Internet Privacy Laws Fall Short of Protecting People. A New Computer Science Professor is Driven to Influence Policy.

"Alexa, play Taylor Swift's Lavender Haze."  

It's a run-of-the-mill everyday occurrence: You ask Alexa for something. Then you may get a Spotify ad for Taylor Swift concert tickets. Or an Instagram ad for "Taylor's Version" merch.  

This may come as no surprise to internet users that Amazon collects data from your interactions with Alexa and shares it with advertising partners to curate online ads. But Alexander Gamero-Garrido, a new assistant professor in the Department of Computer Science, proved this was the case in a recent co-authored paper titled "Your Echoes are Heard: Tracking, Profiling and Ad Targeting in the Amazon Smart Speaker Ecosystem." 

While he admits that the research may not surprise consumers, it compelled Amazon to own what the company had been denying for a long time. Research like this also holds companies like Amazon accountable for being more transparent about how they collect and use people's information. 

Gamero-Garrido hopes to take the research a step further in his Internet Measurement and Policy Lab at UC Davis to reveal how a device could use this collected information to discriminate against people, which, in some cases, could have massive consequences.  

"There's a lot of evidence that the artificial intelligence algorithms these platforms use discriminate, for example, on the basis of gender," he said. "If you think of housing adverts and educational adverts, who gets what ad depending on who they are? Or if you start getting adverts for a gay cruise and you're a teenager, you might find yourself homeless."  

Safe Internet for All 

People generally don't think about these types of consequences when they are doom scrolling through X, formerly known as, Twitter or watching content on TikTok, much less about how the internet works. But this forms the base of Gamero-Garrido's research, which involves investigating the internet from a technical perspective to better understand how companies build their internet systems and hopefully influence regulation and policy that will result in a more accessible and safer internet for all.  

Studying the internet from a technical perspective as it relates to public policy was not initially where Gamero-Garrido had planned to go with his research. He earned a bachelor of electronics engineering from the University Simón Bolívar in Venezuela, where he designed a brake pedal for commercial trucks for his senior thesis (mostly completed while an exchange student at Lund University in Sweden).  

While working on a master's degree in technology and policy at MIT and considering which research path to take, Gamero-Garrido says that because of his engineering background, he became interested in figuring out how the internet works and seeing how those characteristics of the internet influenced a particular policy problem.   

"There is a lot of obscurity in how the internet operates, and I think it comes from the fact that the network grew in this organic, chaotic way," he said. "Ordinary people, at the end of the day, want to access the internet, and they don't want the privacy harms that come with it. For those two things to be true at the same time, we need a better understanding of how companies on the internet are doing their job and how they're building their systems, and in ways they themselves don't spend a lot of resources thinking about."  

No Private Lives 

Gamero-Garrido earned his Ph.D. in computer science at the University of California, San Diego, and was named a Ford Foundation & Future Faculty Fellow at Northeastern University before joining UC Davis. In 2018, he and other researchers developed a system to measure interdomain congestion, and the resulting paper won the Association for Computer Machinery Special Interest Group on Data Communication Best Paper Award.  

In 2022 his Ph.D. research "Quantifying Nations' Exposure to Traffic Observation and Selective Tampering," in which he built a framework to determine which countries are most vulnerable to mass surveillance and selective tampering via the internet, earned the Best Dataset Award at the Passive and Active Measurement Conference.   

At UC Davis, Gamero-Garrido would like to expand on his Ph.D. work by taking the countries from his original study — many of which are in the global south, including his native Venezuela — and investigating their networks for further evidence of tampering and surveillance. In particular, Gamero-Garrido wants to determine how much tampering is happening in authoritarian governments where the networks are mainly state-controlled.  

"Do we see greater rates of disruption? Do we see greater rates of surveillance?" he said. "Surveillance is hard to measure because the outcome of surveillance is intelligence and proprietary information, but do we see evidence that these networks are being used to harm citizens of those countries in a way that's greater than we would have expected based on existing data? Because of course, they are. The answer is not yes or no; the answer is to what extent."  

Taking Regulatory Action 

Gamero-Garrido, who has been named a 2023 Center for the Advancement of Multicultural Perspectives on Science faculty scholar, is excited to conduct this research at UC Davis partly because there is already privacy research being done here, which, he notes, is relatively uncommon in university settings, compared to related areas such as cybersecurity (which receive much more attention). Another reason is UC Davis proximity to both the state capital, where laws are passed, and the Bay Area, where many internet companies are headquartered.  

The state also has the California Consumer Privacy Act, or CCPA. Passed in 2018, the CCPA grants consumers more authority over how their personal information is used and shared on the internet.  

Gamero-Garrido hopes that because of this foundational legal structure, it will be easier to impact policy processes at the state level. The federal government, on the other hand, is more intent on passing laws related to telecommunications and security rather than privacy.  

To that end, Gamero-Garrido and the other authors of the paper "Your Echoes are Heard," are currently in talks with the Federal Trade Commission, or FTC, to explore federal regulatory action. It's not law, but Gamero-Garrido says, it's a start.  

"If I could wave a magic wand, Congress would regulate privacy," he said. "However, privacy regulation is happening because the FTC has found a legal basis to do it, which is great."