Return on Data: When governments fail to make surveillance useful

Posted on Oct 11, 2020

There is this common refrain about how companies have data about you and could do bad things. Yet governments often pass surveillance laws that are much worse, and by definition, you can’t “vote with your wallet” for them. So in a world where I’m already giving data to third parties, it is useful to ask what I get in return.

If we are talking about corporations, we get ads! Yes, but we also get:

  1. Google gives me a good search and email experience. It can even partially write my emails for me! If I were in the Android world, it would do all kinds of more useful things. Even YouTube does a decent job of recommending interesting things.

  2. Apple doesn’t have a lot of data, but I do choose to give it my emergency contact and health information, so if something happens, a passerby knows who to contact. The keyboard does auto-completion as it learns the kind of things I tend to type. In addition, I’m sure Apple is cataloging general iOS usage and using that to guide future developments.

  3. Services like Mint and Personal Capital let me spot trends in my spending and net worth.

  4. Companies like LinkedIn not only let recruiters hound you, but they let you quickly apply to jobs by taking all the data you provided and passing it to the company, instead of having to upload a resume or type your career history out every time.

  5. TurboTax fills up a bunch of redundant information on my taxes from the previous year.

  6. Facebook, well… I’m having a hard time here, but it does occasionally show me some useful stuff.

  7. Credit card companies, grocery stores, restaurants and other places gather all sorts of data to show me relevant ads.

This is my “Return on Data” (RoD).

On the other hand, the data I give to governments generally ends up being a waste of effort and enables power-hungry politicians to do nefarious things without needing to be accountable. At the same time it gives me nothing in return1. Not only is it impossible to avoid giving data to governments (border crossings, visa applications, income records), not giving that data usually comes with severe legal penalties. Yet governments do a downright awful job of doing something useful for me with that data. Instead they just use it to catch a few criminals, harass a few people at borders and generally make life miserable. I jest a bit. Sure, it helps to keep terrorists from getting too bold, and think of all the children…

The reality is, apart from some potentially questionable, low level benefits, my RoD here is zero. Even providing that data is a frustrating experience. Let’s walk through a few examples. I’m going to pick some highly privileged, almost-qualifies-as-a-first-world-problem issues, but my point stands.

Taxes

This one is easy because we can blame lobbyists and move on! This is also a fairly American problem. Basically, for most employees, the IRS already knows how much they make and the taxes they owe. But instead of sending me a pre-filled form and giving me an option to just say “Yes, this looks right, take (or give back) my money!”, which would probably work for 90% of cases, they make me pay TurboTax $50/year. RoD: negative.

Visas

This is the thing I’m most passionate about. Due to being from a third-world country (or is it because we took all the jobs?), I’m basically not allowed to just show up at most places. I need to go through a bureaucratic process most Americans and Europeans have no idea about. Getting a visa.

For the US, the first step is this form called a DS-160. DS probably stands for Data Storage, so it is mind-boggling that they can’t retrieve that data later (I’m not going to go into the other story, about how, recently, that website would only work on Safari…). Every time I, and millions of other immigrants and visitors, want to renew my visa, I need to fill this out. After asking for your name and date of birth and the place where your 52nd cousin was born, it will ask you to fill in the entry and exit dates of every previous time you visited the US in the last 5 years. This is a good place to also rant how they don’t let you say “I’m in the US right now!”

You know where I get this information from? From the I-94 entry look-up provided by Customs and Border Patrol (CBP)! I play the part of glorified data-entry assistant for information the government already has about me. Copy-pasting it from one place to the other. God forbid I make a typo, because they’ll be dragging my ass to prison for perjury in seconds! The DS-160 is run by the State Department, the I-94 by the DHS, so let’s chalk this one up to inter-agency rivalry. Still, what a waste of 30 minutes. RoD: Negative.

The Europeans thought they should do one better. First, they think they are so awesome that uncultured people like me only deserve to visit them occasionally and with a lot of planning. So they will give me a ridiculous “this visa expires 15 days after you said your return flights were” every time! Even though I’ve been to the Schengen Area at least 10 times now. Every time, each country asks me to list every EU country I’ve visited in the last five years. You guys can have no-fee, instant, bank-transfers, and you can’t share this information between yourselves! Sometimes I think governments just do this so they can just harass the plebs and get a laugh out of it.

RoD: negative. Plus I lose time and money on the application (sometimes having to fly to a consulate!) every time I want to go to Europe. At least be like the Canadians and the Americans and the Japanese and give us poor colonized peoples 10-year visas so I only need to play this game every decade.

Regardless of how much money visitors and immigrants bring to a country, they don’t have the power to vote, so let’s not bother doing more than the bare minimum to help them. But we will roll out the 90-day ESTA red-carpet for anyone who hit the genetic lottery and is getting lucky already!

COVID-19

While the Taiwanese government and the Korean government decided to use the data they were collecting to perform quarantining and contact tracing, western goverments didn’t. Then they turned their failure into a success by yelling “FREEDOM & DEMOCRACY!” and got their constituents to think they were great.

“We care about privacy!”, “Apple and Google are working on a Bluetooth-only, privacy preserving solution” are all just papering over the fact that governments already have all this surveillance data that they won’t use for truly useful things! Instead, they will use it to arrest protestors or whistleblowers. The hypocrisy and its acceptance by the public is despicable.

RoD: Negative

What’s going on?

Are they worried about data breaches? That I could enter someone’s date of birth and passport number and see where they traveled recently? These days most people already tell you where they are on Instagram! Companies and governments routinely experience security breaches that leak millions of peoples data and don’t get more than a slap on the wrist for it (see Equifax). Might as well make it useful while they have at it.

Are they worried about lobbyists? What is the lobby for the DS-160 form? Surely one of the DHS' quarterly goals is not to beat their previous quarters page views for I-94 queries!

There are no incentives.

Companies have an incentive because people won’t give data if the products don’t provide value. Companies also have an incentive to make this data collection as low friction as possible, because losing prospective customers is a growth problem, while solving occasional fraud is a line-item. Notice how, even for credit verification, they will ask you a multiple choice question about your previous addresses instead of making you fill in your last 5 addresses along with the ZIP code (Hmm… I wonder if Google is lobbying against this, so that they can show me a few more ads every time I search to find out what the ZIP code was.)

In some sense, governments mostly collect data because they can. They want to enforce various laws and the regulations to implement such laws require them to collect some data. The usefulness of that data expires as soon as the relevant check-mark has been checked, so that when someone comes asking, they can say they complied with regulation. There is no incentive to make that data useful to the person. There is a large lobby of military contractors who will push to develop all kinds of cross-reference and search systems that let them make money. This incentivizes storing that data.

Since I’m not a citizen, they are free to store this data for however long they like and use it for facial recognition and criminal databases and giving it to any country that voices suspicion. But there is no lobby for building the system necessary to fill this form for me on my next interaction. Every individual wallows in their own pain, not a collective pain with an organization and money behind it. In addition, they know that I (and others) have a job and a life, so I’ll just deal with this nightmare for the 30 minutes a year and move on. But collectively that is ~500 years of time lost per year2 just on the DS-160!

Fixing something like this is not a difficult technical challenge. It just needs a re-alignment of incentives.

A TurboTax for bureaucracy?

Public-private partnerships or “we suck because lobbyists” don’t work out well in the end. Certainly in India there is a vast network of middle-men who will deal with bureaucracy for a fee. You may not like their methods, but they sure get stuff done! That only works because of the physical presence and lack of coordination that prevents oligopolies and monopolies. Unfortunately, an online-only kind of workflow tends to incentivize monopolies and we would just end up with a TurboTax like situation once again.

Conclusion

A lot of usability disasters happen because the original laws and regulatory apparatus don’t clearly call out “make this usable and easy” as one of the criteria. I really want to call out Citizenship and Immigration Services of Canada (CIC) here. Their website is a great example of things done right. They want immigrants and tourists and so the incentives are aligned to make it easy for qualified immigrants. The documentation is top-notch and they have all kinds of useful tools to determine eligibility before even creating a profile. Creating a profile is simple and they ask a relatively minimal amount of information in the initial application, understanding that the amount of work you have to do should roughly correspond with how much you are going to get in return. So they can grill you about specifics when you are about to enter the country, but they can stick with “tell us what educational qualifications you have” before that.

I think the reason CIC does well is that they are in competition with their next-door-neighbour, which has an outsized economic influence that attracts people. To get those people to come to Canada instead, they need to go all out on making things easy. That is a really strong incentive. We need to identify similar incentives for all government functions. Product managers looking to change the world? Start here!


  1. Please provide a compelling justification that mass surveillance as practiced by the Five Eyes has had meaningful security benefits to a significant fraction of the world population. ↩︎

  2. The State Department Visa Office report for 2019 states that ~8.7 million visas were issued that year. This figure assumes each person takes 30 minutes to fill the form. ↩︎