THE FORUM ON TECHNOLOGY AND INNOVATION

+ + + + +

PRIVACY IN A TRANSPARENT SOCIETY

+ + + + +

THURSDAY,

APRIL 15, 1999

+ + + + +

PRESENT:

SENATOR JAY ROCKEFELLER Co-Chair

SENATOR BILL FRIST Co-Chair

MEG WHITMAN President & CEO,

eBay, Inc.

DAVID BRIN Author,

The Transparent Society

MARC ROTENBERG Director,

Electronic Privacy

Information Center

This transcript was produced from tape provided

by The Forum on Technology and Innovation.

A-G-E-N-D-A

PAGE

I. Opening Remarks and Introductions 3

II. Featured Speakers

  --   Meg Whitman 12

  --   David Brin 22

  --   Marc Rotenberg 33

III. Roundtable Discussion and Q&A

P-R-O-C-E-E-D-I-N-G-S

(12:30 p.m.)

SENATOR ROCKEFELLER:   --   who work in

Senate offices and who, in effect, decide, although

you may not choose to admit it, what Senate offices

will come to do because of your influence on, as they

say, the principals.

We try to bring you the most dynamic

speakers that we can. We have not failed, and we will

not fail on this.

In your briefing packages, before I

introduce Bill, just kind of give a few overview

comments on privacy, you will find a number of things.

One is we encourage, militantly, questioning. We have

a microphone over there. We have a microphone over

there, for those who like to do it that way. We also

have green cards in your thing, which are very easy to

fill out. Writing legibly increases your chances of

having a question asked. They come up to Bill and

Ivan. We ask them.

As you know, we do not take a point of

view in this forum. We sit   --   our purpose is to put

before you all of the information we possibly can from

the people who know it best   --   in this case, privacy

and all of the issues associated with it.

And, finally, there's a blue form which we

take seriously, and you probably won't for a while.

But that's all right. And that is an evaluation form.

We want to know what you think, what you   --   because we

pay attention to that.

Bill is a doctor, and I'm a former

unemployed social worker, so we   --   we take

everything   --  

(Laughter.)

  --   you say seriously.

(Laughter.)

So, Bill Frist.

SENATOR FRIST: Thank you, Jay.

Let me welcome everybody as well.

Exciting forum. I can tell you that everywhere we go,

as we travel through our states and around the

country, people are talking about this forum. It has

nothing to do with us or even the organization. It

has to do with the topics, the types of interest that

is out there broadly in technology and research and

development in an environment where we know that there

are changes that are ongoing, changes that create

challenges, that can't be predicted very far in

advance.

And one of our goals is to stay on top of

issues and in a very, very current way, do forums just

like this   --   have outstanding presenters. And Jay and

I are not the presenters. We're the moderators.

We're here just to keep things going.

But to bring in an outstanding panel who

can speak to issues in ways that are current, and in

ways that very few people could, to an audience such

as each of you who are broadly representative of

decisionmakers, policymakers, who ultimately translate

these challenges down to public policy. Not

necessarily legislation, but public policy.

Privacy is one of those issues. Privacy,

right now, in the electronic domain is continually

occupying the minds and the thoughts and the topics of

discussion of people throughout the country.

Recent polling by the Harris organization

indicates that 82 percent of Americans   --   four out of

every five Americans   --   are concerned that they have,

and I quote, "lost all control" over how their

personal information is used by companies with whom

they conduct business."

And 81 percent of Internet users feel

their personal privacy is at risk when they go online.

At the same time, about 69 percent of Americans favor

voluntary privacy protection measures over increased

government regulation. It's an exciting policy arena

that Congress is beginning to examine in a somewhat

piecemeal fashion.

There are a number of bills that we won't

be talking about today. But if you look at the range

of bills that have been presented just over the last

few months to the United States Congress, they, in

many ways, capture what the subject will be about

today. What the substance will be about today

ultimately is translated into many different types of

bills.

Should Congress intervene and create laws

to protect American citizens from potential abuse of

their private information? Or is it more appropriate

that we step back and watch as E-commerce

revolutionizes their way and the way that companies do

business.

We're fortunate to have, again, three

thoughtful panelists with us today to discuss these

types of issues.

Some of you were not with us last month,

and I'll mention a little bit later about the other

topics that we have planned in the future as we close

today.

We always begin with a short introduction

  --   and when I say "short," you've just heard the

introduction to today's topic in the last couple of

minutes that I have talked   --   followed by 10-minute

presentations of each of the three panelists. The

remainder of the time, and, in truth, the bulk of the

time, as the three   --   or after the three panelists

have made their presentation, is a discussion.

We encourage, as Senator Rockefeller says,

for you to submit questions. It's always a little bit

better to do it live. But if you don't want to do it

live, go ahead and submit the questions and we'll do

our best to read them. We always have more questions

  --   always   --   and we do this in other forums   --   than

we can take.

And so the objective is if you come to the

microphone, make a short statement, go ahead and make

your point because we do want to hear from you, direct

your question to one of the panelists, and then

Senator Rockefeller and I will help moderate

thereafter. Your job   --   and you've got a job by

coming here   --   is to participate in that discussion,

in that questioning. The briefing packets do take a

look at. They do have the information that Senator

Rockefeller mentioned, those evaluation forms, and the

question forms are in that packet.

With that, let me turn it back, welcome

you all once again and turn it back to Senator

Rockefeller.

SENATOR ROCKEFELLER: Thanks, Bill.

On the evaluation, just a small detail but

important to me, those of you who are sitting near the

back   --   and this is the standing room only crowd at

this point   --   but a lot of you are seated. And I'm

interested   --   in our other forum we do this on a

platform, so that you can see us more easily.

By us being at the same level that you

are, can you see us less easily, and, therefore, hear

us and interact with us less easily? That's one of

the things that you can help us on.

SENATOR FRIST: Politicians love being on

platforms.

(Laughter.)

SENATOR ROCKEFELLER: You know, okay,

let's   --   let me   --   I'm going to introduce all three

speakers at the same time and trust that your memory

can handle that overload of information, the three

people.

Meg Whitman is the President and CEO of

eBay, the world's most successful online auction

house. My wife is a director of Sotheby's, and I will

never forget the day that she went roaring up to New

York for an emergency meeting that Sotheby's obviously

was about to be taken over by eBay if they didn't

start their own, and, by golly, I think they did.

The New York Times has called   --   I find

this unattractive, but it's here before me   --   has

called eBay "the central bazaar of the web." I think

that's good.

(Laughter.)

Their audience has surged to six and a half

million visitors a month. It is capitalized

overwhelmingly   --   $23 billion. You had another

offering, I think, that you just went through, which

produced so much money that I think they have shut

down the New York   --   the NASDAQ for a couple of hours.

Meg herself is on the front lines of the

privacy issue because she faces a very unique

challenge, which I will explain. I visited, in fact,

Meg Whitman's operation last year, and one of the

things that was terribly, terribly clear just from the

conversation was that they do well as they are trusted

buyers and sellers, each other. Not just eBay is

trusted, but the buyers, you know, trust the sellers.

And to do that you have to have

information, and you have to have information about

each other. And that information compiles and eBay

will do well or not do well according to the level of

that trust. To maintain that, obviously, the

information needed brings us directly into the privacy

issue   --   how do you do that without violating privacy?

That is   --   I'm sure Meg will discuss that.

David Brin, who sits right here, has a

triple career, two of which are I think ethical.

(Laughter.)

One is he is an astrophysicist, and the

second is he's a science fiction author. The dubious

one is he is a public speaker.

(Laughter.)

Now, his book, while I have before me

here, The Transparent Society, he deals with a range

of threats and opportunities facing our wired society

in the electronic age. And his chief argument that

openness fosters personal freedom more effectively

than does secrecy   --   think about that   --   has generated

intense controversy and discussion.

Our third speaker over here is Marc

Rotenberg. He is the Director of the Electronic

Privacy Information Center, who may see things a

little bit differently.

And, incidentally, we encourage our

panelists to argue with each other. We do. Because,

I mean, that's the way things can come out. It

doesn't   --   they should go after each other when they

want to.

Also, he teaches law at Georgetown

University. He was named one of the 50 most

influential young lawyers in the U.S. public sector by

the American Lawyer. I deem that to be a good thing.

He is a self-described privacy activist, having helped

organize grass-roots campaigns against Lotus

marketplace and the chipper   --   the clipper chip

encryption scheme. He is currently coordinating the

global Internet liberty campaign.

So those are your three speakers, and we

now go to Meg Whitman. And we're very grateful to all

of you for being here.

MS. WHITMAN: Great. Thank you very much.

I appreciate the invitation. I think this

will be a lot of fun, and I applaud you for putting

these forums together. And one of the reasons that I

agreed that I would come is I think I will probably

learn something here as well, and that will make eBay

a better company.

Before I begin, I thought it might just

take   --   I might take a minute to describe what eBay

actually does. Our company is only three and a half

years old. And while we have garnered tremendous

publicity, there are still many people who actually do

not understand what eBay does.

And what we did is create a marketplace

where individuals could do business with one another.

And it is an efficient marketplace because all sales

are done in an auction format.

So whether you are selling in any one of

1,400 categories, from Beanie Babies to stamps to

Teletubbies to antique furniture, users can trade in

over 1,400 categories, and the market has grown

enormously because prior to eBay buyers could not find

what they were looking for in a concentrated arena,

and sellers only sold in their geography. So now

sellers have the entire world as their marketplace,

and buyers have an enormous opportunity to sift

through things that they want to buy.

To give you a sense of the scale, in the

fourth quarter of this year eBay users traded

$307 million of gross merchandise sales. On an

annualized basis, that's $1.2 billion, which makes us

the largest E-commerce site on the entire Internet.

More gross sales are done at eBay than at Amazon,

CDNow, or On Sale. We have 6.5 million visitors a

month, 2.2 million registered users who have

registered with us to buy or sell.

One of the things that you should know

because it comes back to the whole privacy and trust

issue is that you can look at items on eBay, you can

surf the site, you can window shop, and not be a

registered user. But if you want to do a transaction,

you must be a registered user. And that's an

important thing to know.

Growing very, very rapidly. The company

has been growing 50 percent a quarter for the last

five quarters. As recently as a year ago, we had 20

employees. We now have 209, and by the end of the

year we'll have probably close to 800.

So enormously, rapidly-growing company,

and the thing that's very interesting is we are

pioneering this marketplace. This is something that

could not be done before the Internet. And so most of

the time we are actually trying to figure out what the

right thing to do is because there is not a lot of

precedent here.

So with that, let me tell you a little bit

about eBay's philosophy towards privacy. First of

all, we think it's very important, and our users think

it's very important   --   that they really do understand

the data that we collect about them and how that data

is used.

Now, I will say, exactly as Senator

Rockefeller said, there is this tension that exists

every day at eBay because information makes eBay a

safer place to trade. On the other hand, individuals

don't want too much information about them readily

available, and that is the real-life tension that we

deal with on a daily basis.

Now, if I can give you a sense of how we

think about communicating trust to our environment,

it's really two major components. And the first is

what you say, and the second is what you do. And as

your mother taught you, it's probably a lot more

important what you do than what you say.

But, in fact, we do communicate very

clearly on our site about our privacy policy. We are

a member of all of the various organizations, which

I'll describe in a moment, and we do have a seal on

our site, which is the trustee seal, as well as BBB

online. So we talk about what we are doing.

But very importantly, users' trust on eBay

is how we treat them each and every day, and, frankly,

how they treat each other. So I'm going to focus more

on what we do as opposed to what we say.

eBay was founded on the notion of a very

open and honest marketplace where information was

available to everyone on a very level playing field.

And we have taken, as a result, an active stance to

inform users about how the rules are at eBay, what

information we collect about you, and what other users

can know about you.

And one of the things that we did was

create a very unique appendix, which I'll show you in

a moment, that in an instant lets you know what

information we collect about you and how we use it.

And I'll tell you a funny story.

Brad Handler, who is our associate general

counsel, wrote this very nice privacy statement. It

was three pages long, and it was very helpful. He

sent it to his mother, and he said, "Do you understand

this?" And she said, "Not really." And so he kind of

went back to the drawing board and created this

appendix, which his mother understands, which means

that, you know, at least probably 80 percent of our

users understand.

We also have an automatic update feature.

Whenever we make changes to the privacy policy   --   and,

unfortunately, we have to make them usually about

every three months   --   we send our users an updated

information sheet that says, "Here is what you knew

about us last time, and here is the changes that we've

made."

One of the very important things about our

privacy policy   --   and this has been true from the

beginning   --   is that we will never sell or rent

information about users. We were founded with the

belief that actually our users   --   we should not treat

them as wallets. We should treat them as individuals.

And it goes back to the very early founding days of

this company.

So we have not used the Internet in a

traditional form of direct marketing that so many

Internet companies are.

And then, lastly, we also have a policy

against SPAM, that we have only opt-in policies. If

you want to adopt our personal shopper product, you

want to know when British toy soldiers, pre-1900, inch

and a half high, come on the site, you have to let us

know that that is information you want. We will never

look at the fact that you have bought 10 toy soldiers,

British, pre-1900, half inch, and then start telling

you that those come on the site.

This just gives you a sense of our privacy

policy, and it is very easy to get to this privacy

policy. There is a link on every single page of eBay,

either a text link or the trustee seal, that lets you

get to this policy. And then   --   and you can read

through that. It's about three pages long. That was

the thing that Brad wrote first.

And then, this is what his mother

understands, which is   --   it says, "Here is the

information that we collect about you, and here is who

sees it." And the first column is the world can see

this information. This is information available to

everyone. This is information that registered users

can see. This is information that eBay   --   we know

about you but we do not release.

And then, finally, our legal buddy

program. And those are content owners, intellectual

property owners, everyone from Microsoft to Paramount

to Tommy Hilfiger. They are very interested, of

course, to make sure that infringing and non-licensed

product is not sold on eBay. So there is some

information that we will release to those kinds of

individuals.

From the beginning, actually, we have

taken this quite seriously. And we were a founding

member of the online privacy alliance. We've been a

member of trustee and a member of the BBB online. And

those, I think, have been very helpful to us in sort

of understanding what the right thing to do is here,

working with other partners in our industry to say,

you know, "Here is what the trend is, and here is the

stance that we want to take."

And our real future plans are to remain an

industry pioneer in this area. We are proud of our

record to date. Do we think we are perfect? No.

And, you know, every   --   the thing about the internet

is that the speed at which this change   --   this medium

changes is incredible.

Before eBay, I was at Hasbro running the

preschool division, and we do more in three months at

eBay than we did in almost 18 months to two years at

Hasbro. And that's because the competitive set is

changing and the environment is changing and the

technology is changing.

We want to lead by example. We have

talked with other online auction providers and tried

to get an industry   --   because we are benefitted if the

industry is, you know, on a consistent basis. And we

want to help promote privacy across the net, staying

active in oversight.

And then, lastly, being a very good and

cooperative partner with government. I would say that

I think that the best way to approach this is through

a partnership as opposed to legislation, because I

think if internet companies actually end up competing

for the best privacy policy that will actually serve

consumers very well as opposed to being legislated

into a lowest common denominator kind of strategy.

And then, of course, it's very important

for us to continue to build trust on eBay, not only

with our users on eBay but with buyers and sellers.

So those are our objectives. And I'm

fascinated to actually hear this discussion because I

think it will in many ways help us as we think about

our privacy policy going forward.

So thank you very much.

(Applause.)

SENATOR ROCKEFELLER: Thank you, Meg. And I know

that one-third of you are already writing questions.

This is the constant pressure you're going to get from

up here for the next 10 years or so.

David?

MR. BRIN: I have to   --   I'm not quite as

skilled as Meg at keeping my remarks terse.

I'll try.

Thanks a lot, Senators Frist and

Rockefeller, and, of course, Peter Rooney for inviting

us here today. I think this is a very great idea

because you are the ones who actually have time to

read and digest stuff and try to prepare it for your

principals.

As we speak, across town, the Bar

Association is holding a big session on E-commerce.

The number of meetings on this issue is increasing

rapidly because people are very concerned. And we are

a civilization that tries to have enough perspective

to do something that most other civilizations never

did, and that's imagine where the next threat is

coming from, where the next Pearl Harbor might be or

the next disaster or the next mistake.

Edward Tenor wrote a book called "Why

Things Bite Back: The Tragedy of Unexpected

Consequences," about many great schemes that looked

good on paper but wound up not working out so well or

having terrible unintended consequences.

So this room is an example of a

civilization poking sticks in the path where we're

walking to try to see where the quicksand is. So I

congratulate you for being here today.

Meg Whitman demonstrated how many

institutions are trying to maintain privacy as a

matter of trust, out of a matter of simple self-

interest. And many people believe that this is how

it's going to work in the long run, and I happen to be

one of those people.

Marc Rotenberg will probably take a

somewhat more assertive clarion call attitude towards

what needs to be done.

I want to point out that this business of

electronic privacy is just one aspect of a whole vast

octopus of privacy concerns going in all directions.

In my book, I point out that the proliferation of

cameras has been going on. You've all seen it in the

news. The local neighborhood watch people, they

caught a murderer with their local neighborhood watch

camera.

In Britain, currently, there are half a

million police cameras reporting to police central in

various cities.

National security and personal security   --  

for an example, plastic guns are rapidly reaching the

point where they're going to make all our airline

detectors/security detectors obsolete. The technology

is on the way to the rescue with millimeter wave

radar.

Do you know what that does? It will see

the plastic gun. It will see anything, except it's

stopped by plastic, metal, and flesh, not by textiles.

So when you walk in front of this millimeter wave

radar you have this naked image of your body with

here's the gun, here's your wallet. Who are we going

to hire to run these things, little old ladies?

(Laughter.)

We are a   --   or maybe you could get   --   they

could   --   self-financing, have people pay to be the

people, you know   --  

(Laughter.)

Self-financing is highly in.

One of the things we're going to be facing

as a civilization is that we are a noisy, rambunctious

people, who argue a lot over the nitpicking details of

how to do things, and that is exactly the right

approach.

Social Security Numbers   --   this Congress

reversed itself two or three times, once requiring

that states put Social Security Numbers on driver's

licenses in order to be able to do quick crime checks,

and then immediately reversing, as with the medical ID

card, because the efficiency, on the one hand, seems

to go against the privacy on the other.

And I call this   --   again, plugging my book

  --   I call this "the devil's dichotomy," because it

creates a dichotomy that is false. It says that there

is a dichotomy, a choice that must be made between

efficiency and freedom. And it turns out this is

exactly opposite to the truth. We can have our cake

and eat it, too. We are living in this room as proof

of a people that cannot only have cake, eat it, and

expand the cake, and invite other people to the table.

That's the life that we have lived. I can

get into the Social Security Numbers business and how

silly the misconception is about it later in questions

if you're interested.

Right now, a strong privacy movement has

developed, which is very, very big nowadays and is

pushing several points of view. The left wing of the

strong privacy movement wants us to be like Europe, to

put privacy rights in the constitution, to have strong

privacy commissioners, whole shelves full of laws that

regulate what a doctor, a corporation, or you, as an

individual, may or may not know. In other words, laws

to control and regulate the contents of other people's

brains. When you get right down to it, that's what it

is.

On the other side   --   and these people

believe that Europe is ahead of us in privacy law,

which is   --   there is only one answer the generation

X-ers gave us   --   NOT.

The right wing of the strong privacy

movement believes that we will accomplish, for the

protection of our freedoms and our security and our

privacy, by encryption, by secret codes, by skulking

around and in great anonymity.

This   --   it reflects a reflex to protect

freedom by restricting information flow. It's a very

natural human reflex. If you look at animals,

especially monkeys, especially chimpanzees, and humans

above all, the natural tendency is to believe that

your enemies should know as little as possible, and

you should know as much as possible.

Given a choice between freedom and

accountability, we will all choose freedom for

ourselves and accountability and privacy for

ourselves, and accountability for everyone else,

especially him.

(Laughter.)

This is a dangerous approach that is

diametrically opposite of the way we got where we are.

Now, there are some people out there

opposing strong privacy. The Kado Institute, the

Libertarians   --   there's a document in there by Solveig

Singleton which makes the Libertarian case. Again,

I'm a bit of a curmudgeon about the degree to which

she believes that self-policing can handle the

problem, although Meg Whitman is giving us an example

of how that is certainly a partial solution.

Stepping back   --   and that's all I have

time to do in my remaining five minutes   --   is to say

that there is only one known anecdote that has ever

been a palliative against error in human history. And

that is criticism.

And there is almost nothing that human

beings dislike receiving more than criticism. We're

talking basic human nature here, and we are the first

civilization in all of human history that managed the

knack of applying accountability to the mighty. And

how you define "the mighty" depends on your political

bent.

I'm sure that the Senators here find it

irksome how much accountability is applied to them

every now and then. We've gone through an

accountability frenzy in this town a few months ago,

and yet they are wise enough to know that this system

provides a lot more than any other and is worthwhile.

Now, I just want to run through quickly a

few slides here, and then we can get into, in

questions, some of what I'm getting at here. But this

is just an amusing example of what the internet was

like at the turn of the century, the internet being

the telephone system.

It was distributed, multi-node, robust,

redundant, because there were about 100 phone systems

in New York, and they all strung from balcony to

balcony. And if a fire burned down one building, and

your route got destroyed, you would route around it,

just like the internet.

And then it moved towards a centralized

system that we all are familiar with  --  the phone

company, which is only now loosening up. Think about

this metaphor. We've been down this road before, but

I think we're doing a better job.

Let's switch to the next slide.

Basically, this is what I want you to

think about. What are we defending, and why do we

want to defend it? What are the reasons why we

choose, plan, organize, and try to defend an American

sociopolitical entity?

Features of the present U.S. culture which

are worth defending included unprecedented levels of

individual freedom tolerance of personal eccentricity,

unprecedented rates of education and scientific

progress, economic success and general opportunity for

advancement, safety, community, serenity, security

against ancient threats like war, famine, and

disorder, low levels of oppression by hierarchical

aristocracies.

Now, we can criticize ourselves that we

haven't gone far enough on all of these, nowhere near

far enough. But the fact that we think we can perfect

a society to eliminate these ancient ills, many

foreign people think that we're nuts for even

imagining it, and it's a divine madness, and it has

gotten us what we   --   where we're at   --   a culture that

encourages fun.

And finally, last on the list, nostalgia

and our patriotism for the tribe nation we were

brought up in. Only that one is shared with past

nations or past civilizations.

The next slide.

The things that we're primarily

responsible for giving us   --   the desideratum that I

listed on the previous page   --   are four things that I

call "accountability arenas"   --   democracy, science,

justice, and regulated markets.

Now, think about it. What do all four of

these have in common? They are arenas within which

people make statements, proposals, offer goods,

denunciations, whatever, and then are held

accountable. They have to provide evidence that they

should be the ones who win.

They are all arenas. They are all

tussling places. Democracy   --   it's done noisy,

inefficiently, loud, but everyone can understand the

issues and participate and validate the decisions. In

science, it's done prim, usually politely, the knives

are hidden behind your teeth.

(Laughter.)

I've been there. But the ferocity of

falsifiable statements and truth.

Justice systems   --   everybody hates the

lawyers, but they have to dot every I and cross every

T, because the decisions mean human life and human

death.

Regulated markets   --   you know how this

accountability arena works.

I want you to   --   before I sit down, I want

you to do just one thing. I want you to imagine a

world in the future in which everyone knows everything

about everybody else.

Now, this is an uncomfortable world,

especially during the transition where you get used to

it. And I don't like this world. I'm not prescribing

this world, even though my book is The Transparent

Society. I like privacy.

The point is: imagine such a world.

Everyone knows everything about everybody else. You

can imagine all four of these systems continuing to

work just fine. In fact, probably just a little bit

better.

Now, squint and imagine a world in which

nobody knows anything about anybody else. And you

just imagine those four systems even trying to work.

We've got to dance with the one who

brought us to the party, and the one who brought us to

the party is openness. And encryption has its place,

secrecy has its place, but secrecy should be a last

resort.

Thanks.

(Applause.)

MR. ROTENBERG: Well, thank you all for

being here today. I'm particularly happy to be here

and to meet the Senators and Meg Whitman and David

Brin. David and I have corresponded quite a bit by

email. But particularly to meet Meg, because I

organized a big conference last week in Washington on

issues related to freedom and privacy.

And at the end of the conference, I

realized that I had 600 mailing tubes left over. Now,

these are very nice 24-inch cardboard mailing tubes

that are filling up half of our office right now, and

I'm thinking to myself, what am I going to do with

these 600 mailing tubes? And I thought, ah ha, eBay.

(Laughter.)

And so I'm looking forward to going online

and seeing if I can get   --   you can contact me, by the

way, after the panel if you have a use for   --  

(Laughter.)

  --   these mailing tubes.

But to speak more generally, I would

actually say I find eBay just a fascinating online

environment, and I've been following the development

of the online world for quite some time. And eBay, to

me, is one of the most interesting.

I think you are clearly on the front lines

of dealing with the issue of consumer trust, in

addition to privacy, and what it takes to establish

trust. And the way I look at eBay, it helps support

many of my own views about the protection of personal

privacy.

I think trust is something that

individuals allocate based on their experiences with

others. That's how we build friendships. That's how

we separate colleagues from people who we distrust.

And eBay is this wonderful, in Gates' expression, sort

of friction-free environment where people can interact

around a common interest.

Now, privacy obviously plays a role in all

of this, because you don't necessarily want to say

everything about yourself the first time you meet

somebody. It may be necessary to say, for example,

only that you have 600 mailing tubes to sell and

you're interested to know who will give you the best

price. That is my interest in going online with eBay,

and I'm not particularly interested in telling others

in that community much more about me.

But for people who are online who are

looking for a whole bunch of mailing tubes, that's all

they need to know about me, that I have something that

they need, and we will find a way to negotiate a

transaction online that leaves both of us a little bit

better off than where we started.

And I think it's a very good example, in

fact, of how the online environment works to promote

commerce and even to protect privacy. But the key

here, and where I'm going to argue with David, is

about the selective disclosure of personal identity,

retaining the ability to decide what type of

information to disclose to whom and for what purpose.

Now, eBay also went through a very

interesting period where you could do a lot of

transactions almost without disclosing your actual

identity. And there was a lot of talk about the

reputational value of NYMs, N-Y-M. If you want to

sound cyber savvy, you have to pick up a few terms

like NYM to sort of understand what they say in Wired

magazine.

NYM is an identity, not necessarily a

person's actual identity. For example, I play chess

online. My wife would like me to quit because I play

too much. But okay, I play on the internet chess

club. I have an identity or a NYM which is simply

Dr. R. Okay? I go online, Dr. R, the guy who is

always playing sicilian defenses and always missing

A6, that's me. Okay?

(Laughter.)

But no one knows my actual identity, and

I have just a wonderful time online meeting people,

playing chess. They know my strength, but that's

about it.

eBay and a lot of other online services

sort of recreate the opportunity to establish

reputation and identity that is separate from your

actual identity. If you play, you know, street

basketball, for example, you get to meet people. You

know who   --   you know, you passed to somebody who is

either going to pass it back to you or not.

Over time, you figure out who those people

are. It's not like you need to look at their resume

when you're picking up teams and saying, "Oh, you're

the guy who doesn't pass. I don't want you on my

team. It's right here on your resume." In fact, it's

not going to be on the resume, which is another very

interesting thing about human interaction.

A lot of times the information that we

need to obtain from people to establish bonds of trust

and collaborations that work aren't always the

information that people will readily provide. And so

there's a lot of give and take in the disclosure of

personal information.

Now, being the part-time law professor

that I am, I went through the eBay privacy policy this

morning. There's actually quite a lot of it that I

like very much. I mean, this shows some good work,

counsel.

(Laughter.)

And grandmother's counsel or   --  

(Laughter.)

  --   grandmother to counsel or mother to

counsel.

The one key issue, though, which I think

  --   well, actually two, but let's stick with one for

the moment. I have a problem with your legal buddies,

but we'll put that aside.

She is smiling because she knows what I'm

talking about.

But the key issue is the issue of access

to personal information   --   having the opportunity for

an eBay subscriber, an eBay user, to know what eBay

knows about that person.

Now, here I'm going to borrow David Brin's

phrase "transparency," and try to turn it around on

him because I think he actually doesn't understand how

transparency operates in an information-intense world.

It's not about everyone suddenly dropping their

clothes all at once and saying, "Hey, we have

openness." It's about having the opportunity to know

what others know about you.

Now, this is a critical concept in privacy

law. The Fair Credit Reporting Act, for example,

which tells credit reporting agencies that you cannot

just toss, you know, people's credit records out

whichever window you choose, says that you also have

an obligation to give people a copy of their credit

report, so that if they're turned for a mortgage they

can look at that information and make sure that it was

accurate, that they were not sort of unjustly treated

in a credit determination because of incorrect

information.

And you can imagine a world where others

hold a great deal of information about you without

telling you how much information you have.

Imagine the banking world, for example, if

you were to deposit your money and the bank never sent

you a monthly statement telling you how much you had.

And so that every time you presented a check someone

called them and said, "Oh, right. You can cash that

one but not this one." I mean, we sort of couldn't

function in such a world.

Much of what privacy tries to do is

establish greater openness and greater transparency

between individuals and the organizations that collect

information about those individuals, and there is

probably no better example of this than the Privacy

Act of 1974, which was the response of Congress to the

increasing automation of federal records.

And at such federal agencies you're

limited in your disclosure, how you use this

information. You also have to give citizens the right

to get access to information that they have   --   that

you have about them, so they can understand what type

of information is being collected and how it's being

used.

Now, here the story gets really

interesting, because in 1974 not only did Congress

pass the Privacy Act, it also strengthened the Freedom

of Information Act. Now, I mean, what's going on

here? Is this schizophrenia? Is this like one group

voting on one day and the other group   --   you know, the

privacy people came in one day saying, "We want

privacy," and the open government people coming in the

next day saying, "We want open government."

Well, I guess it could happen, actually.

But, of course, what it really represents is the joint

interest in protecting the privacy of personal

information and the openness and the accessibility of

public information, which I have always thought are

completely compatible interests that don't involve

this tradeoff that David wrongly puts forward and

says, "You've got to choose."

You know, are you going to have a secret,

veiled, shrouded society? Or are you going to have an

open, bright, interactive society? I think you need

both. I think you need privacy for private life. And

you need openness for public life.

Keep in mind, for example, that Justice

Brandeis, who penned the famous article on the right

to privacy and the right to be let alone, was also the

writer of many important First Amendment opinions and

said, in fact, that sunlight is the most powerful

disinfectant.

He, like the Congress, in 1974, understood

you have to have both the protection of private life

and the openness of public life. So I think that's

the key to understanding the interests of the

individual in this information-rich world. Of course,

we want a lot of openness. We want a lot of

information. We want a lot of accountability.

But we also have to protect private life.

We've done it in the past, and I think we need to

continue to do it.

(Applause.)

SENATOR FRIST: All right. Who's up? Do

any of the panelists want to   --  

MR. BRIN: Well, I do think I need to

respond on one level here.

(Laughter.)

I just   --   I tried my best to parse out how

this Congress was supposedly schizophrenic, that

passed the increase in the Freedom of Information Act,

at the same time allowing people access to their

personal files and the Fair Credit Reporting Act.

In all directions it was an increase in

light. I don't see any dichotomy there.

The credit companies declared that the sky

would fall if people were allowed to see their credit

reports. Now it has become a natural part of the

synergy of a self-correcting system. I see no

conflict there whatsoever. In all four of the bills

that you were describing, Marc, it was an increase in

light flow that resulted in increased accountability.

SENATOR FRIST: Yes, sir?

AUDIENCE MEMBER: Before I ask my

question, given that first slide that Mr. Brin put up,

I thought it's worthwhile to note for the record that

in this very room was the only public meeting of the

Conference Committee on the Telecom Act, where you all

did your work. So a lot of what we're talking about

could have sprung from here, for good or ill.

Ms. Whitman, I have a question for you.

Your privacy policy, despite Marc's objection, seems

to be pretty comprehensive. But the question is:

what do you do for all of those other hundreds of

thousands and thousands of web sites that either don't

have one or have one that's much inferior to yours?

How do you protect everybody else?

MS. WHITMAN: I can tell you what has

happened in the person-to-person option space. It is

very interesting because we compete against Yahoo

auctions, now Amazon auctions, Excite auctions, as

well as Auction Universe.

And as we have stepped up our privacy

policy, as well as have put in safeguards against

misuse of information, and as we do not actually SPAM

our users and direct market to them, it has become,

actually, a competitive advantage for us.

And what you see is that the consumers are

voting with their feet, and we have a very large share

of our market and remain the leader in our space, I

think not in small part because we have actually

demonstrated a competitive advantage on those

dimensions.

And so in many ways within my small world

of competitive option sites, being better on these

things, where you listen to the voice of your

community, then the consumers vote with your feet, and

what we are starting to see is our other competitors

having to do some of the same things in order to

compete with us.

Now, more broadly, beyond our space, I

think in many ways we have got to work with other

internet companies to, you know, try to really share

our point of view on why this is the right thing to

do. And as we form alliances and work with other

folks, I think we are starting to see that.

The question is, you know, do we need to

speed that up? And the legislature needs to put laws

in place to speed that up.

And I would like to see how much the

industry can do on their own. You know, last summer

there was a cry for more leadership in the space, and

I think if you probably look at the top 100 web sites

today, most of them have privacy policies that are

easy to follow and fairly explicit. And 80 percent of

the traffic to the internet now goes to those top 100

web sites. So you've gotten, you know, the vast

majority I think really on a pretty good playing field

at the moment.

PARTICIPANT: Okay. One question here.

Yesterday I received a letter from a bank offering me

a loan. I did not need or want a loan, especially not

at 20.99 percent.

(Laughter.)

Upon calling and asking them how they got

my name and address, they replied that a credit

authority sold it to them. I do not feel that TRW or

others should make a profit from my credit support

history. What do you think? To the panel.

PARTICIPANT: I agree.

(Laughter.)

MR. BRIN: Well, I agree, and one of the

reasons is   --   and it may surprise Marc   --   is that I

dislike anything that's an imbalanced information

flow. I dislike it when any kind of elite or any kind

of power group can have access to information that the

rest of us can't. And this is what I fear is going to

happen more and more with the expansion of privacy

laws.

As Robert Hynlan once said, "The only thing

accomplished by privacy laws is to make the bugs

smaller and to make richer those who have access to

them."

Today, it is illegal to   --   for banks and

credit companies to know about bankruptcies more than

seven years old. They're supposed to simply forget.

It's against the law. Wipe your memory. Well, they

wipe their files officially, and they all get sent

over to the Bahamas. A bank loan officer can go enter

a Bahama cyber haven site, look up bankruptcy records

  --   and it's not me. We're not doing it.

The fact   --   as Dirty Harry said once   --   I

quote him a lot   --   "A man has got to know his

limitations." And we've got to know that some of the

things that we're going to outlaw are going to happen

anyway. But if we keep things open, we'll be able to

look back.

MR. ROTENBERG: Can I respond?

SENATOR FRIST: Marc, go ahead.

MR. ROTENBERG: Yes. David and I have

really gone at it on e-mail, and I was sort of holding

back. But I think it's very important, you know, to

sort of parse that statement, as people like to say.

I mean, there's a reason, you know, for

not taking bad credit information more than seven

years old, or expunging criminal records for young

people, and that is basically that our society

recognizes that when you stigmatize someone you make

it more difficult for them to reenter society, and

particularly, you know, a young person who has had

some difficulty or someone who has had some financial

trouble.

So we make a decision and we say, "This is

a value that we will try to protect." Now, we may not

be able to do it perfectly, and word may leak out that

the fellow did have a run-in, you know, with the law

or something, and that's, you know, recognition that

there are no   --   but there are no perfect solutions.

But David, sort of faced with that kind of

policy challenge, throws up his hands and says, "Oh,

technology makes it impossible to keep those kinds of

secrets. So why even bother?"

And I think the reason that we bother is

because there are things that we   --  

(End of Tape 1, Side A. Beginning of Tape 1, Side B.)

  --   use our institutions and law and our

creativity and technology to try to protect them. And

the fact that it may not be a perfect solution doesn't

mean that we shouldn't pursue it.

MR. BRIN: No. But it means that we

should try other solutions that might accomplish the

same ends without using the worst possible first

resort, and that's secrecy.

For example, we've been talking about

electronic privacy here in just a very narrow context.

But as I mentioned, there's cameras, there's all sorts

of other privacy aspects going on. One is spying by

employers on employees.

Now, we are monkeys, and telling them that

it's not nice is just not going to stop it. Because

if you get a chance to know something and see

something, you'll do it. Anybody will do it.

Now, you can pass all sorts of privacy

laws and send thousands of clerks going around

inspecting every company in America, saying, "You may

know this about your employees, but the law says you

may not know that about your employees," or why don't

we, instead, try something else first and see if that

fails before we have a new OSHA, and try   --   giving

employees the right to sue for reciprocal transparency

in the workplace.

If you want to time my bathroom breaks,

the top 100 officers in the company get their bathroom

breaks timed, too.

Now, I'm not saying that's a panacea, but

why not try that kind of thing first. It's simpler,

and it relies on light rather than secrecy.

SENATOR ROCKEFELLER: We will go back, keeping

going back and forth. We'll try to get between

questions that are written and questions from the

floor. So let's take two questions from the floor.

AUDIENCE MEMBER: Thank you, Senator. I'm

Jim Davidson. In 1974, I was the Senate staff author

of the Privacy Act, the federal Privacy Act.

I'm curious because   --   and I'd be

interested in Meg's comments about the real world

where you have to deal with credit issues. The issue

that we dealt with in 1974 is still there today. It's

the one that Marc identified. It's the lack of equity

in the marketplace.

People come to the marketplace as

individuals with less clout than the institution that

grants favors, whether it's the institution of an

insurance company granting health insurance, or

whether it's the institution of someone granting

credit. And there has been an effort to try to

restore that equity by the use of and regulation of

information.

The biggest single problem is simple

inaccuracy, old information, information from the

wrong source. And all of the transparency, I don't

believe, still deals with giving the individual an

elevated position in the marketplace where they can

have a role that is equal to the dispenser of the

benefit. That has been the problem, and I'm just

wondering if you've faced that in the credit arena

with eBay.

MS. WHITMAN: It's not a perfectly

relevant question to us because, basically, we get

paid by   --   we send an electronic invoice and most of

our customers pay by giving us their credit card or

their check, and the average customer has a $50 bill

a month. So that is not too much an issue.

I'll give you an analogous situation. We

have a feedback profile on eBay, so if you and I do

business with one another I can leave you positive

feedback. And what came up was if I'm not happy, I

don't feel like you paid me on time, I might say, you

know, "This individual doesn't pay on time." And

there was no way for you to respond to that negative

feedback, and the community was getting quite   --   you

know, gee, I can't respond to this. You know, someone

left me a bad score, and I can't do anything.

So our second generation of feedback

actually did two things. One, it separated

transactional-related feedback from regular feedback.

In other words, this is someone I have really done

business with as opposed to someone who saw me from

afar. And then, secondarily, allowed individuals one

response to each negative feedback that they got. So

you couldn't have, you know, an (inaudible) back and

forth.

But it actually solved a lot of the

problems, because if you were able to have one

response, you leveled the playing field, again, in

many ways and neutered a comment where if you had 20

positives and one negative you could make the

community see you for your, you know, true value

versus that one negative comment.

AUDIENCE MEMBER: Thank you.

SENATOR FRIST: Marc or David, a comment on

that?

MR. BRIN: Well, only to say that the Fair

Credit Reporting Act and the Privacy Act of '74 were

marvelous things. I am in favor of anything that

enables the citizens to look at any power center.

One of the problems you see in this whole

issue is a great many people   --   left, right, strong

privacy movement   --   are all across this issue. They

choose their own personal bugaboo as being the center

of power that they fear most.

And one of the things that I see going on

in this town all the time is you have people trained

by three generations of suspicion of authority   --  

propaganda in almost all of our films   --   the most

extensive propaganda campaign ever waged makes Goebbels

look like nothing. But we don't

notice it because it's suspicion of authority in all

of the films.

A good Republican fears suspicion of

authorities by faceless government bureaucrats and

officious academics. A good Democrat fears

accumulations of undue power and authority by

corporations and faceless aristocrats.

We sometimes don't notice that deep inside

we are much more similar to each other than we

realize, and that all power centers deserve

accountability and scrutiny.

SENATOR FRIST: Let's turn to Marc, and then

we'll turn back to the floor.

MR. ROTENBERG: I think the right strategy

for me here is just to reserve my time after David

speaks, so I can have a rejoinder.

I don't enjoy these labels. You know,

privacy of the left, privacy of the right. You know,

my organization and my colleagues here, you know, we

led the campaign against the clipper encryption scheme

because we thought it was wrong for government to

impose a technique of routinized surveillance that

seemed inconsistent with the Fourth Amendment and the

statutory safeguards well established in this country.

I guess that's privacy on the right.

And we have also led campaigns against

Intel and Lotus for marketplace, and most recently

Microsoft, because of certain architectural changes in

the internet or development of computer chips because

of the implications for personal privacy, which I

guess is privacy on the left.

Maybe I'm schizophrenic. I don't know.

But I think what it really comes down to is the sense

that privacy is an important human value. It is not

generally the case that it's directed against

particular institutions, as David suggests. It's,

rather, something that people share as a common value

and they try to find ways to protect through

government institutions.

So instead of sort of dividing us in this

fashion, David, I think you should recognize that we

in the United States have a collective interest in

protecting privacy, and we will decide, based on who

is violating privacy, what action should be taken.

SENATOR ROCKEFELLER: Oh. Let me   --   oh, you said

two, so you go ahead, sir.

AUDIENCE MEMBER: Thank you. Well, I had

a question for Meg and Marc regarding the role of a

legislative solution. And I'll preface it by pointing

out a recent AARP poll, which indicated that 92

percent of the AARP members would object if a business

they   --   if a company they did business with sold

information about them to another company.

The same survey found   --   asked them about

the statement, "Do you agree with the statement,

'Current federal and state laws are strong enough to

prepare   --   to protect your personal privacy from

businesses that collect information about consumers?'"

Seventy-eight percent disagreed with that statement.

I think the issue for many Americans is

disclosure by companies of what they are doing with

the information they are collecting and whether

consumers are given the opportunity to control the

dissemination, the sale or rental of that information.

eBay certainly seems like a model in many ways, but

there are many companies out there that are not.

I don't know whether you know whether your

bank sells your CD maturity dates, your account

balance, to a stockbroker or an insurance company.

Whether they sell the names of the people you write

checks to to a marketing firm or some other firm.

Most Americans don't. There is no disclosure of that.

And even if they did know, there is no

opportunity to choose, to say, "Well, I'd rather not."

If they say, "Fine, I'd like disclosure, I'd like it

to be shared," that's great. But there's no

opportunity for that   --   for them to have input into

what happens to their information when it's used for

purposes different for which the information has been

given.

So at what point is it necessary for the

legislature to vindicate the will of the people, as

the polls indicate and as sort of anecdotal

experiences indicate, with the Intel chip, with CVS

giant, with AOL, where there is a large public outcry

when serendipitously people find out that their

information is being sold.

MS. WHITMAN: You go first.

MR. ROTENBERG: Well, there is always this

tendency to characterize privacy advocates as favoring

top-down centralized, bureaucratic, cumbersome,

expensive, inefficient regulation. And my view is

that in a lot of these areas what is really needed is

some simple baseline that establishes and enforces

fair information practices about the collection and

use of personal data.

There are above the baseline a tremendous

number of innovative things that companies can do, and

that market forces can bring to bear, to protect

privacy. And by and large, as I said earlier, I

actually think a lot of what's happening on eBay is

neat.

But I think you need a baseline, and so my

answer to your question is the concern you see in the

AARP poll and other polls is the absence of the

privacy safety net. People just don't know what's

going to happen to their information when they turn it

over to someone else.

MS. WHITMAN: You know, I know exactly

what you're talking about. And as a company, we have

taken the opposite stance there. I think it's   --   you

know, as a consumer probably more than anything else,

I would favor, you know, disclosure and an opt-in

mechanism. Okay? You know, so if I'm an AARP member

and I want to have offers come my way for life

insurance or health insurance, then that's great.

I think the problem is that, you know,

there are so many, many industries that it is   --   and

everyone has a different way of collecting information

and a different way of communicating with their

constituencies. If something was to be done, it has

to be done on a federal preemptive basis, because as

a business person we cannot cope with 50 states each

having different privacy policies and each having

different disclosure things.

So if something has got to be done, it's

got to be done on a centralized level or it will

create true hardship for businesses.

I guess I would say, you know, I actually

put a lot of stock in consumers. I think consumers

are pretty smart. And, you know, whoever had the

offer of the 20.99 percent mortgage rate   --   and I

don't think they probably have a lot of takers there.

And while it is annoying, you know, at

some point you've got to give the consumers credit and

say, you know, "I'm just not going to respond to those

offers that are not interesting to me." And yes, you

know, they probably have some information about me,

but if you don't respond to those things they won't

keep on doing it. So I sort of come back to free

market in some ways on that.

MR. BRIN: By the way, polls ask leading

questions. You all know that. The same people are

using their supermarket scanner cards like mad and

have answered other polls with other kinds of leading

questions, indicating that they are much more

interested in getting a good deal and primarily not

letting anybody get a chance to harm them than whether

or not people know what color   --   what salad dressing

they're buying.

The main thing is that people don't want

to be harmed. Now, how many of you out there   --   let's

take a little poll of our own   --   would care to bet me

a $100 bill that I couldn't, by the end of the day,

find out your Social Security Number? Anybody want to

raise your hand?

The Social Security Number is an example

of a major misunderstanding of what privacy is all

about and what can harm people. It's a name. It's

not a password. And the only reason why people are

afraid of it being used is it's simply a national name

that's a little less ambiguous than John Q. Smith and

could save you from getting the wrong insulin

injection one day in a hospital, or having your wages

garnished because another John Q. Smith is a deadbeat.

The only reason   --  

MR. ROTENBERG: It is a password.

MR. BRIN:   --   is because it's being

used   --  

MR. ROTENBERG: Call your bank.

MR. BRIN:   --   as a password. That's the

reason. It's being used lazily by banks. They are

using a name as a password. And I can't get into that

in detail right now. But so many of these things are

based upon simple misunderstandings.

MR. ROTENBERG: I think the question deals

with disclosure and knowing where the information is

going. You're raising other issues.

MR. BRIN: But do you honestly believe

that any of these things, like your name or your

Social Security Number, are not going to be out there?

They're not out there now? That some elites don't

already have all of this information?

MR. ROTENBERG: Well, since you asked the

question, if I may respond. With respect to your

information, would you care to disclose to this group

here, because there may be people with relatives who

do stockbrokerage or insurance, your personal

financial information? Your medical information, in

case there is   --  

MR. BRIN: Very good question. Very good

question. And my answer is the answer that every

citizen has a right to make, and that is: I'll show

you mine if you'll show me yours.

(Laughter.)

And I   --  

MR. ROTENBERG: I was taking a different

position than you are.

MR. BRIN:   --  I am not against   --   I am not

against privacy. I am not against any of the privacy

protections I see. I applaud what Meg shows, and I

applaud many of the efforts that Marc is doing, even

though he thinks that I don't.

(Laughter.)

The fact is that in the long run you have

to understand the   --   in the long run that this stuff

is going to get out there. We've got to plan for more

than just next year.

SENATOR ROCKEFELLER: Bill Frist and I have to

disclose it to you, but we don't like it. We just

have to do it by law.

(Laughter.)

AUDIENCE MEMBER: Drew Clark with National

Journal’s Technology Daily. Marc mentioned about

NYMs and reputations arising in anonymous identities.

I'm just curious   --   with the increasing use of

technologies to preserve privacy, what   --   David and

Meg, what you think about the growing use of

technology to preserve privacy. In particular, you

know, the P3P standard, for instance   --   is that a

privacy protection? Do you think that it makes sense?

Is there a market, so to speak, for people betting

their money on products and services that will offer

them greater privacy?

MS. WHITMAN: Boy, that's a pretty broad

question, a difficult one to answer. I guess I would

say that I would come back to the consumer. You know,

when I look at companies for eBay to invest in, or me

personally to invest in, I look to try to understand

the magnitude of the consumer problem that needs to be

solved.

And we have a statement around eBay, "Do

not create a solution for a problem that actually

doesn't exist in any major magnitude," because you

will end up creating a complexity of the system that

makes it very difficult for individuals to use.

So I would say I think that if there are

a simple   --   if there is a simple problem, where there

is a relatively simple and understandable solution, I

think there is   --   I think technology can solve some of

those issues. But I do think that, you know, often we

  --   we create problems that don't actually need to be

solved on any major scale, and I guess that is sort of

the broad answer to sort of a broad question.

MR. BRIN: The quick answer is that I am

friends with a lot of the people   --   Whitfield Diffy

(phonetic) and Phil Zimmermann, who are doing a lot of

this pretty good privacy stuff. In the short term,

fine, it'll work very well. In the long term, it's

utterly doomed. Anybody who relies   --   who says

anything with an encryption standard today that he

will be ashamed of seeing in The New York Times three

years or five years from now is a fool.

SENATOR FRIST: Marc?

(Laughter.)

PARTICIPANT: David There is some money

in this for the two of us, if we can just figure out

how to do it.

(Laughter.)

SENATOR ROCKEFELLER: Not from this group, there

isn't.

(Laughter.)

MR. ROTENBERG: I mean, I just   --   you

know, it's extraordinary to me. I mean, we're facing

big issues on the Internet today. For example,

payment systems. Now, you can design payment systems

that collect a great deal of information about

individuals, or you can design payment systems that

protect identity absolutely, electronic cash.

Now, if this sounds like science fiction

to you, I carry around with me telephone cards that I

collect and that people send me and no doubt someday

I'll be auctioning on eBay.

(Laughter.)

Now, you don't see very many telephone

cards in the United States because most of us charge

our   --   most of us charge our calls using a credit card

or a calling card number. But these are widespread in

Europe and Asia and other parts of the world, and they

have this, you know, wonderful quality, which is that

you get the service you want, the telephone company

gets paid for providing the service, and there is no

privacy issue, because no personal identifiable

information is collected.

And in the design of telephone systems,

you make big choices in architecture about collection

and use of personal data. Those things, David, stay

with us. And the choices that we make today   --  

payment systems on the internet, identification

schemes, authentication, user ID   --   will have a long

and profound impact on the privacy we have in the

future.

Will it be perfect in one direction or

another? Of course not. I mean, no human enterprise

is perfect. But to say that just because it can't

perfectly protect identity, it's not longer a serious

issue, is just completely walking away from the

interesting stuff we have to think about.

MR. BRIN: No. It will protect some

people's privacy. It will protect the privacy of the

elites. Privacy laws will make it possible for us to

be blinded looking at the mighty. They will not make

it possible for us to prevent the mighty from looking

at us.

As soon as they got one elite   --   one elite

was stymied by Kevin Mitnick, the governmental elite.

They went to the intellectual cyber elite, Shema Mora

(phonetic)   --   my neighbor Shema Mora, the most

charismatic man in America   --   and he found the calling

card of Kevin Mitnick.

SENATOR FRIST: Okay. We're going to keep

moving. All right.

(Laughter.)

We're going to shift just a little bit.

Something that 80-   --   100 million Americans are doing

today and it has to do with the tax arena.

AUDIENCE MEMBER: This being

April 15th, my question is on taxes. Concurrent with

the privacy debate, is there a debate over whether and

how to tax internet commerce?

It seems to me that these two issues

directly intersect because if a government wants to

tax you, it needs to find you.

(Laughter.)

Very good.

Any comments from the panel on the privacy

implications of decisions made in the electronic

commerce tax arena?

(Laughter.)

MS. WHITMAN: Hand that one to me. Well,

I think ultimately the Internet will be taxed. as much

as we enjoy the three-year moratorium that is on

Internet transactions. And, again, it does not affect

eBay so much. It does affect our users, and,

certainly, a company like an Amazon.

But I think ultimately that is a reality

because as commerce moves from land-based to the

Internet, that will happen.

It's interesting because we do not feel on

eBay that anonymity is actually part of what's going

on here. I mean, people   --   their e-mail addresses or

their user IDs   --   I mean, it's very easy to find

another individual on eBay. It's very easy to

correspond with another individual on eBay. If you

come from an anonymous e-mail domain, like a hot mail

or a Yahoo, we actually require a credit card when you

register.

So we know who our top sellers are, and

they are actually quite happy to have us know who they

are. And I suspect that ultimately we may be in a

position to give that information to someone who would

want to understand what the magnitude of the taxes are

that are due.

I'll tell you an interesting story. We

are expanding to Europe right now, and we are going to

be required to collect the value   --   the VAT tax, if

someone in the U.K. is buying from someone else in the

U.K., or buying from someone in France. And we have

had to engineer the system, actually, to be able to be

able to collect that VAT tax and remit it to the

governments of Europe.

So I am not particularly scared about

that. I don't think it will harm eBay's business. I

think, you know, after three years people will be

understanding that if they are making money on eBay

selling to people within their states that that is

going to be a requirement   --   to pay taxes. So I am

probably not as rabid on that as a lot of Internet

executives.

SENATOR ROCKEFELLER: You're right about that.

(Laughter.)

SENATOR FRIST: Meg, this is also to you.

Do you restrict   --   this is from the audience   --   legal

buddies in their use of the information that you

share? There are several questions here. Are they

limited to use for protection of their intellectual

property? The second question, what happens to your

privacy policy if your company is sold? Is there

anything in the policy that states that you will

require any sale or merger party to abide by your

policy? Those are two of the three questions.

MS. WHITMAN: Okay. What was the first

question again?

SENATOR FRIST: Legal buddies.

MS. WHITMAN: Oh, legal buddies, right.

Okay. Legal buddies today   --   let me just take two

seconds to explain what it is. If you are Tommy

Hilfiger or Donna Karen or Microsoft, you want to make

sure that there are not infringing or unlicensed

merchandise for sale on eBay. And we have a program

with them that they look at the options in their

category and ask us to end those auctions if they deem

them to be illegal or unlicensed.

And then they have the right to ask us for

information about that seller, which in certain

circumstances, if fraudulent activity can be, you

know, reasonably well documented, then we will give

that information to law enforcement on their behalf.

On the second question on the privacy

policy, there is not anything in the privacy policy

right now that relates to if our company is sold. I

think, you know, eBay is still a relatively closely

held company. Only 20 percent of the company is in

the publicly held markets.

So I think, you know, if we were to sell

the company, at a very minimum we would do an update

to all of our users that says, "The company is going

to be sold. Here is the change in the privacy policy

that is going to be introduced," if there was a

policy, and give people a chance to opt out. So

that's our thinking on that at the moment.

PARTICIPANT: (Inaudible.)

MS. WHITMAN: Those that are already in

the database.

AUDIENCE MEMBER: May I? I'd like to ask,

first, Meg Whitman, half of all of the comments in

town about electronic commerce and stockbroking, and

whatever, relate to fraud on the internet. Would you

tell me if that's a problem for you? And why don't

you think about that for a moment?

Your situation and not divulging

information, selling it, trading it for free with

others is positively saintly. But my experience is

every time I ask a question on the internet of some

commercial enterprise, or even a non-commercial

enterprise that's linked to a commercial enterprise,

a little thing pops up that says, "Do you want us to

tell other people that you asked?"

What am I supposed to do, Marc? Am I

going to get a   --   I already get a mailbox full of

catalogs because I once ordered something that didn't

fit.

(Laughter.)

Is the internet going to do this to me?

What can I do about it?

MS. WHITMAN: Go ahead.

MR. ROTENBERG: Not much.

(Laughter.)

I mean, it's very interesting. I caught

Meg's comment a moment ago when she said if there is

to be privacy legislation it should be federal,

because imagine a business having to deal with 50

different state policies. And I thought to myself,

imagine a consumer having to deal with 5,000 different

web site privacy policies.

I mean, the problem that people face

online today is that you have to be like a speed

reader of great stamina to make it through all of the

privacy policies of every web site that you visit,

which is why I think we need some baseline law to

limit the collection and use of personal data.

I don't think getting an extra catalog

through your mailbox is the worst thing that can

happen to you. But I do think over time you do lose

control over your information, and I think that can be

controlled.

MR. BRIN: But you've just raised the big

point. How much harm does the catalog do you? We, in

this room   --   you   --   should be thinking about not so

much whether or not people answer a public opinion

poll over whether or not they would kind of not like

other people to know their e-mail address, but as to

whether or not we can minimize the amount of real harm

done to real people.

And in the future, they are using the

supermarket scanners, which (inaudible) addressing you

by is going to be just like what color sweater you

wore today. You're going to just have to live with

the fact that that's going to be known.

We can protect what really counts and stop

you from being really hurt. We can't equip everyone

with shutters.

MR. ROTENBERG: But, David, I mean, you say

these things as if they're predetermined. You know,

five years ago we launched a campaign against the

national security agency who was three guys and a web

site. And we got 50,000 people on the internet to

join with us, and eventually the technical community,

and even people within the Defense Department said,

"Actually, you guys were right. This wasn't such a

good idea." I mean, you keep telling us about a

future as if it's predetermined.

MR. BRIN: I never said that.

MR. ROTENBERG: You just said a moment ago.

MR. BRIN: You didn't read my book.

(Laughter.)

I never said the future was predetermined.

I said you've got to fight the fights that make some

sense, that prevent our citizens from being   --  

experiencing real harm.

MR. ROTENBERG: But fighting for the right

of privacy today, at the end of the 20th century, to

me, makes some sense.

MR. BRIN: And real privacy. Within the

curtilage that Brandeis spoke about   --   your bedroom.

Do you know that they are developing small cameras for

infantry units that will do for $1,000 for an infantry

sergeant what the Predator does for a general of a

division right now? They will cost $1,000 and they

can bzzzz, check what's behind that bush over there.

How long before they show up in Radio

Shack, and then what will we be arguing about?

Whether you're curtilage stops at your fence? Can you

sunbathe in the backyard? What about when they become

little gnat-cams and can fly in through your bedroom

window?

MR. ROTENBERG: I'll be there with a

baseball bat.

(Laughter.)

What's your point?

MR. ROTENBERG: (Inaudible) an article about

those little cameras?

(Laughter.)

SENATOR FRIST: First of all, just   --   we

have about another seven minutes or so that we're

going to continue going.

AUDIENCE MEMBER: (Inaudible.)

SENATOR FRIST: Okay. We'll come to fraud

and   --  

PARTICIPANT: Yes. He wants to talk   --  

SENATOR FRIST: We'll come to fraud.

Let me just say, while I have the

microphone, these little green evaluation forms   --  

yeah, they're green today. Green today. The little

evaluation forms   --   just begin to take them out. You

can leave them there or hand them on the way out as

you   --   as you go.

In addition, I'll announce our other

topics in the future. But in the back   --   if you wish

to register, in the back of your packet is a large

sheet that you can register for one of our next topics

as well.

Now, we're going to turn to the microphone

in a second, but, Meg, you want to comment on fraud.

MS. WHITMAN: Yes. Let me just spend a

minute on fraud.

eBay, as I said, is an open and honest

marketplace and in nine months has grown from a city

the size of a small town   --   you know, a small town of

88,000 to the size of San Francisco and San Jose

together in about nine months. So yes, there is a

small amount of problems, surprisingly small, and I

think it's largely because the feedback profile has

worked so well in being a governor of the system.

But anywhere between 20 and 30

transactions for every million transactions result in

some kind of reported case of fraud to eBay. And we

have taken steps over the last five or six months that

augment the feedback profile. And those are always

not perfectly aligned with more privacy, and I will

give you a sense of one of them, which is   --   will

probably be some debate for this room.

One of the optional programs that we have

introduced is to use eBay user verification, so that

you can provide incremental information about yourself

to a third party, in this case Equifax. That would be

your Social Security Number, driver's license, and

address. If those all line up, according to Equifax,

they will give you an icon on the site that says,

"Verified eBay user."

And while it is an entirely optional

program, what we suspect will happen is our top

sellers will adopt that almost immediately, because

they are, in fact, who they say they are. They are

100 percent honest. And that will create a necessity

for every seller on the site, in many ways, to be an

eBay verified user, if they want to their fair share

of the business.

And we think this is a good thing because

it really does create a level of safety on the site,

but those individuals   --   they haven't given that

information to eBay. They've given it to Equifax.

Equifax verifies it and then lets the information go.

But it is taking the next level, and that was a

tradeoff we made between privacy and safety in the

community.

SENATOR FRIST: We still have several

questions. And next we have a question to the floor.

Let me just remind people what our next

forum will be on. It's entitled "High Speed

Communications Access: Who Will Control the Last

Mile?" That's going to be May 19th in SC-5, from

12:15 to 2:00. We'll have a great panel there. FCC

Chairman William KEnnard, Chief Technical Officer of

At-Home Network, Milo Medin, and Bell South CEO

Duane Ackermann all will join to discuss consumer

access to broadband Internet and telecommunication

services. Steve Case, Chairman and CEO of America

Online, has also been invited, and we hope that he

will be able to join as well.

Finally, back to the microphone. Thank

you for your patience.

AUDIENCE MEMBER: Okay. No. Thank you.

This has been a terrific presentation.

David, it strikes me that you and Marc

share a concern about privacy that is very deeply

held. And I think a good example of it is somebody

said, "Tell us your personal information," and you

said "no." And I agree with that.

And then, in the article you circulated,

the cameras are coming, get used to it, you reacted

the way I assume everybody in this room would react

when they weren't choosing to do this themselves.

That is, to be seen naked by a camera publicly. And

you said, "These X-ray specs may restore safety, but

at what cost?"

And you say, "Will citizens demand

separate aisles for men and women? Should savvy

investors look at companies making metallized

undergarments?" And the point I'm getting at is you

want your personal privacy. You suggest these

mechanical ways to do it.

But for some reason that I don't

understand you are resigned to a fatalistic point, it

seems to me, that there is no high tech remedy to

ensure the individual's right to choose what to

disclose, nor is there any legislative or voluntary

policy/practice.

And though you speak of the general

openness that has served us well, your entire

predicate for concern is that openness that is without

any either publicly agreed community notions, either

voluntarily arrived at or legally arrived at, is

insufficient to protect our individual privacy.

That's my synthesis of your presentation.

MR. BRIN: You raise many very important

issues that are very difficult to deal with in a 10-

minute format. One is the robustness of the

civilization we're building. If you build a

civilization that is built based upon distrust and

secrecy and protecting yourself by the maintenance of

secrecy, then you are going to have to be able to

trust your technology that was designed by someo