You wake to the sound of a ringing telephone–but how could that happen? Several months ago, you reprogrammed your home telephone system so it would never ring before the civilized hour of 8 am. But it’s barely 6:45. Who was able to bypass your phone’s programming?

You pick up the receiver, then slam it down a moment later. It’s one of those marketing machines playing a recorded message. What’s troubling you now is how this call got past the filters you set up. Later on you’ll discover how: The company that sold you the phone created an undocumented “back door”; last week, the phone codes were sold in an online auction.

Now that you’re awake, you decide to go through yesterday’s mail. There’s a letter from the neighborhood hospital you visited last month. “We’re pleased that our emergency room could serve you in your time of need,” the letter begins. “As you know, our fees (based on our agreement with your HMO) do not cover the cost of treatment. To make up the difference, a number of hospitals have started selling patient records to medical researchers and consumer-marketing firms. Rather than mimic this distasteful behavior, we have decided to ask you to help us make up the difference. We are recommending a tax-deductible contribution of $275 to help defray the cost of your visit.”

The veiled threat isn’t empty, but you decide you don’t really care who finds out about your sprained wrist. You fold the letter in half and drop it into your shredder. Also into the shredder goes a trio of low-interest credit-card offers. Why a shredder? A few years ago you would never have thought of shredding your junk mail–until a friend in your apartment complex had his identity “stolen” by the building’s superintendent. As best as anybody can figure out, the super picked one of those preapproved credit-card applications out of the trash, called the toll-free number and picked up the card when it was delivered. He’s in Mexico now, with a lot of expensive clothing and electronics, all at your friend’s expense.

On that cheery note, you grab your bag and head out the door, which automatically locks behind you.

This is the future–not a far-off future but one that’s just around the corner. It’s a future in which what little privacy we now have will be gone. Some people call this loss of privacy “Orwellian,” harking back to 1984, George Orwell’s classic work on privacy and autonomy. In that book, Orwell imagined a future in which a totalitarian state used spies, video surveillance, historical revisionism and control over the media to maintain its power. But the age of monolithic state control is over. The future we’re rushing toward isn’t one in which our every move is watched and recorded by some all-knowing Big Brother. It is instead a future of a hundred kid brothers who constantly watch and interrupt our daily lives. Orwell thought the Communist system represented the ultimate threat to individual liberty. Over the next fifty years, we will see new kinds of threats to privacy that find their roots not in Communism but in capitalism, the free market, advanced technology and the unbridled exchange of electronic information.

The problem with this word “privacy” is that it falls short of conveying the really big picture. Privacy isn’t just about hiding things. It’s about self-possession, autonomy and integrity. As we move into the computerized world of the twenty-first century, privacy will be one of our most important civil rights. But this right of privacy isn’t the right of people to close their doors and pull down their window shades–perhaps because they want to engage in some sort of illicit or illegal activity. It’s the right of people to control what details about their lives stay inside their own houses and what leaks to the outside.

Most of us recognize that our privacy is at risk. According to a 1996 nationwide poll conducted by Louis Harris & Associates, 24 percent of Americans have “personally experienced a privacy invasion.” In 1995 the same survey found that 80 percent felt that “consumers have lost all control over how personal information about them is circulated and used by companies.” Ironically, both the 1995 and 1996 surveys were paid for by Equifax, a company th at earns nearly $2 billion each year from collecting and distributing personal information.

Today the Internet is compounding our privacy conundrum–largely because the voluntary approach to privacy protection advocated by the Clinton Administration doesn’t work in the rough and tumble world of real business. For example, a study just released by the California HealthCare Foundation found that nineteen of the top twenty-one health websites have privacy policies, but most sites fail to follow them. Not surprisingly, 17 percent of Americans questioned in a poll said they do not go online for health information because of privacy concerns.

But privacy threats are not limited to the Internet: Data from all walks of life are now being captured, compiled, indexed and stored. For example, New York City has now deployed the Metrocard system, which allows subway and bus riders to pay their fares by simply swiping a magnetic-strip card. But the system also records the serial number of each card and the time and location of every swipe. New York police have used this vast database to crack crimes and disprove alibis. Although law enforcement is a reasonable use of this database, it is also a use that was adopted without any significant public debate. Furthermore, additional controls may be necessary: It is not clear who has access to the database, under what circumstances that access is given and what provisions are being taken to prevent the introduction of false data into it. It would be terrible if the subway’s database were used by an employee to stalk an ex-lover or frame an innocent person for a heinous crime.

“New technology has brought extraordinary benefits to society, but it also has placed all of us in an electronic fishbowl in which our habits, tastes and activities are watched and recorded,” New York State Attorney General Eliot Spitzer said in late January, in announcing that Chase Manhattan had agreed to stop selling depositor information without clear permission from customers. “Personal information thought to be confidential is routinely shared with others without our consent.”

Today’s war on privacy is intimately related to the recent dramatic advances in technology. Many people today say that in order to enjoy the benefits of modern society, we must necessarily relinquish some degree of privacy. If we want the convenience of paying for a meal by credit card or paying for a toll with an electronic tag mounted on our rearview mirror, then we must accept the routine collection of our purchases and driving habits in a large database over which we have no control. It’s a simple bargain, albeit a Faustian one.

This trade-off is both unnecessary and wrong. It reminds me of another crisis our society faced back in the fifties and sixties–the environmental crisis. Then, advocates of big business said that poisoned rivers and lakes were the necessary costs of economic development, jobs and an improved standard of living. Poison was progress: Anybody who argued otherwise simply didn’t understand the facts.

Today we know better. Today we know that sustainable economic development depends on preserving the environment. Indeed, preserving the environment is a prerequisite to the survival of the human race. Without clean air to breathe and clean water to drink, we will all die. Similarly, in order to reap the benefits of technology, it is more important than ever for us to use technology to protect personal freedom.

Blaming technology for the death of privacy isn’t new. In 1890 two Boston lawyers, Samuel Warren and Louis Brandeis, argued in the Harvard Law Review that privacy was under attack by “recent inventions and business methods.” They contended that the pressures of modern society required the creation of a “right of privacy,” which would help protect what they called “the right to be let alone.” Warren and Brandeis refused to believe that privacy had to die for technology to flourish. Today, the Warren/Brandeis article is regarded as one of the most influential law review articles ever published.

Privacy-invasive technology does not exist in a vacuum, of course. That’s because technology itself exists at a junction between science, the market and society. People create technology to fill specific needs and desires. And technology is regulated, or not, as people and society see fit. Few engineers set out to build systems designed to crush privacy and autonomy, and few businesses or consumers would willingly use or purchase these systems if they understood the consequences.

How can we keep technology and the free market from killing our privacy? One way is by being careful and informed consumers. Some people have begun taking simple measures to protect their privacy, measures like making purchases with cash and refusing to provide their Social Security numbers–or providing fake ones. And a small but growing number of people are speaking out for technology with privacy. In 1990 Lotus and Equifax teamed up to create a CD-ROM product called “Lotus Marketplace: Households,” which would have included names, addresses and demographic information on every household in the United States, so small businesses could do the same kind of target marketing that big businesses have been doing since the sixties. The project was canceled when more than 30,000 people wrote to Lotus demanding that their names be taken out of the database.

Similarly, in 1997 the press informed taxpayers that the Social Security Administration was making detailed tax-history information about them available over the Internet. The SSA argued that its security provisions–requiring that taxpayers enter their name, date of birth, state of birth and mother’s maiden name–were sufficient to prevent fraud. But tens of thousands of Americans disagreed, several US senators investigated the agency and the service was promptly shut down. When the service was reactivated some months later, the detailed financial information in the SSA’s computers could not be downloaded over the Internet.

But individual actions are not enough. We need to involve government itself in the privacy fight. The biggest privacy failure of the US government has been its failure to carry through with the impressive privacy groundwork that was laid in the Nixon, Ford and Carter administrations. It’s worth taking a look back at that groundwork and considering how it may serve us today.

The seventies were a good decade for privacy protection and consumer rights. In 1970 Congress passed the Fair Credit Reporting Act, which gave Americans the previously denied right to see their own credit reports and demand the removal of erroneous information. Elliot Richardson, who at the time was President Nixon’s Secretary of Health, Education and Welfare, created a commission in 1972 to study the impact of computers on privacy. After years of testimony in Congress, the commission found all the more reason for alarm and issued a landmark report in 1973.

The most important contribution of the Richardson report was a bill of rights for the computer age, which it called the Code of Fair Information Practices. The code is based on five principles:

§ There must be no personal-data record-keeping system whose very existence is secret.

§ There must be a way for a person to find out what information about the person is in a record and how it is used.

§ There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the person’s consent.

§ There must be a way for a person to correct or amend a record of identifiable information about the person.

§ Any organization creating, maintaining, using or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take precautions to prevent misuse of the data.

The biggest impact of the Richardson report wasn’t in the United States but in Europe. In the years after the report was published, practically every European country passed laws based on these principles. Many created data-protection commissions and commissioners to enforce the laws. Some believe that one reason for Europe’s interest in electronic privacy was its experience with Nazi Germany in the thirties and forties. Hitler’s secret police used the records of governments and private organizations in the countries he invaded to round up people who posed the greatest threat to German occupation; postwar Europe realized the danger of allowing potentially threatening private information to be collected, even by democratic governments that might be responsive to public opinion.

But here in the United States, the idea of institutionalized data protection faltered. President Jimmy Carter showed interest in improving medical privacy, but he was quickly overtaken by economic and political events. Carter lost the election of 1980 to Ronald Reagan, whose aides saw privacy protection as yet another failed Carter initiative. Although several privacy-protection laws were signed during the Reagan/Bush era, the leadership for these bills came from Congress, not the White House. The lack of leadership stifled any chance of passing a nationwide data-protection act. Such an act would give people the right to know if their name and personal information is stored in a database, to see the information and to demand that incorrect information be removed.

In fact, while most people in the federal government were ignoring the cause of privacy, some were actually pursuing an antiprivacy agenda. In the early eighties, the government initiated numerous “computer matching” programs designed to catch fraud and abuse. Unfortunately, because of erroneous data these programs often penalized innocent people. In 1994 Congress passed the Communications Assistance to Law Enforcement Act, which gave the government dramatic new powers for wiretapping digital communications. In 1996 Congress passed two laws, one requiring states to display Social Security numbers on driver’s licenses and another requiring that all medical patients in the United States be issued unique numerical identifiers, even if they pay their own bills. Fortunately, the implementation of those 1996 laws has been delayed, thanks largely to a citizen backlash and the resulting inaction by Congress and the executive branch.

Continuing the assault, both the Bush and Clinton administrations waged an all-out war against the rights of computer users to engage in private and secure communications. Starting in 1991, both administrations floated proposals for use of “Clipper” encryption systems that would have given the government access to encrypted personal communications. Only recently did the Clinton Administration finally relent in its seven-year war against computer privacy. President Clinton also backed the Communications Decency Act (CDA), which made it a crime to transmit sexually explicit information to minors–and, as a result, might have required Internet providers to deploy far-reaching monitoring and censorship systems. When a court in Philadelphia found the CDA unconstitutional, the Clinton Administration appealed the decision all the way to the Supreme Court–and lost.

One important step toward reversing the current direction of government would be to create a permanent federal oversight agency charged with protecting privacy. Such an agency would:

§ Watch over the government’s tendency to sacrifice people’s privacy for other goals and perform governmentwide reviews of new federal programs for privacy violations before they’re launched.

§ Enforce the government’s few existing privacy laws.

§ Be a guardian for individual privacy and liberty in the business world, showing businesses how they can protect privacy and profits at the same time.

§ Be an ombudsman for the American public and rein in the worst excesses that our society has created.

Evan Hendricks, editor of the Washington-based newsletter Privacy Times, estimates that a fifty-person privacy-protection agency could be created with an annual budget of less than $5 million–a tiny drop in the federal budget.

Some privacy activists scoff at the idea of using government to assure our privacy. Governments, they say, are responsible for some of the greatest privacy violations of all time. This is true, but the US government was also one of the greatest polluters of all time. Today the government is the nation’s environmental police force, equally scrutinizing the actions of private business and the government itself.

At the very least, governments can alter the development of technology that affects privacy. They have done so in Europe. Consider this: A growing number of businesses in Europe are offering free telephone calls–provided that the caller first listens to a brief advertisement. The service saves consumers money, even if it does expose them to a subtle form of brainwashing. But not all these services are equal. In Sweden both the caller and the person being called are forced to listen to the advertisement, and the new advertisements are played during the phone call itself. But Italy’s privacy ombudsman ruled that the person being called could not be forced to listen to the ads.

There is also considerable public support for governmental controls within the United States itself–especially on key issues, such as the protection of medical records. For example, a 1993 Harris-Equifax survey on medical privacy issues found that 56 percent of the American public favored “comprehensive federal legislation that spells out rules for confidentiality of individual medical records” as part of national healthcare reform legislation. Yet Congress failed to act on the public’s wishes.

The Fair Credit Reporting Act was a good law in its day, but it should be upgraded into a Data Protection Act. Unfortunately, the Federal Trade Commission and the courts have narrowly interpreted the FCRA. The first thing that is needed is legislation that expands it into new areas. Specifically, consumer-reporting firms should be barred from reporting arrests unless those arrests result in convictions. Likewise, consumer-reporting firms should not be allowed to report evictions unless they result in court judgments in favor of the landlord or a settlement in which both the landlord and tenant agree that the eviction can be reported. Companies should be barred from exchanging medical information about individuals or furnishing medical information as part of a patient’s report without the patient’s explicit consent.

We also need new legislation that expands the fundamental rights offered to consumers under the FCRA. When negative information is reported to a credit bureau, the business making that report should be required to notify the subject of the report–the consumer–in writing. Laws schould be clarified so that if a consumer-reporting company does not correct erroneous data in its reports, consumers can sue for real damages, punitive damages and legal fees. People should have the right to correct any false information in their files, and if the consumer and the business disagree about the truth, then the consumer should have a right to place a detailed explanation into his or her record. And people should have a right to see all the information that has been collected on them; these reports should be furnished for free, at least once every six months.

We need to rethink consent, a bedrock of modern law. Consent is a great idea, but the laws that govern consent need to be rewritten to limit what kinds of agreements can be made with consumers. Blanket, perpetual consent should be outlawed.

Further, we need laws that require improved computer security. In the eighties the United States aggressively deployed cellular-telephone and alphanumeric-pager networks, even though both systems were fundamentally unsecure. Instead of deploying secure systems, manufacturers lobbied for laws that would make it illegal to listen to the broadcasts. The results were predictable: dozens of cases in which radio transmissions were eavesdropped. We are now making similar mistakes in the prosecution of many Internet crimes, going after the perpetrator while refusing to acknowledge the liabilities of businesses that do not even take the most basic security precautions.

We should also bring back the Office of Technology Assessment, set up under a bill passed in 1972. The OTA didn’t have the power to make laws or issue regulations, but it could publish reports on topics Congress asked it to study. Among other things, the OTA considered at length the trade-offs between law enforcement and civil liberties, and it also looked closely at issues of worker monitoring. In total, the OTA published 741 reports, 175 of which dealt directly with privacy issues, before it was killed in 1995 by the newly elected Republican-majority Congress.

Nearly forty years ago, Rachel Carson’s book Silent Spring helped seed the US environmental movement. And to our credit, the silent spring that Carson foretold never came to be. Silent Spring was successful because it helped people to understand the insidious damage that pesticides were wreaking on the environment, and it helped our society and our planet to plot a course to a better future.

Today, technology is killing one of our most cherished freedoms. Whether you call this freedom the right to digital self-determination, the right to informational autonomy or simply the right to privacy, the shape of our future will be determined in large part by how we understand, and ultimately how we control or regulate, the threats to this freedom that we face today.