By Carolyn Krol
On Thursday, October 13, 2016, the Federal Trade Commission (“FTC”) held an afternoon workshop exploring drones as part of its series of fall technology events. Commissioner Maureen Ohlhausen’s opening remarks likened privacy concerns about drones to concerns about portable camera technology. The Commissioner explained in 1890, it was this new and unfamiliar portable camera technology that spurred the influential Louis Brandeis and Samuel Warren “Right to Privacy” article. Like portable camera technology in 1890, drones are a new and unfamiliar technology prompting experts and consumers alike to reevaluate the right to privacy. In an effort to evaluate privacy in the context of drone technology, speakers at the workshop highlighted the following issues:
consumer perception of drones, in particular the overall lack of trust between consumer bystanders and drone operators;
the uniqueness of drone technology, specifically whether drones are unique enough to warrant distinct regulation from other technologies;
existing guidelines, current regulatory action, and future regulatory approaches, and in particular whether certain policies could lead to inconsistent legislation over equally invasive data collection conducted using other technologies; and
whether drone operators can offer notice and choice to consumer bystanders.
The workshop consisted of two presentations and two panels. The FTC Office of Technology, Research & Investigation first presented its research based on three popular commercial drones.
FTC staff examined three drones under $200 and found:
open wireless networks;
no encryption of video or control signals
root shell access via telnet;
one drone without password protection; and
ability to see video feed on multiple devices with inconsistent or no notification.
Using these findings, the FTC staff then demonstrated how to attack a drone (1) to remotely access video feed and (2) turn it off mid-air. The FTC staff concluded their presentation by encouraging drone manufacturers to take steps to mitigate these dangers (e.g., using secure WiFi, using encryption technology, and preventing drone technology from capturing human faces). Panelists later responded to FTC staff recommendations, some of whom raised concerns regarding the resulting accuracy versus privacy tradeoff (e.g., arguing that drone technology that prevents drones from capturing human faces may affect the ability of a drone to know where it is in a physical place using Simultaneous Localization and Mapping (SLAM) methods). Others emphasized these steps are already being taken by some drone manufacturers.
Do Drones Raise Unique Privacy Concerns?
The first panel discussed whether drones raise unique privacy concerns. Panelists disagreed about whether drones are unique enough to warrant distinct regulation from other technologies and whether current regulations and guidelines address underlying privacy concerns. Some panelists argued drones are unique due to:
operator remoteness;
smaller size (making it harder for consumer bystanders to identify);
ability to collect more robust data in mass; and
resulting decreased cost for aerial surveillance.
Other panelists argued drones do not raise unique privacy issues, in particular that drone data collection is no more robust or invasive then other technologies already in use (e.g., online advertising technology).
The panelists also considered the rights of drone operators, how perception shapes regulation, and how privacy rights can conflict with First Amendment rights. In the context of future regulatory efforts, some panelists emphasized a need to identify problems associated with drone technology on a case-by-case basis and create regulations based on those specific use cases. Others panelists cautioned strict regulation of drones will kill off innovation.
Consumer Perception of Drones
Yang Wang, an assistant professor at Syracuse University then presented takeaways from his article, Flying Eyes and Hidden Controllers: A Qualitative Study of People's Privacy Perceptions of Civilian Drones in the U.S., based on empirical research studies. He explained amongst other conflicting perspectives between drone operators and consumer bystanders, the key challenge is the lack of trust between these two groups.
How Should Privacy Concerns Raised by Drones Be Addressed?
The workshop concluded with a conversation about how privacy concerns raised by drones should be addressed. Panelists considered regulatory effectiveness and progress at the federal, state and municipal level as well as recently issued self-regulatory guidance. Panelists also debated whether it is possible to implement notice and choice with drones.
At a federal level, panelists considered whether the FTC will be able to effectively police drone manufacturers given the lack of interaction with consumers. Panelists noted there are many gaps in state laws that still leave a void in privacy laws. One panelist offered perspective from a municipal standpoint, arguing the benefit of federal and state regulation given the limited resources of municipalities.
Panelists discussed the National Telecommunications & Information Administration (NTIA) multi-stakeholder process and resulting recently-issued voluntary best practices. Points of contention surrounded the usefulness of this process given NTIA’s track record regarding protecting consumer interest in previous multi-stakeholder privacy initiatives around mobile apps and facial recognition. As to whether these guidelines will be effective, some panelists suggested consumer bystanders likely will not trust drone operators will abide by these voluntary guidelines.
Panelists were also asked to address whether it is possible to implement notice and choice with drones. One panelist argued the question is whether consumer bystanders can be given adequate notice about the type of data being collected. Other panelists pointed to instances where consumer bystanders could reasonably expect their actions could be captured by drones (e.g., riots are typically covered by the media). Panelists also considered First Amendment rights noting just because there is a First Amendment right to record, privacy concerns are still valid. However, some panelists also cautioned that requiring notice and consent could be considered compelled speech.
While the second panel engaged in lively discussion, disagreeing and debating, the panelists broadly agreed that one day consumers will be okay with drones the same way they are okay with cameras.
The FTC Fall Technology Series comprises three half-day events that will explore three new and evolving technologies that are raising critical consumer protection issues – ransomware, drones, and smart TV. Businesses small and large should expect to see the FTC issue guidance on these technologies, which will indicate the Commission’s views and that are likely to be reflected in future enforcement actions.