On 28 March 2017, the House of Representatives took another step toward ending regulations set by outgoing President Barack Obama in late 2016 that prevented Internet service providers like Verizon and Comcast from collecting and selling browsing histories of customers without their consent.
The resolution (the summary of which can be read here), which was approved by Republicans in the House and Senate on near-party line votes, is expected to be signed into law by President Donald Trump when it reaches his desk. The resolution and its likelihood of becoming law has generated anger among those who see it as a privacy violation, and at least two activists, Cards Against Humanity creator Max Temkin and engineer and privacy advocate Adam McElhaney, have vowed to retaliate by purchasing and revealing the browser histories of the lawmakers and industry executives who voted or pushed for the regulation rollback:
— Max Temkin (@MaxTemkin) March 27, 2017
McElhaney responded by launching a GoFundMe page (which as of 30 March 2017 has raised more than $177,000) and putting up a web site featuring a search tool that, if operational, would allow users to search the names of members of Congress who voted for the rollback or chairs of companies like Comcast and, presumably, see their Internet surfing histories.
McElhaney told us by e-mail:
My penultimate goal, my driving force, is to get that law back into play. I think a lot of people do not realize this isn't about retaliation. It's about exposure to our civil liberties being nick once again without our knowledge and without our consent. This is about showing our legislators that this is the what the future holds. It may not be right now that I can just go online and buy someone's history. But that future is coming. That is what I am trying to get people to see and understand.
"Supernatural" star Misha Collins jumped in on the fray, launching his own GoFundMe to buy lawmakers' browser histories, writing:
Since Congress has made our privacy a commodity, let's band together to buy THEIR privacy.
This GoFundMe will pay to purchase the data of Donald Trump and every Congressperson who voted for SJR34, and to make it publicly available.
But Temkin has taken a more cautious approach by pledging to match $10,000 in donations to the Electronic Frontier Foundation (EFF), a group that advocates for civil liberties in the digital sphere. He also advised that readers install EFF tools like HTTPS Everywhere and Privacy Badger, and noted that the process of trying to purchase and make public legislators' browsing histories will not be either easy or neat. Temkin wrote on Reddit:
1. First off - this bill hasn't been signed, the data doesn't exist, and nobody knows what they're talking about. We don't know if there will be any data to buy, how it will work, or what will be available. This means you should be very skeptical of any GoFundMe projects to buy this data. They are making promises they can't possibly keep.If and when any data becomes available, myself and Cards Against Humanity will do whatever we can do acquire it and publish it. We have a long track record of activism and spending around government transparency issues. We've donated over a million dollars to the Sunlight Foundation and the EFF.
2. This may take a long time. We may have to file FOIA requests. We may have to buy browsing data for Congressional office building ZIP codes and then p-hack our way to statistical significance in an attempt to fish spurious correlations out of unreliable datasets, but we've done it before.
3. The amount of attention this is getting is honestly starting to scare me. I know that voting this up is funny, and easy, and feels good. But even if we get this data, it's a symbolic victory at best. Our basic human rights, like the right to privacy, are being sold to the highest bidder while the best minds of our generation are here on Reddit asking pro gamers if they want to fight a horse-sized duck or whatever. Real, material change requires sacrifice. You probably can't do it on a computer. If you're frustrated with the way things are going, the incompetence and corruption of government, and the money in politics, we need to support institutions like the EFF and we need to be heard by elected officials. I really like the tool 5Calls.org. If 100 Redditors called a congressman, it would freak them out and their staff would have to do something about it. It really doesn't take much.
We asked Temkin about the enthusiastic response he has gotten for his ideas:
The response to our attempt to buy congress' data if and when it becomes available has been overwhelmingly positive. But that's also a symbolic gesture, and not a real material change to policy or anything. So I wish people would stay focused on the coming battle over Net Neutrality.
We also asked him why he thought the recent regulation rollback has generated more outrage than the threat to net neutrality, which refers to the concept that Internet service providers should not block or discriminate against any applications or content that ride over networks. Temkin chalked it up to both fear that Internet search histories could somehow become public, and anger towards the newly-elected president for a perceived betrayal:
[T]here's a lot of young people who believed in Trump and see this as a betrayal of what he said he was about. But this is also a more personal issue than net neutrality, everyone can imagine how embarrassing or strange their personal browser history or search history would be, taken out of context
Citing Temkin, TechCrunch writer Taylor Hatmaker had some doubts about McElhaney's stated mission, writing on 29 March 2017:
First of all, it's not like this sort of thing is a true open market where absolutely anything goes. Private individuals can't just waltz in, slam their money on a table (what table??) and demand targeted, de-anonymized internet data on individual users, successful GoFundMe campaign or not. Sure, advertisers can buy web user data, but that's generally done in aggregate, and they have existing relationships that let them broker these kind of deals to begin with, sketchy as they may be.
Second, I mean, yeah, it's hypocritical. If you care about privacy, like really believe in it, throwing your ideals out the window for a half-baked revenge plot isn't a very good look. And like I said, I like revenge just fine. But it's a dish best served cold, and anyone who gives a shit about privacy is still worked up from yesterday's nonsense. And, by the way, the GoFundMe wants to target not only the politicians and the telecom fat cats, but also their families (check the fine print). Not cool.
@DavidAns this site is raising $1m on gofund me for promises they cannot possibly deliver on, it is a scam
— Max Temkin (@MaxTemkin) March 29, 2017
We asked McElhaney to respond to criticism that he was raising money toward a goal that wasn't achievable (he also said he plans to return donated money if he is unable to achieve his stated goal). He told us he has worked in Internet technologies for fifteen years, and believes it is possible:
When you search for something on the Internet (whether you're in incognito mode or not), that data goes to your ISP, where in most cases it is logged. It may not know WHO specifically in your home made the request, it just knows that from your unique IP address someone made the request. ISP's will argue that the data isn't attached to a name.
How can it not be? They know how much data you are using. It is why you have data limits and caps. If they are unable to match a name to an IP address they would have no way of monitoring your data usage and be able to charge you extra at the end of the month when you have gone over. The ISP's and telecom industries want you to believe they would never sell your data. Then why did they lobby our legislators to remove the protection?
If the data must be bought in bulk, ok that's fine. Give us the external IP address of we are requesting the data for so we can filter. So could we request from Paul Ryan's ISP to look up his home IP address? Yes. Could we then in turn send a check for $150,000 in exchange for that data that is associated with that IP address. Yes. Would it cost that much? Who knows? But money talks.