WASHINGTON–If Sen. Richard Blumenthal was waiting for the right moment to strut his Attorney General stuff, a pair of high-profile Judiciary Committee hearings this week gave him a tailor-made walkway.
Take the first setting: a Senate hearing room jammed with high-tech lobbyists in high-priced suits, all clicking away at their BlackBerries and iPhones. The subject: privacy protections in the era of smart phones and Google apps.
Executives from Google and Apple sat at the witness table, and Blumenthal’s turn for questioning had arrived. For a few minutes at least, the scene felt more like a courtroom than a congressional hearing.
“For three years, Google intercepted and collected bits of user information, payload data–emails passwords, browsing history, and other personal information–while driving around taking pictures of people’s homes on the streets,” Blumenthal began, referring to revelations last year that Google had collected data from unsecured Wi-Fi networks as part of its Street View mapping program.
“The company first denied that it was collecting this information. Did it not?” Blumenthal asked.
“We did,” answered Alan Davidson, Google’s director of public policy.
The freshman Democratic senator was in his element, grilling Davidson on a privacy breach that he had highlighted last year, when he was still Connecticut’s high-profile attorney general.
Google officials said then, and again on Tuesday, that the collection was inadvertent and they never used the information. But at this week’s hearing, Blumenthal said he had evidence suggesting otherwise.
“In fact, this personal data and the interception and downloading of this personal data is contemplated by a patent application that’s been submitted by Google to both the U.S. Patent office and internationally. Does it not?” Blumenthal continued.
Davidson said he didn’t know about the application. Blumenthal gestured towards a manila folder that had been placed at Davidson’s spot at the table. “Maybe you can have a look at it,” he said. “Do you recognize the document? Have you seen it before?”
Tuesday’s hearing was the first session convened by a new Senate Judiciary subcommittee, created to probe emerging legal issues surrounding privacy and technology. Blumenthal snagged a seat on the panel, chaired by Sen. Al Franken, the former Saturday Night Live comedian who is now a Democratic senator from Minnesota.
Blumenthal said he specifically lobbied to be on the new subcommittee because of his experience at the state level grappling with similar questions. “Internet privacy and security and safety are very longstanding and priority interests for me,” he said. “And I believe they are issues that grow more important every day.”
On Wednesday morning, Blumenthal attended a second Judiciary subcommittee session, this one focusing on anti-trust concerns related to the merger between AT&T and T-Mobile. He didn’t get a question in before having to leave for another briefing, but he’d already made his position known: When the proposed deal was first announced, Blumenthal said it raised serious anti-trust concerns and should be closely scrutinized for negative implications on market concentration.
“Out of the senators on the Democratic side, I think he’s probably been the most forward in his skepticism of whether this is good for consumers or not,” said Ernesto Falcon, a lobbyist for Public Knowledge, a consumer advocacy group opposed to merger. “He was the first one that came out asking about net neutrality” and suggesting a need for stronger regulation.
The Judiciary posts give Blumenthal a high-profile platform to display his legal expertise and trumpet his fight for consumers, major elements of his political persona. And with the spate of recent revelations about online privacy lapses–from reports that Apple’s iPhones were collecting data about customers’ locations to news that Sony PlayStation’s data had been breached–Blumenthal seems well on his way to carving out a legislative niche.
It’s one that has echoes of his AG days, with the benefit that he’s well-versed in the issues and the drawback that he might appear to be replaying some old tunes.
“Blumenthal Presses Google on Wi-Spy Data Collection ‘Debacle’,” declared a news release from his office on Tuesday’s Senate subcommittee hearing. An April 28 release reported: “Blumenthal Calls for DOJ Investigation of Sony Playstation Data Breach.” In another, he and other senators went after Facebook for a new plan they said could “reveal sensitive user information” and put users at risk for theft of personal data.
In an interview Wednesday, Blumenthal said he was thrilled to be digging into the nitty-gritty of these high-stakes, high-tech issues and translating his experience from Connecticut onto a national stage.
“The issues are very similar, but the challenges are different,” he said. As the state attorney general, he noted, he was focused on enforcing existing laws and imposing legal remedies. Now, he said, “I’m trying to strengthen those remedies and safeguards, through changing the law and making them national in scope, not just statewide,” he said.
But didn’t he have more power when he could threat a lawsuit? Not necessarily, Blumenthal said.
He pointed to his public pressure on Sony executives in the wake of a cyber attack on PlayStation accounts that resulted in the theft of consumers’ financial information. Sony has since agreed to provide a year of free credit monitoring for users and $1 million insurance policy if they become victims of identity theft.
“I think it could provide a real model for what we would incorporate conceptually in legislation,” Blumenthal said Wednesday.
During Tuesday’s hearing, Blumenthal made it clear that he believes technology companies need to be better regulated and held liable when their customers’ data is stolen by hackers.
“Right now what we face is the Wild West,” he said. Current federal statutes “simply don’t provide the kind of targeted enforcement opportunity that I think is absolutely necessary.”
More specifically, he suggested that companies should be required to meet some basic standards when it comes to designing and protecting their data–and be held liable if those systems are not adequate. In Wednesday’s interview, he said he is currently drafting legislation that would require companies to protect consumers’ data and provide a right for individuals to sue if those data-security standards aren’t met.
“My question is why not some liability to ordinary consumers, imposed through federal law, that would impose accountability?” Blumenthal said at Tuesday’s hearing. He said that would give companies an incentive to build secure data systems from the outset, instead of waiting until “disaster strikes.”
In wading into this thicket, Blumenthal and others risk stirring up a hornet’s nest of opposition. Many high-tech companies have dramatically increased their lobbying power in Washington in recent years. And although federal officials at the Justice Department and the FTC seemed to embrace Blumenthal’s suggested legislation at Tuesday’s hearing, some Republicans have sounded alarm bells about imposing new legal or regulatory burdens on high-tech companies.
“To say someone is liable for a breach of their security, when we all know that almost every system in the world can be breached today, we need to be careful how far we carry that,” said Sen. Tom Coburn, R-Okla., the top Republican on the subcommittee. He said lawmakers needed to tread carefully, so as not to stifle American innovation in Silicon Valley.
Asked about the political push-back so far, Blumenthal said: “There is a very active and sometimes intense conversation ongoing, and I welcome the dialogue.”
He said he expects to introduce his high-tech security bill in the coming weeks. And even though his successor in the AG’s office has come to a stipulated agreement and is working on a resolution to the Google case in Connecticut, Blumenthal doesn’t plan to drop it in Washington, saying he will to continue to press the company for answers about its patent application.
“The jury is still out, the investigation is ongoing and I am seeking simply to explore some of the factual and legal issues that have been raised,” he said.