COMPUTER PRIVACY VS. FIRST AND FOURTH AMENDMENT RIGHTS                       (By Michael S. Borella)<Mike Borella received a bachelor's degree in Computer Science andTechnical Communication from Clarkson University (1991). He iscurrently a graduate student and teaching assistant in ComputerScience at U.  Cal. at Davis. This paper is the result of anindependent study sponsored by Susan Ross, an assistant professor inTechnical Communication at Clarkson. e-mailborella@toadflax.eecs.ucdavis or sross@clutx.clarkson.edu>I: What is Cyberspace?            "Cyberspace.  A consensual hallucination experienced daily        by billions of legitimate operators, in every nation...  A        graphical representation of data abstracted from the banks        of every computer in the human system.  Unthinkable        complexity.  Lines of light ranged in the nonspace of the        mind, clusters and constellations of data.  Like city lights,        receding..."                                        - William Gibson, Neuromancer        Even after reading William Gibson's cyberpunk novels, one'sconceptualization of cyberspace, the electronic world of computers andcomputer networks, can be insubstantial.  Gibson describes cyberspace asa world of simulated stimulation that a computer feeds to a "jockey"(computer operator) via a "cyberspace deck" (human-computer interface).Explorers in Gibson's cyberspace often have difficulty telling what isreal and what is not.  Frequently, in our world, the novice computeruser has similar problems understanding how to use the potential wealthof information at their finger tips.  In Gibson's uncharted future,people access computers by merging their thoughts with a database.Today we can "enter" cyberspace through keyboard and modem.  But whatactually is cyberspace?  Is it real?  What does it look like?  What aresome of the personal and legal issues emerging from this vastlyuncharted new frontier?  This paper will answer those questions and moreas we explore cyberspace, meet its frequenters, and discuss itsincreasing role in the life of every human being, not just those whoactually use a computer.        Before we embark on our journey through the legal battles andrights issues regarding cyberspace, we need a working knowledge of whatit is and how computer operators use it.        Envision a roadmap.  Cities dot the otherwise sparse landscapeand roads branch out in all directions, connecting every city.  Thisnetwork leaves no city unserviced. Although not every city is connectedto every other, it is possible to reach any one city from any other.Like every other mass transit system, certain areas are more travelledthan others.  Some cities are larger than others and some stretches ofroad are more prone to traffic.  The size and complexity of this roadmapdefies the imagination - it encircles the world.        But the cities are not actually cities.  They are computers orgroups of computers.  The roads are telephone lines or fiber-opticcable.  The system surrounds the globe in an electronic web of data.The travellers on these 'virtual' roads are packets of information whichare sent from one city to another, perhaps via many.  The roadmap is aworldwide computer "network."  Each city is a depot or terminal for thepackets, and is usually referred to as a "node."  In reality they aremainframes owned by universities, companies, or groups of computerusers.  There are several worldwide computer networks currently inexistence.        Every individual who has an account on any mainframe in theworld has their own unique electronic address.  It is not unlike amailbox, except that it can only receive mail of the electronic kind.Electronic addresses are similar to postal addresses in that theycontain:        --a name, or user identification which corresponds to the        individual computer user who owns the particular address.        --a local machine name, which is the specific mainframe that the        userid is on.  Local names are only used in the node consists of        more than one mainframe.  This is not unlike a street address.        --a node name, which corresponds to the physical location of the        node that the userid belongs to.  This is not unlike a city        address and/or zip code.        This is all a network needs to know before it can sendinformation from one mailbox to another.  Just like postal mail, if theuser doesn't address mail correctly, the network will return it.  In thecase of e-mail (electronic mail) a simple misspelling will cause thenetwork to return the mail, or send it to an improper destination.  Eachof the several worldwide networks has its own unique but similar methodfor addressing e-mail.  Corresponding via electronic mail has beenavailable to some academicians for over 20 years, but today it ispossible for anybody with a computer and a modem to have their ownmailbox.  For the sake of convenience, many useful physical objects havebeen abstracted into cyberspace.  Computerized filing systems(databases), bulletin boards, and electronically published digests andmagazines proliferate in the virtual world of networks.  Many of theseelectronic items are being treated differently than their "real"counterparts.  Often, due to the convenience of having millions ofpieces of data available in seconds, individual privacy rights areviolated.  This is leading to debate and litigation concerning the useof various aspects of cyberspace.  The next sections cover thesituations, people, and legislation of this untamed and largelyundefined frontier.II: Databases        A database is a collection facts, figures, numbers, and wordsthat are sorted in a particular order and/or indexed. They are stored ona computer so that retrieval is quick and simple.  Often, databases areused by the government, corporations, and private businesses to keeptrack of the names, address, phone numbers, and other relevant dataabout their clients, subscribers, members, etc.  For example, mostpublic libraries have databases containing information of every personwho has a card at that library.  Besides the name, address, and phonenumber of the card holder, the library's database would also containinformation regarding what books the holder is currently borrowing,whether they are overdue or not, and when each person's library cardexpires.        Similarly, banks have databases containing information regardingthe persons they transact with.  Again, name, address and phone numberis essential, but the bank would also be interested in social securitynumber, credit rating, assets, mortgage information, and so on.  Byorganizing this data on a computer, the bank increases its efficiency.It is able to serve more customers in less time, and provide monetarytransactions within seconds.  Anyone who has used a bank card at anautomated teller can attest to this.        But all databases are not used for such beneficial purposes.  Aswe will see in the next section, even the information stored in "benign"databases can be used to violate privacy rights.        In 1967, J. Edgar Hoover, then head of the FBI, created theNational Crime Information Center (NCIC).  This organization's purposeis to use a computerized database containing the criminal record ofevery United States citizen to increase the efficiency of all levels oflaw enforcement by facilitating quick exchange of information.  TheNCIC's federal databanks interface with over 64,000 state and localgovernments' computer networks, and even with some criminal databases offoreign countries.  This widespread and far-reaching power is used byeveryone from top FBI investigators to county and municipal patrolofficers.  For example, if a police officer pulls over a speeder in NewYork, they can check, within a matter of seconds, if that person iswanted in any other state, and if that person has a criminal record.        The NCIC contains records on every person arrested in the UnitedStates, which amounts to approximately 40 million people, a numberequivalent to one-third of the work force (Gordon and Churchill, p.497). It goes without saying that the holders of this information haveincredible power.  However, at first glance, the existence of the NCIC'sdatabases seem completely beneficial; in fact they do much to protectthe privacy of the average American.  Authorities can find out if anindividual is wanted for a crime and detain that person if necessary,all with the push of a few buttons.  Effective law enforcement does makethe country a safer place for its citizens.  But, as we will see, thecurrent state of and uses for the NCIC do infringe upon individualprivacy.        There are many cases in which the NCIC databases have beenfound to hold inaccurate and incomplete information. Keep in mind thatthey only contain arrest records, not conviction records.  If anindividual has been acquitted of a charge, it does not necessarily getentered into the computers.  An example of this was the legal battlefought by Los Angeles native Terry Dean Rogan.  After Rogan lost hiswallet, a man using his identification was linked to four crimes,including two murders.  Rogan was mistakenly arrested, and an NCIC filewas made about him.  The file was inaccurate - it did not contain adescription of him.  As a result, he was arrested four times for crimeshe didn't commit.  Rogan successfully sued to city if Los Angeles in1987 for violating his Fourth Amendment rights (Science Court Opinions,p. 99).  But some victims of NCIC errors don't get off so easily.        In 1979, Michael Ducross of Huntington Beach California made aminor traffic violation on his way to the supermarket one day.  Thepolice officer radioed for a check on Ducross.  When a police stationdesk clerk punched up the NCIC database to see if Ducross had a file, hegot a surprising result.  Ducross was wanted for going AWOL from theMarine Corps 10 years earlier.  He was seized and held for five monthsat Camp Pendleton.  The Marine Corps eventually dropped the chargesbecause he had never actually gone AWOL.  Ducross was a Native American,and he had left the Corps on a special discharge program available onlyto Native Americans and foreign citizens (Burnham, pp. 33-34).        But these are just two isolated examples, right?  Wrong!  Astudy by the Congressional Office of Technology Assistance (OTA)conducted in 1982 found that, "...as many as one-third of state recordslacked information about the disposition of the cases on file.Therefore, an arrest in one state, which may have resulted in adismissal or an acquittal, could in another state influence the decisionto withhold bail or to prosecute the defendant as a 'career criminal.' "(Gordon and Churchill, p. 514).  The OTA study found that, at best, 49.5percent of the NCIC Criminal History records were complete, correct, andunambiguous (Burnham, p. 74).        It's bad enough that the NCIC files are largely inaccurate -thatyour Fourth Amendment rights protecting unlawful search and seizure canbe lawfully violated if you have been previously arrested for a crimeyou didn't commit - but these computerized criminal files are used formuch more than law enforcement, and are used by more than just lawenforcement agencies.  Approximately 90 percent of all criminalhistories in the United States are available to public and privateemployers (Gordon and Churchill, p. 515).        Nor is the NCIC without local competition. For example, oneRhode Island data merchant, whose clients are mostly prospectiveemployers, keeps files on people who have been arrested butno necessarily convicted of a crime. That merchant includes in the filesnames of individuals taken from local newspaper stories (ConsumerReports).        If arrest records but not conviction records are available,might not they influence hiring decisions? For example, might not anemployer finding a record of arrests in the file of a person claiming a"clean record" on an employment application question the credibility ofthe applicant's claim and make a decision not to hire influenced by thatdoubt? Given that the applicant would not be aware that such a databasehad been consulted, he or she could not possibly mount a defense if theinformation in the file was inaccurate (e.g., someone else's arrests) ormisleading (e.g. no arrests led to convictions).        Since 40 million US citizens have an arrest record, thesocial cost is potentially high.  In several states, includingCalifornia and Connecticut, more than half of the information requeststo criminal history databases were made by employers (Gordon andChurchill, p.  515).        But the problems don't end there.  In 1981, mainly becauseof John Hinckley's attempt on then President Ronald Reagan's life, about400 files were added to the NCIC database.  These were of people who hadno criminal record and were wanted for no crime!  Why were they beingentered into the computers?  Because these individuals were considered"a potential danger" by the Secret Service.  Secret Service DirectorJohn R. Simpson stated that listing these people would provide aninvaluable tool for tracking their location and activities (Epstein, p.17).  This shows that the government is only paying lip service to the"innocent until proven guilty" precedent that our freedom is based on.The "potential danger" would be to members of the FBI protectorate,including the President, Congress members, and controversial politicaland social figures such as Jacqueline Onassis.  Considering how"accurate" the files have been proven to be, one can imagine theatrocities possible (and encouraged) under these provisions.        But there are more culprits to this mess than just thegovernment. The use of databases in the violation of privacy extendsinto the corporate world.  The U.D. Registry Inc. was formed in 1977 byHarvey Saltz, a former deputy district attorney in Los Angeles.  "Usinga computer to store information obtained from legal charges filed bylandlords in the courts, Saltz says he currently has compiled more thana million records about such disputes all over the Los Angeles area.Over 1900 landlords pay Saltz an annual fee ranging from $35 to $60...todetermine whether the individuals who come to them for housing have hadarguments with other landlords in the past." (Burnham, p. 34).  And justlike the NCIC, Saltz's database was found to be less than reliable.        In 1978, Lucky Kellener paid the rent to his brother'sapartment. But when his brother was evicted, Kellener's name wasincluded in the U.D. Registry files, defining him as an undesirabletenant.  When Kellener went looking for a new apartment in 1981, he gotrepeatedly turned down and brushed off.  Finally, a landlord told himthat he had been blacklisted (Burnham, pp. 34-35).        Another victim was Barbara Ward, who moved to Los Angeles and