Coalition Building: Lessons in Seizing Opportunities

Digital privacy is often understood within the broader rubric of digital rights advocacy. Digital rights encompass everything from freedom of speech online and access to an open internet, to limiting government surveillance, ending human rights abuses taking place in the largely unregulated global digital ecosystem, and of course, protecting the fundamental right to privacy. Coalition building is an essential aspect of work in this space, as advocacy organizations are regularly fighting a tech industry that is better funded, more powerful, and perfectly aligned with the neoliberal ideology guiding US governance principles. Primarily non-partisan, digital rights advocates work with a host of different players in a delicate balancing act, including political officials, private companies, and consumers. The largest and most visible organizations in this “loose coalition,” as several of our interviewees called it—the ACLU, Consumers Union, Electronic Frontier Foundation (EFF), Electronic Privacy Information Center (EPIC), Public Knowledge, and the Center for Democracy & Technology (CDT)—are also joined by others of varying sizes and areas of emphasis, including Free Press, the National Hispanic Media Coalition (NHMC), Media Alliance, Access Now, Common Cause, the Center for Privacy and Technology at Georgetown Law, New America’s Open Technology Institute (OTI), and the Consumer Federation of America.

These organizations have been able to build a “loose coalition” related to digital privacy because their stated missions align around several key issues—the importance of an open internet, equitable access to digital technology, rights of free speech and privacy, and human rights in digital contexts. The OTI, for instance, promotes “universal access to communications technologies that are both open and secure … .” Public Knowledge works to advance “freedom of expression, an open internet, and access to affordable communications tools and creative works.” And the EFF champions “user privacy, free expression, and innovation through impact litigation, policy analysis, grassroots activism, and technology development.” Other organizations describe their missions in similar ways, but each has its own unique approach to framing and fighting for public interests in the arena of privacy and the attendant landscapes of surveillance, human rights, internet governance and access, free expression, and corporate accountability, as indicated in Figure 1.

Figure 1: Mission statement excerpts of digital rights advocacy organizations, 2019–2020.

These excerpts were pulled from the organizations’ websites.

The collaboration of coalition members, as several of our interviewees explained, allows for more tactical and efficient advocacy as opposed to dozens of specialized silos working at cross-purposes. Together, these groups share information, coordinate communication and lobbying strategies, and even develop joint recommendations, such as the 2018 Public Interest Privacy Legislation Principles. These Principles were released by thirty-four organizations and urged Congress to pass privacy legislation that “ensures fairness, prevents discrimination, advances equal opportunity, protects free expression, and facilitates trust between the public and companies that collect their personal data.”³⁴ This document was based on polling coalition members on fifty-three different privacy positions and culling the results to focus on broad areas of consensus among the group’s members. This intervention seems to have had some influence as Democratic members of Congress introduced a digital privacy bill in November 2019.

Still, due to the wide range of constituencies, issues, and diverse ideological positions within the coalition, consensus is not always possible. Often, coalition partners have different opinions on an issue or different emphases. Some organizations focus on US Constitutional protections (ACLU), whereas others deploy international human rights law (Access Now). Some value the libertarian ethos of the internet (EFF), whereas others view policy and legislation as the best way forward (Public Knowledge). Many try to influence corporate practices (OTI, CDT) and/or develop technology-based solutions and apps (Glianet; OTI; Access Now). These differences have created an interesting dynamic wherein most organizations see themselves both as independent, working toward their own stated mission, and as part of a larger community, pushing a broader agenda. They never undermine one another, but they are forced to juggle competing interests when working together. As one advocate put it,

we will take advantage of any means of furthering an advocacy objective … continuing to have conversations with relevant privacy officers and the administration to further dialogue on something until we see an opportunity to get something passed …

Our interviewees also noted that they actually do a surprising amount of work with companies engaging in data collection activities themselves, and sometimes advocacy interests are even aligned with those companies. For example, tech companies do not want to see backdoor encryption bills passed; they want to be able to tell their consumers that their data is protected. According to one advocate, “That’s just the straight up business interest,” and the advocacy community takes advantage of such strategic affinities to move their agendas forward, particularly in challenging political times.

Further complicating the work of coalition building, the privacy and surveillance landscape is extremely complex and nuanced. As Harold Feld, Senior Vice President of Public Knowledge, remarked, “the problems and shape of [this landscape] change over time, particularly with regard to evolving technologies and the way that people think about it.” While many in the general public might be concerned about one issue (Facebook and data harvesting, for example), the privacy advocacy community is concerned with the aggregate of threats, relevant policies, and critical vulnerabilities in the global digital ecosystem. This has created a rather daunting agenda for a relatively small but undeniably mighty coalition.

This expansive agenda has led the coalition to be involved with lobbying related to everything from the enhanced surveillance powers in the US PATRIOT Act and the National Security Agency’s (NSA) PRISM program’s spying on US citizens (with the aid of Big Tech companies as Edward Snowden revealed) to the Broadband Consumer Privacy Rules designed to protect consumer data created by the Federal Communications Commission (FCC) in 2016.³⁵ While these rules were quickly decimated by Congress in 2017, just three months into the Trump administration, it was an important moment for privacy advocates. According to Feld, this was when it became clear to those who had been working on digital privacy issues in coordination with the Obama FCC that

FCC privacy was now a dead end and, therefore, to the extent that we were still going to pursue privacy, it wouldn’t just be within the context of the FCC; it had to be in a more broader coalition effort that looked to legislation.

Privacy advocates not only interface and work with one another, but also must navigate dynamically changing political, economic, and technological conditions. Media industry scholars often default to the role of neoliberalism as an explanation for advocates’ shift away from pressuring the FCC and Congress and toward corporate engagement, yet our interviews revealed that such an explanation is too facile. Advocates engage in a complex calculus, constantly researching the political climate, industrial practices, and digital rights concerns and assessing what is possible. Sometimes advocates’ agendas align incidentally with the companies they scrutinize, and a certain amount of progress can be made. Sometimes congressional leaders introduce bills that integrate principles they have elaborated in policy recommendations. And sometimes they bang their heads against the wall in conditions of regulatory inertia. Suffice it to say, their coalition building does not always lead to major reforms, but it has kept digital rights on the regulatory radar.

Agenda Formulation: Juggling the Proactive and Reactive

It is one thing to engage in the work of forming and sustaining coalitions. It is quite another to formulate shared digital privacy agendas. The extremely broad purview of the coalition makes it challenging to develop a proactive agenda and create buy-in among coalition members for maximum effectiveness and efficiency. Each group brings different skill sets, areas of focus, and expertise. Some like the ACLU, EFF, Public Knowledge, and CDT specialize in legislative drafting and policy recommendations via amicus briefs and lobbying Congress and regulatory agencies. Members of these groups also write and distribute white papers, blogs, and other materials such as advocacy and activist training documents, consumer education tools, technologies for enhanced privacy such as browser extensions, and online courses designed to engage and inform the public about digital rights. These public-facing tactics run the gamut from educating the public about sustainable cybersecurity measures, providing tips for avoiding surveillance on digital devices, and creating technology for defeating ad trackers. Access Now even runs a twenty-four-hour multilingual, free helpline resource to support “civil society around the world” (detailed further below).

Given the proliferating threats to individual privacy, digital privacy advocates have sought to seize all opportunities—whether legislative reform, research, influence on corporate operations or terms of service agreements, or tech development—to ensure Constitutional rights are upheld in the digital realm. While advocates do not always agree on issues or use the same tactics, they approach the “public interest” in this context in relation to citizens’ rights to free speech and privacy under the First and Fourth Amendments. A “digital violation,” then, involves federal or corporate practices that infringe upon these rights in digital spaces. In addition, some advocates emphasize the ways that social inequalities (e.g., those faced by racial communities of color; immigrants; inmates) often inform and shape these violations as well.

To keep track of the privacy-encroaching potentials of digital technologies, some digital rights advocacy organizations, such as EFF, CDT and Access Now, have staff members considered as “technologists” who specialize in understanding how digital technologies, software, apps, and devices work. These advocates download and test new apps on burner phones so that they can understand terms of service agreements and functionality of apps, and identify potential privacy vulnerabilities. In the Big Tech era, advocates have to understand and communicate about the operations of technologies in ways that advocates working in the analog era never did. Not only do they closely read terms of service conditions and test apps, they also have to contend with the Big Tech requirement to sign non-disclosure agreements (NDAs) in the course of their work. Yet signing them, according to our interviewees, does not preclude advocates from writing about or publicizing general digital privacy concerns linked to the technology.³⁶ As Joseph Jerome, staff at CDT, explained, in these situations, “It’s always slanted to what they want to show us, but we do get access to things sometimes, which I think is useful to help us know a little bit more about what we’re talking about.” Natasha Duarte, also staff at CDT, characterized these situations as companies providing a “look under the hood” and indicated that advocates learn the most from private companies when approaching them with a technical description and asking, “Is this an accurate description of how this technology works?” Given the secrecy around privacy and surveillance-related activities, it can be challenging to figure out how algorithms are set up, even with an NDA. Because of this, digital privacy advocates also read a lot of technical reports, product descriptions on company websites, and academic research to try and understand technological trends, proprietary algorithms, and device designs and capabilities. Our interviewees indicated that even acquiring baseline understandings of emerging technologies can be helpful in proactively confronting the proliferation of digital privacy invasions.

In addition to leveraging technologists’ research for agenda-setting, digital privacy advocates also must react to major breaking news and security events. This is a critical element of these organizations’ mandates. If they did not respond to developments such as the Equifax data breach or the Cambridge Analytica scandal, for example, privacy advocates would risk appearing irrelevant or out of touch. When such events occur, congressional leaders and news media often look to digital privacy advocates for context or explanation. Breaches and violations often end up drawing attention to the value of digital privacy advocacy while revealing new concerns on the horizon that need to be addressed. Thus, advocates must strike a balance between reactive and proactive postures in their agenda formulation. One interviewee noted that it is a constant struggle to maintain a proactive agenda while also having to react to so many privacy-related developments in a rapidly changing technological landscape. It is also very challenging to even define the line between the proactive and reactive as events and strategies unfold and overlap. For example, working proactively on the policy implications of automated content moderation related to hate speech and disinformation led one organization to utilize that research in relation to an entirely separate project on the Trump administration’s proposal to conduct surveillance of immigrant populations using automated analysis of their social media accounts. Agenda formulation occurs through relational understanding of different situations and juggling of proactive and reactive efforts, complicating many common understandings of advocacy labor—and policy change—as a fundamentally linear path.

Another aspect of the coalition’s agenda-setting, which is sometimes directly acknowledged but more often unstated, is adjusting what is known as the “Overton window”—the range of policy ideas that are acceptable to the political mainstream at a given moment. One of our interviewees addressed this issue in relation to the issue of encryption. Instead of continuing to debate with the Department of Justice whether or not there is an actual “secure backdoor,” they convened a conference on encryption policy that explored how such tools affect people, who is protected by encryption, who is most at risk, and what kind of personal information is at stake. The conference, in other words, attempted to shift the range of policy ideas about encryption by discussing the technology’s social dimensions—its effects on particular people rather than fixating on the technicalities of the “backdoor.” Bringing together members of vulnerable communities, industry experts, and high-ranking government officials to discuss how encryption affects public and personal safety, individual rights, and economic security, in addition to national and cyber-security, enabled advocates to expand and redirect the encryption policy discussion and weave it into their agenda formulation work.

Also crucial to this work is legibility. Several of our interviewees emphasized the importance of being able to describe agenda items and public advocacy work in accessible ways “so that people can understand and take ownership of them.” Advocates truly want people to have the ability to be engaged in conversations and decision-making processes about the impacts of digital surveillance technologies and privacy protections. Harold Feld underscored this issue, which was repeated throughout our interviews: “there is an educational issue that has to happen … you need to draw connections for the public and you need to draw connections for the decision makers.” The educational work of creating these connections for and between various parties was viewed as critical to building salient advocacy agendas and achieving long-term success, and all of our interviewees implored us to get academics and students further engaged in this process.

Navigating Regime Changes: Big Picture and Long Game

Whether agendas are proactive or reactive, privacy advocates must ride the treacherous waves of election cycles and political transitions while maintaining focus on their overall goals. There are persistent frustrations in navigating regime changes as well as experiences of working for many years on an issue only to see it refiled, sidelined, struck down, or deprioritized (e.g., the 2017 Congressional nullification of the FCC’s Broadband Privacy Rules created in 2016). One advocate bemoaned what they called the “government in exile” function—that is, when political regime change prevents progress on an issue from being made. Such conditions can bring about strategic retrenchment, triaging, and damage control, but they also can create time to work on long-term agenda items and writing projects. In this sense, even the most challenging times can be generative for the long game of digital privacy advocacy, which is of primary importance to coalition members.

Beyond dealing with new political administrations, there continue to be major challenges getting legislation passed due to bipartisan congressional gridlock. This situation stalls advocacy work that is oriented around legislation and policy-making, and requires continuing to “play in the orchestra on the Titanic,” as one advocate, Allie Bohm, policy counsel for Public Knowledge, put it. In such conditions, Bohm explains, advocates push for “a strong losing vote, because we’re setting ourselves up for the future.” Harold Feld called the Trump administration the “100-year flood of policy,” meaning that “it was totally unexpected.” Feld continued, “We never prepared for something this awful. Even those of us who had experience with previous Republican administrations were astounded at the absolute indifference the Trump Administration had for the broader consequences of their actions.” Trump’s FCC Chairman, Ajit Pai, has aligned himself with internet service providers (ISPs) and Big Tech from day 1, leaving the public behind in actions ranging from destroying net neutrality to abandoning almost all government-enforced privacy protections for US broadband users. Other interviewees echoed Feld’s concern, emphasizing the serious challenges for all forms of civil and human rights at this time. Another explained, “We just have to deal with a Congress that is very partisan right now and will refuse to move on certain issues. That’s making a lot of our work difficult to do [when] we want to see legislation passed.” Regulatory agencies change as well with each new administration, as do their ideologies and approaches to safeguarding the “public interest.” As one advocate put it, “The old FCC worked with us on common goals and the new FCC works against us and is hostile.”

Yet for digital privacy advocates, continuing to fight for better policies remains critical because, as Allie Bohm explained, “no victory is permanent, and no loss is permanent. We have to defend the victories we have or we will lose them, and we have to continue to build the record to eventually win on the issues we’ve lost on in the past.” Nevertheless, it is still important to document for the historical record how terrible decisions get made; this helps to prepare for the future as, inevitably, many of the same fights will continue. Moreover, it allows scholars and citizens to better understand the longue durée of policymaking, which only these historical struggles can illuminate. Typically, the advocacy community faces a “sliding scale of victory” as they note it is rare to ever get a total win, even in the best of times. So a defeat can be an orderly retreat, or a complete rout, but the goal will always be to secure future opportunities and accomplish what is possible, as opposed to simply giving up and going home—even in the worst of times. Sometimes that translates into education—for the public and for legislators or policymakers. At other times, it results in increased fundraising, advancing conversations with adversaries, or expanding the network of relationships to be able to fight more effectively in the next round. An advocate with OTI explained this consistent sentiment across the coalition: “even when you know you’re fighting a losing battle and it’s preordained that you will lose … . everybody still feels tremendous responsibility to continue to fight because it’s about the very long game.”

Beyond navigating election cycles and committing to the long game of advocacy work, digital privacy advocates have been laser-focused on the protection and security of personal information, which involves working with citizen-consumers, government officials, and companies. Advocates have continued to question what types of data the government can collect and access about individuals and how that access is afforded. This labor includes monitoring everything from the national security surveillance programs conducted under the Foreign Intelligence Surveillance Act (FISA) and/or reliant on Executive Order 12333 (an order that significantly expanded the surveillance authorities and mandate of the NSA originally signed in 1981), to criminal wiretapping, digital security issues, and the expanding state use of biometrics and facial-recognition technologies. As one interviewee put it, there are “perpetual efforts by the FBI to expand national security letter authorities.”³⁷ Beyond this, privacy advocates must ensure they are well positioned to participate in debates about new technologies and related government encroachments and abuses. Through such work, advocates apply and maintain pressure on government agencies, demanding that they provide information about their surveillance practices so that advocates can effectively recognize and prioritize needed reforms.

Another aspect of digital privacy advocacy is more commercially directed: What kinds of personal data do Big Tech companies, advertisers, health insurers, or hardware manufacturers have access to? And how is this access expanding in ways that diminish privacy or enhance surveillance? Some advocates who have worked in various capacities for both private companies and public organizations believe the biggest challenge is to create technical solutions to digital privacy that are somewhat “future proof or at least have a future open approach.” For instance, one interviewee has envisioned personalized gateways to the internet using “TrustMediaries,” which serve as digital interfaces between the user and web that are designed to create a “more decentralized ecosystem of digital trust”—see, for example, GliaNet. This project was inspired by experiences with the rapid-fire pace at which corporate legal teams must respond to various privacy matters and the desire to develop more structural and long-term solutions for digital privacy protection.

Such projects are contingent upon securing the necessary funding to continue advocacy work. Most of these organizations receive funding from a combination of public and private sources. Some avoid taking funding from the US government in order to prevent interference with their organization’s mission, but do accept funding from European governments for networking initiatives related to global issues and coalition partners, for example. Some also have branches in Latin America, South Asia, and Europe, and typically receive funding from national governments in those regions. Interestingly, advocacy groups often receive significant support from the companies they are critiquing or opposing in their various campaigns. The CDT, for example, counts 43 percent of its revenue from corporations and lists Amazon, Apple, Google, Facebook, Microsoft, Twitter, and Verizon among their top supporters.³⁸ Public Knowledge “limits contributions from any single corporation to 5–10% of its budget to ensure that no funders can attempt to assert undue influence” on the organization. Their highest level donors include many companies that Public Knowledge clashes with in their various initiatives, including AT&T, Sprint, T-Mobile, Google, Microsoft, Charter Communications, DISH Network, and Netflix.³⁹ While donations from these companies certainly create the possibility for “advocacy capture,” defined by Perlman as “the process by which public interest groups adopt the priorities of their funders over those of their communities,”⁴⁰ such pressures were not evident in our interviews or our research on the work of these particular digital privacy organizations. All of the financials for these companies are readily available online in their annual reports. These records detail the individuals, foundations, grants, corporate donors, fundraising events, and other in-kind contributions that support their independent missions.

Ultimately, the line between advocacy communities and the Big Tech companies they lobby is murky. There is regular coordination and cooperation between digital advocates and the private sector, from consulting on hot button issues to advocacy groups accepting donations from tech companies. Interviewees explained that they embraced opportunities to work with tech companies and urge company representatives “to be aggressive in defending their users’ rights.” Often this corporate outreach yields favorable outcomes or increased access to information for advocates. In the wake of the 2013 Snowden revelations, for instance, advocacy groups pressured companies to provide information about their data collection and surveillance activities. This resulted in the routine release of corporate transparency reports, which provide unique insights into the workings and privacy protection commitments of Big Tech companies and help to hold them accountable. Troublingly, however, these reports are increasingly being phased out, and a key privacy safeguard for consumers is being lost with their removal. Interviewees further indicated that a combination of patterns has taken shape: newer tech firms are not adopting the practice; existing companies are dropping the reports; and the reports have become the casualties of mergers and new management that “lacks the old management’s commitment to transparency … [so] the momentum has faded.”⁴¹ However, some do still exist,⁴² thanks in large part to the continued pressure coming from privacy advocates.

Given the abysmal records of the FCC, Federal Trade Commission (FTC), and Congress on the digital privacy front, advocates must play a multidimensional long game. As one interviewee insisted, it is critical to remain at the table in discussions, even if both parties completely disagree. There is always hope that

if you could figure out a way to show them alternative business models or use the market to put pressure on them … [they could] be more willing to look at things other than what they’re sort of tied into now … . and they might change things.

To that point, three of the most prominent and experienced lawyers in the digital privacy advocacy and information security space were poached by Facebook to join the company’s legal counsel just after we conducted our interviews. The fact that Big Tech companies recruit advocates with deep expertise—people who started their careers working in the public sector and who bring significant experience working with congressional leaders and government agencies—is not new or surprising. In fact, the “revolving door” between public- and private-sector jobs in Washington, DC is quite routine and, for better or worse, often leads to charges of “regulatory capture” or the corruption of agencies that come to adopt the interests of those they are charged with regulating. The appointment of current FCC Chair, Ajit Pai, perfectly exemplifies this dynamic. Pai was previously a Verizon corporate attorney who came into his FCC position and immediately repealed net neutrality and consumer privacy laws, both of which favored his former employer and the US telecommunication and ISP sectors. Advocacy workers often move to private companies for the astronomically better pay. And some advocates embrace the challenge of trying to implement progressive changes from within Big Tech companies, which perhaps motivated the three lawyers who recently moved to Facebook. Whatever their reasons are for “crossing over,” the loss of advocacy talent is a blow to the community as it affects the continuity of policy struggles as well as institutional memory. It can also leave a mentorship vacuum and require time and resources to recover from so that advocacy momentum can be restored. Perhaps most importantly, the continued blurring of lines between the public sector and private industry, especially in the digital media ecosystem, which remains largely unregulated, save for the corporations’ own Terms of Service (TOS) and End User License Agreements (EULAs), is an unhealthy condition that contributes to the erosion of public interest provisions and protections that are desperately needed at this time.

Monitoring of Global Conditions: Human Rights and Corporate Transparency

Given the resurgence of conservative populism and authoritarianism in recent years, digital privacy advocates have spent increasing time and effort monitoring internet policies and data collection practices of nation states and transnational companies, as well as their impacts on people in different parts of the world. Digital privacy advocacy, in other words, extends far beyond the United States and Europe to Brazil and India, Egypt and Ethiopia, China and Iran, to name a few countries. Organizations such as Privacy International, Citizen Lab, ACLU, OTI, EFF, Access Now, and Ranking Digital Rights all undertake global monitoring and advocacy projects. Access Now, for instance, has offices in multiple regions with staff who work in teams focused on policy, advocacy, grants, and technology. Formed in response to the Iranian government’s repression of digital activists during the 2009 Green Revolution, Access Now addresses digital privacy concerns through an international human rights framework concerned with user harms, rather than civil liberties, as many US-based digital rights groups. Access Now’s work, explains Drew Mitnick, the organization’s US Policy and Global Policy Counsel, involves “thinking about the effects of US surveillance for people all over.”

As part of its global monitoring work, Access Now operates an international Digital Security Helpline, which provides assistance to journalists, human rights workers, digital activists, and others who need technical assistance related to their internet use. The helpline accepts calls twenty-four hours a day in nine languages. Members of the group’s tech team field questions from the helpline. Callers typically seek advice on issues ranging from government shutdowns of civil society blogs to digital safety for journalists and human rights workers. As Mitnick put it, human rights workers’ lives “depend on secure communications.” Advocates also rely on these calls to understand the changing digital rights challenges faced by internet users in different parts of the world. Each call is also an opportunity for advocates to spread awareness about the helpline’s existence and usefulness.

Advocates also undertake other global monitoring activities, from analyzing export controls to calling out corporate security breaches to tracking national or regional policy developments. Scrutinizing export records enables advocates to infer which equipment—particularly surveillance—is going where. Privacy International has been particularly active in tracking the international distribution of digital eavesdropping and lawful interception technologies as well as how these technologies are used in ways that compromise privacy and other human rights. Advocacy organizations also monitor international data protection issues by tracking security breaches and issuing press releases when Big Tech companies violate users’ privacy. For example, Access Now critiqued WhatsApp for a 2019 security breach that exposed 1,400 international civil society workers. When asked about assuming such risks on the job, Joseph Jerome of CDT stated, “Privacy advocates don’t have privacy.”

Several digital privacy advocates we interviewed mentioned the importance of GDPR in Europe and perceived this regional policy development as a sign of international progress in the digital privacy arena. One interviewee insisted that GDPR is an important model of digital privacy legislation in the world, and also indicated that open support of GDPR can alienate some Silicon Valley companies as they are nervous about similar legislation in the United States. Here again, digital privacy advocates must engage in a delicate balancing act when formulating and pushing for privacy-related legislation. They must know the intricacies of GDPR while tempering their enthusiasm for such policies in order to sustain relations with digital companies that are resistant to such measures.

Increasingly, advocates’ global monitoring focuses on emergent technologies such as the Internet of Things (IoT), biometrics, sensors, and artificial intelligence. This work requires not only learning about these technologies, but also investigating where they are made and sold, national laws pertaining to their use, and how their use impacts diverse populations. Within some organizations, advocacy workers with law degrees and expertise in international human rights law conduct industry research and apply international law to various tech scenarios in a steady production of white papers and advisory reports. Examples of recent reports include the following: “Human Rights in the Age of Artificial Intelligence”, “A Human Rights Response to Government Hacking”, and “Recommendations on Privacy and Data Protection in the Fight Against COVID-19.”

Monitoring of global conditions also entails studying and providing information about the Big Tech companies that dominate the world’s media and information industries. The project Ranking Digital Rights (RDR) reviews publicly disclosed records of two dozen telecommunications and internet and mobile ecosystem companies, and generates a Corporate Accountability Index that ranks these companies based on their policies and commitments to freedom of expression, privacy, and security. RDR also produces “company report cards” that offer discussions of each company’s performance in these categories. Housed at the New American Foundation and co-founded by internet researcher, Rebecca MacKinnon, these rankings are now used by internet users, governments, and companies around the world. Sometimes they are even used by investment firms such as Fidelity and Goldman Sachs in determining companies’ valuation. As MacKinnon explained to us, “We’re looking for enough disclosure that people can credibly be confident that companies are taking appropriate measures and that their policies are responsible … And that people understand what’s happening to their data.”

Generating the RDR rankings is extremely labor-intensive and is based on a rigorous methodology with multiple rounds of data analysis, described in detail on the organization’s website. Producing the rankings requires back-and-forth communication with the companies assessed, review of publicly disclosed corporate records, comparative analysis of findings, development of public information campaigns, writing of reports, and updating of the rankings. The review of the digital privacy category is, according to MacKinnon, “very much grounded in international human rights law”⁴⁴ and takes into account community standards across international contexts. In 2019, assessments in the privacy category were based on eighteen indicators that measured corporate commitments and disclosure of policies affecting users’ privacy. These indicators range from “users’ control over their own user information” to “processes for responding to third-party requests for user information.” Russian and Qatari companies (Mail.ru and Ooredoo, respectively) scored the lowest and German and US companies (Deutsche Telecom and Microsoft, respectively) scored the highest in the report’s 2019 privacy index. Since these Big Tech firms operate around the world, RDR’s advocacy labor “is geared toward equipping global publics with knowledge about these companies.”

Since 2015, RDR has released four sets of rankings and the group has built a strong reputation for its salient take on Big Tech. Because of this, some companies have become extremely concerned about these rankings. In the wake of Cambridge Analytica, explains MacKinnon, “Anything that risks harming users is a risk to the value of the business … We know that they’re making changes in response to the index.” Some company employees have reported back to RDR and indicated they were able to get their managers to pay attention to and address particular privacy concerns because of poor scores in the RDR index. As a sign of the index’s powerful influence, some companies have even adopted RDR’s methodology to do their own internal self-assessments.

Despite the success of RDR, the organization has faced two major challenges. The first has been finding time and resources to ensure there is “government take-up” of the rankings. As MacKinnon stated,

We put out this robust index and then we don’t have the staff to really engage. We were somewhat reliant on advocacy partners but now everybody’s busy. We’re trying to double our budget so that we can actually hire somebody who can engage with policymakers in a more systematic way.

Given the heavy workload required to produce the RDR Corporate Accountability Index, it is unclear whether RDR will be financially sustainable in the long term. This is unfortunate given how crucial RDR’s reports have been, both in pressuring Big Tech companies to be more publicly accountable and in equipping internet users with information about how these global companies stack up against one another on key digital rights issues. Like the transparency reports discussed earlier, the RDR reports are crucial given the lack of international oversight and minimal regulation of Big Tech at national levels, but these reports are also at risk of being on the chopping block given the resources needed to generate them. To keep up with technological changes, RDR staff have consulted with Consumer Reports and the Digital Standard Project, and hope to begin assessing companies in emergent sectors such as the Internet of Things (IoT) and Digital Assistants, but needs to raise US$10 million per year for that to happen.

A final concern that emerged in our interviews was the expanding scope of their work in the context of the globalization of digital surveillance technologies. With “surveillance creep”—the proliferation of surveillance practices in everyday life—comes a constantly changing and growing amount of work for advocates. Cloud computing processes, sensors in the built environment, new forms of data collection, and artificial intelligence are just a few areas of emerging concern among advocacy groups. Some interviewees offered examples of technologies they had investigated recently, including urban scooter sharing systems, automated/algorithmic moderation of social media content and surveillance data, and autonomous vehicles equipped with sensors. With a growing number of objects in the world collecting data, digital privacy workers are also reckoning with conditions of “advocacy creep,” as they are tasked to investigate, monitor, and influence policies in relation to a skyrocketing number of technologies. This enlarging terrain for violating individual privacy also requires a renewed understanding of and respect for the work of the advocates that are devoted to protecting it. Many governments have abandoned their role as a steward of the public interest, corporations seem to be engaged in an arms race to see who can collect the most user data, and what remains is a coalition of technologists, lawyers, and privacy advocates who refuse to give up. Whatever is left of the public interest in the digital space, we owe to them.

Conclusion

The labor practices we have discussed have the potential to inform, improve, and impact media and tech companies and policymakers in significant ways, yet the activities of advocacy groups are typically not registered as relevant to media industry studies. Our research shows, however, that there is an intensifying degree of advocacy–industry coordination taking place, in part because of US regulatory roll-backs under the Trump administration and a gridlocked Congress. Not only do advocacy organization staff members rely on companies for information to do their assessment and agenda-setting work, advocates spend much of their time studying industry operations and engaging directly with workers in Big Tech companies. They apply consistent pressure to these companies and force them to think about how their technologies and operations impact users and publics around the world; they mount legal challenges to various media and tech initiatives to ensure public interests are protected; and they can ultimately wind up working with or for these companies in ways that might impart the values of advocacy organizations to a system that privileges profit above all else.

Several of our interviewees urged academics to become more involved in supporting their advocacy work, whether in the form of research, educational initiatives, or technology development. As Harold Feld stated, “It’s important for the academic community to take stands … and to not be afraid of pushing the envelope.” We believe advocacy work should be a topic of research and teaching in media industry studies as well as a workforce pipeline for media studies students and scholars. Digital rights advocates have devised tactics for accessing proprietary information about corporate practices and technologies; translated highly technical, legal, and corporate records into publicly intelligible information; formed coalitions to set advocacy agendas; and pressured corporations to uphold the law. Through these practices, and others, advocacy organizations and their devoted, relentlessly optimistic workers help us to connect the dots between digital privacy, online surveillance, and the erosion of democracy. Understanding these relations can inspire future generations of students and scholars to participate in the protection of digital rights themselves. Our scholarly community could apply additional pressure on Big Tech not only through our research, but also by integrating advocacy labor into media industries courses, helping to establish and prepare students for advocacy internship programs, and designing collaborative research projects that bring together advocacy organizations, academic, and industry partners. “Life is too short to do bad policy,” as Feld insisted, and it is our shared responsibility as media industries scholars and educators to help prevent that tragedy.