state attorneys general more effective in advocating for the public interest.
“That kind of education is incredibly useful,” says Cable. In some cases, the only other way for attorneys general to get similar insight about new technology is “using our investigative tools to ask the company directly,” says Cable. That adversarial process, she adds, can color the information the states get.
The AGTech Forum is the brainchild of Lecturer on Law Jim Tierney, who served as Maine’s attorney general from 1980 to 1990 and directs the Attorney General Clinic at HLS. Outside certain limited sectors, state law—not federal law—tends to govern privacy in the United States. Yet state attorneys general do not always have cutting-edge knowledge about technology’s effects on privacy, Tierney says.
“Attorneys general did not have access to the very top experts, who could see not only the tech issues now, but the tech issues of the future,” says Tierney, who often consults with attorneys general as director of the educational website StateAG.org. “They’ve had to make tough prosecutorial decisions about tech-related matters, [without] access to those experts.”
So, Tierney pitched Berkman Klein Center Directors and Professors Chris Bavitz and Jonathan Zittrain ’95 on the idea of hosting tech conferences for attorneys general. The AGTech Forum fits neatly with Berkman Klein’s long-term goals, says Bavitz, who is managing director of HLS’s Cyberlaw Clinic. “We at Berkman like doing research but also having impact,” says Bavitz. “The idea of talking to people who are on the front lines of doing the work seemed very appealing.”
So far, 36 state attorneys general have sent lawyers to at least one of the four forums, thanks in part to grants and foundation support that help to cover travel. The gatherings give state attorneys a place to learn and connect without being lobbied by the very companies that could become enforcement targets. “We have really tried our best to make sure this is not tainted by commercial interests on any side,” says Bavitz.
During this winter’s AGTech Forum, scholars and security researchers with expertise in the changing landscape of state privacy law participated in panel discussions on disinformation and data-sharing on digital platforms, emerging privacy-invasive technologies such as facial recognition algorithms and the Internet of Things, and legal approaches to defining privacy harms.
The panel discussion about quantifying harms of data breaches proved especially interesting to Christopher Edwards ’98, counsel to the New Jersey attorney general. The sale of personal information on the “dark web” can lead to identity theft, extortion, and other harms, but proving that a specific breach caused a person a financial loss can be difficult. “With the cutting-edge technology, you have to figure out where the harm is,” says Edwards, “and because the technology’s always morphing, it’s hard to get at the harm.”
Bavitz says the panel discussed building cases around unauthorized data extraction by anticipating future harm, as toxic torts do. “If a polluter dumps a bunch of stuff, or a smokestack is shooting off pollutants into the atmosphere,” says Bavitz, “courts have come up with ways in torts cases to compensate people.”
Each AGTech Forum has been punctuated by an off-campus dinner, where state attorneys have the chance to network with each other and compare. “We all work together on various cases of national import,” Cable says. “We’re almost in daily contact with each other. But the ability to collegially connect and share insights more informally is invaluable.”
So far, two AGTech Forum convenings have focused on privacy and cybersecurity concerns. Two others looked at emerging legal issues around artificial intelligence, algorithms, and machine learning — major interests of Berkman Klein. The Center’s partnership with the MIT Media Lab to examine the Ethics and Governance of Artificial Intelligence, explores issues around self-driving cars, misinformation on social media, and the use of algorithms in criminal justice. Sessions at the AI-oriented events focused AG staff on the fact that algorithms, far from being objective, have the potential to encode bias and discrimination. “The prejudices of the person programming the computer [are] going to come out the other end,” says Cable. “The computer is just going to do what the human asks it to do.”
For Edwards, who is African-American and grew up in the Bronx, the AI forum reminded him of how technology gaps and education gaps can combine to leave parts of society behind. “I learn all this information on how artificial intelligence can be used for good or ill,” Edwards says, “but potential victims of someone using artificial intelligence to gather information on them, they don’t even know about that.”
Cable says the AI forum has planted seeds in her mind for future action. “Algorithmic discrimination,” she says, “is an issue a state AG can do something about.”
