club briefing include the aclu, consumer action, consumer federation of america, consumers union, consumer watchdog, electronic privacy information center, the privacy rights clearinghouse, u.s. pirg, world privacy forum, and my center for digital democracy. i thank chairman jon liebowitz from the fcc and other distinguished speakers for agreeing to present today. the personal privacy of all americans is at risk in what's being called -- there's an explosion of sophisticated and ubiquitous technologies that track profile and target all of us online and off-line, in the store, on the street, in our homes, such surveillance. information about your habit, behaviors, travels and interest are gathered and sold to the highest bidder in milliseconds.

including information on our finances, our health, or ethnicity or race, our children, and our political concerns. this presentation will help us identify the risks and dangers and whether our political leaders have the wisdom to place in balance the rights of individuals to protect their privacy in the face of a vast commercial data collection system. lately i've been thinking, how can we be good stewards of this digital data collection environment? is reshaping everything we do. and like anything in life, it needs to be put in balance. and right now it is not in balance. the fcc staff has proposed a framework designed to protect individual privacy, were also ensuring data collection companies engage best practices. i look forward to hearing about their plan. now to introduce chairman liebowitz, i place a call on the show, the senior associate national price priorty consumer advocate.

thank you. [applause] >> good morning. thank you, jeff. my name is michelle, i'm with consumer action and i had the privilege to introduce today's keynote speaker, a man who has a long history of public service at the federal trade commission chairman liebowitz has been a national leader in working to ensure that americans are not ripped off by scams and fraud, have the tools they need to protect their identities, have access to affordable generic drugs and have the confidence that they need to go online. under his leadership the federal trade commission has worked to develop a new framework to protect consumer privacy online, including promoting do not track. i have a quick story. in my first meeting with chairman liebowitz i was a little bit nervous, i'm still a bit of a newbie here in town so myself along with other advocates were sitting in one of those giant conference rooms at the ftc just waiting for him to come in. so he walks in, carrying a gigantic tub of pretzels. when i say gigantic, i mean

gigantic. so we all kind of looked at each other and he sat down and started munching away and said everybody have some. we pass the gigantic tub of pretzels around the meeting. and i feel like i learned something important about him in that moment, which was that one, he is more. number two, he doesn't really think, is open to ideas and his kind of down-to-earth. is willing to listen, thinks outside the box or the tub i should say. is a stymied traditional thinking, and the man shares his pretzels. we are pleased and honored to have him speak your today. please join me in welcoming federal trade commission -- commissioner jon liebowitz. [applause] >> thank you for those kind and entirely undeserved complements. i will say i do remember that as a sort of bonding experience for all of us, and anyway, and my staff said no, don't share the

pretzels. i said no, we should share the pretzels. [laughter] anyway, let me also thank jeff chester for putting this event together, and really all of the sponsors, aclu, the center for digital democracy, that's jeff, consumer action, consumer federation of america, consumers union, consumer watchdog, electronic privacy information center, where is mark? is mark here? mark is probably taking his daughter to school this morning. that's one of my daughters goes to school. privacy rights clearinghouse, u.s. pirg, and the world privacy forum. and i'm especially pleased to be here with the jonathan mayer. where is john? hi. who has done just acidly terrific work on behavioral marketing. anbehavioral advertising and christian fjeld. is christian here yet. he will be here for the next panel. who works on the commerce committee for senator rockefeller and he is done just

wonderful work on privacy and also pharmaceutical competition to as many of you know one of our biggest competition issues, competition and false health care, health care is a key% of the gdp, and one of our biggest issues is stopping what we call paid for delay, pharmaceutical settlements. he was involved in that issue when he worked for chairman bobby rush on committee. so i'm just delighted to be sharing the stage with them today. now, jeff will be announcing a new study today, jeff and jonathan. and while we haven't seen it yet, i am certain that it will move us towards a goal that all of us in this room share. and by the way, it's a goal i also believe is shared by most businesses, online businesses. and that's protecting consumer privacy while ensuring a cyberspace that generates the free content and services we have all, to expect and enjoy.

now, based on research and reading that my staff and i have been doing over the last couple of weeks, much of it picked up while waiting in line at the supermarket, we have concluded percy ali could've had gastric bypass surgery, kim kardashian almost certainly had a butt lift, blake lively and leo dicaprio's short relationship seems bigger than, well, let's take kim kardashian's about. it doesn't look for ashton and demi. she has been, nowhere, she has been nowhere to be seen near the set of two and half men. thank goodness for the paparazzi. and really who cares of a thousand words each of their pictures is worth, at best only 500 are true. public figures choose, choose to make their living as monetizing their identities. in a free market it is hardly

surprising that photographers and gossip writers want to get in on the occasion. it would be a different story though if the paparazzi unleashed their lenses on those of us who don't have jobs treading the red carpet. take snap photos of us in what we thought were our private moments, and then sold them without our permission, the resulting montage, detailed and perhaps damaging portrait of ourselves. but you could make the case that this is exactly what's happening every time we access the internet. a host of invisible cyber -- isn't that a great word? soon to be a word, we hope. a host of invisible cyber because i like is what i'm going to say it again. host of invisible, cookies and other data catchers follow as we browse purporting art every stop in action to marketing firms that in turn collect an astonishingly complete profile of our online behavior. whenever we click, so do they.

one day you might be printing out a cdc fact sheet on alcoholism to help your son with a project for health class, click. or you order a box of your mother's favorite candy to take her when you go visit. click. or you buy the book the winners guide to casino gambling as a raffle prize for churches las vegas night. click. you know you are a beautiful parent but an employer could see a floozy job applicant if you know you're a thoughtful daughter but a health insurer could see a diabetic. you know you're a generous member of the community, but a loan officer can see a ricky gambler -- a risky gamble or. it is to they know who their subjects are one of cyberazzi may not have linked at least not publicly our identities to the profiles they are building. but that could happen disturbingly and may become a common practice. often the buyers of those cyber snatch a compass the target internet advertising to your

particular interest, a beneficial or worse, and knocked was marketing practice that helps support free content on the web. that's a good thing. but your track information doesn't have to stop there. it could be traded to out and invisible ladders of companies snow blowing into a profile of you available to those making critical decisions about your career, or finances, your health, and your reputation. of course most online advertisers are nothing like paparazzi. many companies have strong privacy policy protecting consumers, and they seek a microsoft representative and they have very strong policies for the most part. but we are not presenting a digitally altered picture of the situation. once you enter cyberspace software place on your computer usually without your consent or even knowledge turned your private information into a commodity out of your control. and keep in mind as my former colleague, republican ftc chairman used to say, your

computer is your property. and people shouldn't be putting things in it without your permission. now, at the ftc would want you to get your control back. we've been safeguarding privacy since long before cyber focus on the public. our goal is to stay one step ahead of technologies that raises -- races along, find more means to store and record your every move. the ftc has been working on consumer privacy as many of you know since the 1970s. in the early days of the internet businesses posted privacy policies which they and we because we are very in ensuring that happened, expected consumers to read and understand. of course, we soon learned both -- do you want me -- are you making a signal to me that i should -- no? the fed was and felt, that is until it has been a wonderful addition, our chief technologist. that wasn't a signal when you're going your ear?

know, okay, fine. [laughter] let me go back. i apologize for that. the ftc has been working on consumer privacy since the 1970s and in their early days of the internet businesses posted privacy policies that we expected when they read and understand. we learned sadly that both were unlikely. who is going to examine a legal document as long as the code of hammurabi when all that stands between them and free shipping is checking a little box as we know it's often project to you that say i can send. this is not, this is not meaningful privacy protections for consumers to cyberspace. with that same space expanding exponentially, to allow more and more data collection that is more and more invisible to consumers, the commission is looking for another way to allow consumers to cap the lenses of the cyber rotc -- the tranninety by the way, isn't that a great word? if you're not going to laugh at my jokes i'm just not going -- [laughter] mimic verizon also has excellent

private protections by the way. thanks. looking to have celebrities doesn't provide much guidance. so matt damon never did anything interesting in the public. jude law -- why organic isn't so in a vegetative state. in a report issued last december we propose a new framework for safeguarding consumers personal data, flexible enough to allow both businesses and consumers to continue to profit from an innovative and growing and rich information marketplace. we expect to issue a final report in the coming months. the report puts forth three principles to guide policymakers and industry. first, companies in the business of collecting, storing and manipulating consumer data need to build privacy protections into their everyday business practices. we call this privacy by design.

companies that collect consumer data should do so only, for specific business purpose, stored securely, key but only as long as necessary to fill its legitimate business needs, and then dispose of it safely. the more sensitive the data, the stronger the protection should be. and to their credit, or to its credit, much of industry is already embracing this approach. and, in fact, many in industry and i'm looking at around the room as some of the people from leaving american online corporations are, many in industry were doing this before we issue, long before we issued our draft report. second principle is transparency. any companies, any companies gather information online need to tell consumers what's going on. by this i don't mean another sort of 3.410 page document written by corporate lawyers and very deep within the site. i asked our staff to look at data disclosures on mobile devices because so much of commerce is going into the mobile marketplace.

one form took 109 clicks, 109 clicks to get through. and the staffer who discovered that, patty, is bobby julich who ever, or maybe it was one of our princeton graduate students or undergraduate interns come in any event the staffer who discovered that is probably the only one who ever made it to click 109. please do not read a policy policy like, privacy policy like this for why you are driving. transparency, and no one will read it anyway, transparency is not an unreasonable request. my daughters can go to any of a number of retail clothing websites and with one click see a clear description of a pair of pants, color, size, customer reviews, shipping online. one will click and that is the total of two, not 109, they can choose exactly the pants they want in the size and favorite colors and shaped exactly to where they want them.

put the guy who designed that page on the job of resenting meaningful disclosure and consent forms. and by the way, could i have a show of hands, how many of you actually read online privacy policies. just raise your hand. as a general matter. i would say it's maybe 15 -- you are really sophisticated audience and i would say it's maybe 50% of the people here. so, you know, imagine even with a general sort of hype is what percentage of people read online, read online privacy policies. the third principle is choice. consumers should have streamlined and effective choices about the collection and use other data. and that includes choices about when, why and how cyber optic follow them into cyberspace. we have proposed a do not track mechanism that will allow consumers to decide whether to share information about their browsing behavior online. and we envision a system in

which consumers can find and use easily, consumers can find and use easily and one that all companies employing cyberazzi have to respect. a vision of do not track, there's some similarity to the successful do not call program. and now we have more than 200 registered users of do not call. can i get a show of hands about how may people actually use do not call? that's terrific, thank you. and dave barry, the american humorist has called it the most successful government program since the elvis stamp. we are very proud of that. but unlike do not call, the ftc doesn't think do not track should be administered by the government. we hope different sectors of industry will work collaboratively to give consumers choice is about how and when they are tracked online. we're talking of something that is just opt out, not opt in. it really isn't very radical at all. now, a number of leading businesses responded to our call for do not track.

microsoft, mozilla and apple have admitted their own do not track features and we remain hopeful that google will join them. a half dozen advertising networks pledged to honor the mozilla do not track, mozilla and do not track header. and then i suspect it's only the tip of the online privacy iceberg. our wonderful chief technologist who was mentioned before, ed, is that all right? i got it. ed film is participating in a key internet standards setting body, finding technical standard for do not track. in this and other similar endeavors the ftc supports standards that provide systems -- but do not interfere with the normal data flows necessary for a thriving internet. we think this balance can be struck without too much difficulty. now, to its credit, to its great credit, the online advertising industry is also focusing on a consumer choice architecture.

digital advertising alliance coalition to me and marketing associations is making progress on its ad choices icon which consumers can click to opt out of targeting. we are encouraging industry to move forward and to really to partner with the browser vendors to ensure that the consumer choice model is persistent and effective, and it encompasses not just the advertising that consumers use but also the collection about the consumer, that advertisers and others collect. i think collection here is a key. of all the recommendations in the december privacy report, do not track is probably received the most exposure and, in fact, it's probably been in some ways over exposed leading to a fuzzy picture of exactly what do not track will do. to be clear, do not track will not use behavioral advertising marketing online. the ftc has no intention of pulling a sean penn on the cyber

rotc. in many, if not most consumers, prefer as we all know targeted ads. do you really want to scroll through went instead you could -- at the ftc we are agnostic as to do not track comes about it doesn't matter what technology backs the system, so long as it works. but no matter what, it has to be easy to use and easy to find. industries interest in developing tracking choices for consumers is hardening. they had the experience and knowledge to address flexible workable approach and to do it quickly. if they don't, however, there are signs that congress might impose do not track regime of its own design on the private sector but i believe that to christian to discuss on the next panel. when it comes to the tracking of adults we believe that with good faith and full disclosure and

working together, i think industry is going to strike a reasonable balance between consumer privacy information of online advertisers. but cyberazzi needs to stay away from our kids, at least without parental consent. now, as almost all of you know the ftc protects children's privacies with children's online privacy protection act, and the rules implementing the act. last month we proposed update to the rule to keep pace with both rapid technological change, such as geolocation devices, social networks and tracking cookies. and even more rapid evolution of tech savvy kids ability to outwit parental consent. it's a draft rule though, so we are seeking public comment on the proposed amendment and we will take into account that public comment from whoever submits it. that is, consumers ribs, advertise, children website operators, and many of you in

the audience. and, of course, as i look around the audience i see some of you who are very involved in the actual drafting of the coppa law back in 1998 and 99. while we at the ftc are proud of her work at privacy policy rules, we are primarily as you know in enforcement agency. to over the last 10 years we brought more than 100 spam and spyware cases, 79 do not call cases, more than 30 data security cases most of them did up with undergoing independent audits. today we are announcing a privacy case against a company called frost wire. which offers mobile ttp software by used hundred or perhaps millions of consumers. frost wire should its users personal cell phone pictures and other data without those users consent. it's default settings which are extremely difficult to change had been automatically,

automatically revealing private photos and videos, other files taken with users phones to other ttp users around the world. so in effect, it turned all of its clients into both unwitting paparazzi and underwear paparazzi victims. we now have a settlement order against frost wire prohibiting settings that automatically share the files use created. now, at frost work practice privacy by design as our 2010 staff report suggested, it would have built into the software consumers, it would have built into the software consumers reasonable expectations that their privacy, that their private photos state private. and it would have avoided a run in with our staff. had it in greater transparency but it would've provided clear information to consumers who could then make of course choices about the sharing of personal content like photos and videos. so the bottom line is this. cyberspace need not be a privacy

free zone, a place where without our consent or knowledge, our every online click is tracked and recorded with the sort of intensity of the "national enquirer" photographers trying to catch justin bieber on a bad hair day. the ftc is committed, if not good laugh at my jokes are just not going to make jokes anymore. [laughter] i'm going to finish his speech up in 30 seconds. the ftc is absolutely committed to a thriving innovative internet through policy recommendations, or self-regulatory efforts, and strong enforcement. and i think by working with all the folks in this room and then it was public interest advocates as well as industry, i believe we can keep cyber -- cyberazzi lens is focused on dwelling subjects, and at the same time ensure the rights of all citizens to choose the public faces we present to the world. with that i will stop but i'll be happy to take a few questions. thank you. [applause]

>> so, couple questions if you have any. otherwise i will -- you're going to interrogate me? fine. >> i am pam dixon. world privacy forum, i'm the executive director. i'm going to help with the q&a here for your excellent comments. so, thank you for your comments by the way and for the new idiom, the new terms, cyberazzi. >> did you pick up on the? >> i like the justin bieber. i want to talk about consumers bad information. >> okay. >> you talked about the study and a framework which we're all looking forward to. i have a question for you. your family with the berkeley study that talked about privacy misperceptions. given that study and that consumers are having privacy misperceptions when they see an

icon or the see a privacy policy, they automatically think, oh, this is private, my information is in getting exchange, how with a framework and ftc work with his deep consumer misperception? >> well, you know, i think education has to be a part of any attempt to protect privacy here, and i am reasonably confident or at least optimistic about, you know, the icon abstractly standing alone, sort of acknowledged the icon standing alone doesn't explain to consumers what it's about. but that if you put it into context, the advertised who are part of the daa are really committed, then you know, consumers will understand what the privacy, whether privacy icon means. we've done studies i think going back to the late 1990s about privacy policies, and consumers, and i've seen other studies, and consumers believe often that privacy policies protect their

policy. all it does is explain what the privacy or the approach of the company is. and so it's a big educational issue both for the icon and beyond, and i think we all need to work on that together. >> well, two quick questions. how could consumers get more meaningful rights in this space just beyond be notified of the policy? and how could consumers have a more integrated part, for example, the daa process? how could they be a bigger part of any kind of effort like that? >> i think how can consumers have a more meaningful involvement, in privacy generally, you know, we think, a lot of different ways but one approach of course is what we come is the approach we've taken in the privacy draft report which is more privacy by design, more transparency and more choice but i think a lot of companies are moving towards this. at how can consumers, the second part of your question, how can consumers be sort of more involved with the daa process.

you know, i think that's, i, you know, my sense is that, you know, consumers will tell us pretty quickly whether the daa process is working, you know, they will vote with their clicks or their awareness. and so, you know, from my perspective i surely hope it works. i tend to think that companies can move more quickly than government can. and particularly lawmakers, just the nature of the process now, it is -- for those of us are worked in washington for a long time. and so, i like to think that this is, and i do believe, it's a very well-intentioned project and that it might just work. we will seek. >> questions from the audience? can you speak into the mic,

please. >> if there are members of the press, please identify yourself your you go first. >> julianne with "national journal" to either question about privacy that was coming up in the house lastly. or some people to think that there should be special rules for teenagers. you guys didn't think that should be extended to teens, maybe you'll include some recommendations, perhaps. can you talk more about that and should it be special protection for teens? >> well, i would save her children they are in his specially vulnerable population, and i think everyone agrees on that. i sort of, i was very heartened to hear a couple of members across the aisle basically say we seem to have hit the sweet spot with our draft, coppa, updated rule. ibc were taking comments so we will refine that. 413-17, you know, -- 13-17,

they're somewhat obvious a more capable and cognizable, of making their own decisions. on the other hand, there are also, you know, they are also in some ways a vulnerable population. and in some ways, you know, the ages 13-17, it's sort a more come page was a group, too. they have the ability, jeff knows this, they have the ability to have an incredible facility with the internet. and at the same time, you know, they don't think about consequences. and anyone who has a teenage child has learned about the consequences of posting things without thinking about them and having sometimes those postings sort of sit around at lightspeed to all of their friends, and some of them might temporarily become ex-friends. you know, it's an area that we

think about a lot. we we looking forward to seeing comments from all the stakeholders on that. yes, other questions. >> david hatch with ftc watch. your agency -- >> you guys are really expanding, archie? >> we are hiring star reporters. [laughter] your agency has received complaints from coalition of privacy groups and also lawmakers about facebook. i was wondering, first of all, do you share the concerns that have been raised? and second of all, will the ftc investigate? >> we don't confirm our -- let mr. witt answer the second question. we don't confirm our investigations unless a company confirms them. do we share concerns more generally? i don't really want to comment on the letters we receive. i think we got one from maybe possibly to from joe barton and ed markey.

at 50,000 feet of course we share general privacy concerns. and that also reminds me about another point, which is really important. i think to make in the privacy space. i said before and i think everyone here knows this, that it is a particularly vitriolic time in washington. privacy is one of the very few issues where there's a lot of bipartisan support and interest, and i think that actually it is critically important for all of us in the room, whether you are a company or -- is an area where we can work with congress possibly towards an acting the privacy legislation to we haven't taken a position on things like that as security. and also just to sort of raise awareness. so, going back to your question about consumer involvement i actually think one way is by making this a high profile issue. >> one last question. okay, two more questions. >> then we will take one from

the non-press audience. >> tony from political. when you were talking but the ad icon, it got me thinking about super cookies. about the prevalence of super cookies. any thoughts from your perspective on this? >> sure. without respect to whether we have received from two very thoughtful members of congress, look, one of the things we talk about is do not track, they do not track portion of our report and when we testified on this is the notion that your opt out has to be persistent and i know the da is working on this, too. and sort of the notion of the super cookie that is incapable of being stamped out or is like a whack-a-mole problem. it's, you think it is delete and it pops up again and again and again. i was a without talking about, without regard to the specifics at a general level i think that it is in some tension within the approach the commission wants to

take. >> julie with "the wall street journal." we haven't seen the report yet on the lack of anonymity online, but can you talk generally about your view about whether the data collected online is anonymous? >> well, i think there are different degrees of anonymity. i think a lot of data collected online remains anonymous, but i also think, i also think particularly with respect to, say, data brokers and some companies that don't live up to the standards of privacy that we would all like to see, everyone in this room would like to see, i think you could build a pretty complete profile of someone. now, companies are not necessary doing this, and we don't have a lot of evidence of a lot of companies doing this, but we have certainly brought cases. we are primarily, we are a

policy agency but we're also very much an enforcement agency. we have certainly brought cases involving, you know, companies that have violated their privacy policy by either selling information or making information are less anonymous. and, of course, you reported on that, too. and "the wall street journal" has been very good reporting in that area, although i welcome should mention that your editorial page doesn't necessary read your articles. but anyway, neither here nor there. >> steve with no choice but at least someone has ask you about your cyberazzi line. spent what are you talking about? is that a new word? yes. so cyberazzi, it's -- >> made we didn't laugh because it just doesn't fit. the vast majority of online advertising industry is doing

targeting based on categories. so it's as if the online industry is following people around just that with a camera but with a checklist. and it's a checklist that you simply indicates they likes women, they like vacations. >> again, and again, you know, if you give me the right to opt out, i probably wouldn't take it because i sort of like the notion of being and of receiving targeted ads. but i do think, look, i do think that the concept of cyber roxy is a legitimate one. and it's legitimate, goes back to hans point. consumers i to have, consumers out to be able to make a choice in cyberspace, right? if you don't want to be tracked online, you ought to be able to sort of opt out. that's the did you know -- that's the view of the majority of our commission, which the commission voted five nothing to release. some commissioners have

different views of how this should be implemented one of my colleagues who i'm very fond of would like to see we do a '60s study, a subpoena driven study that would just look at the industry and see what they're doing first first. but i think it's critical that consumers have the right to opt out of tracking. and again i think that's a very modest proposal. i think most consumers won't do that or they won't do it for most categories. if they do, companies can still serve them ads. the free content that we've come to love and enjoy will continue, love and enjoy an extent will continue i believe in the free online services. and it's very different than, say, what they're having in europe where this information can be collected at all, whether it should be an opt in approach. i think that would be something that would be a dramatic change. i actually think, this is my own perception, that if we could go back and revisit the past at the

beginning of online advertising, and, of course, you can never revisit the past, i think that this would've been sort of the rules of the road the commission would propose in the late 1990s. and i say rules of the road, guidance. and i think industry would have adopted it. it's harder to undo changes, to undo entrenched behavior, but i think here it's a kind of, it's a kind of reasonable middle ground approach that i think most companies want to adopt. and i think, and going back to the use of the word cyberazzi, or the not quite get word of cyberazzi, i think it's a fair way to sort of capture the sort of gestalt of the moment -- you don't think so? we can disagree and that's one of the great things about this. i wouldn't say about this issue,

about privacy generally, but i think about this issue which is online tracking. i think most people agree that there should be a choice. that's a whole nature of the industry's online proposal. all right, i think i'm going to leave while i am modestly ahead. or not too far behind. thank you for the good questions. and anything else you want to add, ed? are we okay? >> thank you very much. [inaudible conversations] [inaudible conversations]

>> good morning. i'm susan grant, director of consumer protection at consumer federation of america. i am pleased to introduce jonathan mayer. jonathan as a graduate student in computer science and law at stanford university, and a student fellow at the center for internet and society at stanford law school. he and his fellow researchers at stanford security lab have been looking at what really happens with the data when people go online, and how that reality compares to what people might reasonably expect, or what people are told. in a series of groundbreaking reports, jonathan and his colleagues have shown how the

privacy assurances made by some self regulatory programs are belied by practices such as browser history, raise questions about the adequacy of the ad choices icon program for behavioral advertising, and shown that clearing cookies doesn't necessarily mean that they're gone for good. is interests lies, as he puts it, wherever information technology, public policy, and law intersect. with debates about the privacy of consumers data currently raging, i suggest that that's a very interesting place to be right now. in his spare time, johnson builds robots. we are delighted that jonathan is releasing today at this event a new study that debunks the myth that tracking is anonymous. jonathan, the floor is yours. and copies of the study and a

related post on the side table now. >> so thanks for the kind introduction. i want to add three quick introductory points of my own. he for moving into substance. the first is my obligatory government disclaimer. so much as i enjoy working with the exception of staff attorneys of the california department of justice, i don't speak for the department and i don't speak for the attorney general. second, in the interest of this not being an oscar style acceptance speech, i want to get the things out of the window so thanks to all of my colleagues at stanford and those were in my research for letting me get away with all this. last, i've gotten a number of questions from folks about the title of the talk, and i want to be very clear that i am not, in fact, old enough to appreciate the cheers reference. [laughter] okay. so with that out of the way, today i'm going to talk about

how it is when you log into the home depot website and go to your local and, your e-mail and first and get sent to 13 companies. and that e-mail first and get associated not just with what you're doing right now, but can associate with what you've done in the past and what web browsing activity you may have been future. i'm going to talk about how when you talk the wrong password on "the wall street journal" website your e-mail address gets sent to seven can. and again, but in the address can be associated with activities in past and future. i'm going to talk about how unpopular photo sharing website photo bucket when you go to swap some photos with friends and family, your username can be sent to over 25 companies. again, associate with past and future browsing activity. but with ground -- photo bucket has over 100 billion users. but i'm talking about today is the problem called information

leakage. i'm going to talk about its implications for identity in third party web tracking. so my talk is going to proceed in three parts. first i'm going to give a quick overview of the technology and policy by third party web tracking. for some in the audience i recognize this is going to be a recount but i want to level the playing field. sack and i'm going to talk about the role of identity and third party web tracking, how it can get associated and how information leakage works. and last i'm going to talk about the new results of our study. so to begin only a third party web tracking, when you fire up your web browser in the morning you might see a website that looks like this. are if you're a conservative it might look like this. i guess it's not funny. [laughter] hard to tell from the west coast. okay, so for simplicity i'm going to stick with "the new york times."

so you see "the new york times." it looks like "the new york times." it says "the new york times" right up there. there's "new york times" news stories, columns. it's all "new york times" content. but it isn't all "the new york times." in fact, your browser isn't just talking to "the new york times," it's talking to a bunch of different companies. some of those company's provide the ads on the page. some of those countries provide video on the page. some provide photos on the page. some provide social content on the page allowing you to share what you're reading with friends. or a sign on using a social network. and there are of course a variety of companies that you can't even see on the page. i want to give my favorite example of a third party invented on a webpage by way of terminology, these companies that are not the one year deal with are often called third parties and the website you're on is often called first party pics i want to get my favorite example, thankfully no longer the case now, for some time the

uk's national health service page had a like button embedded. i don't know why people would like syphilis. [laughter] you could share with your friends. so i'm assuming that was just french. but at any rate, funny. okay, so here's the core concern around third parties on the web. every time you visit a page that has third parties indicted, all those third parties learn about your visit to that page. and it's very trivial for those companies to essentially slap a barcode on your browser and follows your browser as a page to page. so that's the core information that is available here. what your web browser does as it moves around the web. now that information can be used to draw behavioral inferences. they can be used for a variety of other purposes. but for privacy concern, the fact that this data exists is generally why advocacy groups

get concerned, why consumers get concerned. why the ftc has expressed concerns and drafted a report. here's a broad sample of some of the reasons you might be concerned about all of these companies collecting user's browsing history. i'm not going to talk about that today. i'm also not going to go overly into detail beyond sketching the contours of debate that there is some polling to suggest that some users, strongly believe that it should not be lawful or at minimum they should be allowed to opt out of an on the other side of the debate there's the question of monetizing web content. so how can we make sure that all the great free service that are available on the web continue to be free to consumers. my research team at stanford is look at a variety of questions related to online tracking, i've looked at what the self revelatory program does, what technology users can look to protect themselves. we spent a lot of time speaking

about do not track and economics of do not attract the most not going to talk about in at this further today. i am happy to get into a q&a. if you're interested what we have say on this topic you can find a fairly comprehensive list of things we've written on a website do not track dot us. also appear they not funny. so that wraps what i wanted to say about third party web tracking only of the technology and policy today. and i want to talk about identity tracking. and in particular, there's a claim that, well, it's all anonymous. so where is the real concern here? in fact there was a time cover story on online tracking related to privacy practices, i want to be carefully in case the author is in the room, some might interpret to express that view in places. i think there are differences on what the article said. at any rate suffice it to say, there is a commonly held view.

i want to start with what is technical nitpicking. i'm going to carefully dosed out the computer science and is, hopefully not too much at any given time, so i'm going to try to steer clear of the jargon, and where i go right into him going to try to be very clear about what i'm saying. so it may seem like nitpicking to say this is all synonymous, not anonymous. but that's actually a really important distinction. pseudonymous means that there is an identifier, not necessarily a person's name, not a person's name, that is associated with a bunch of activities. versus anonymous where there is no identity as the sea with any of the activity. and each of the activities is independent, that you can't link them. that's important difference for policy purposes. so, to provide a rough graphical approximation, anonymity looks like this.

i can see what you do now and then when you walk away and come back i don't recognize you. and that's that. so under pseudonymity i can connect what goes on in the present to what goes on in the past, and also what goes on in the future. and this has a very important implication. that if you want associated and identity with the pseudonymous identifier, both present and past, and also future, activities are all identified. so i want to repeat that because that's a really important property. if you provide an identity once and they pseudonymous tracking scenario, that identity can be associated past, present and future. so even a little, even a little identity and check it into a pseudonymous system is enough to provide identity throughout the system. in a blog post about two months ago my colleague explained five

main ways in which identity might be injected into third party tracking. first, there were a bunch of third party tracking companies were identity is not even a question. so it's increasing the case that social networks offer plugs in for other sites like facebook like button with a tweak button or the google+ one button, into the past couple of weeks it's generally not on the radar that sees raise the same privacy concerns that is behavioral advertising and other better known forms of third party tracking. the social networks if you log into them already know your name. so, in fact, it's exactly the same cookie that gets sent to facebook.com, that unique identifier, that barcode that get sent to facebook.com when you load a like button versus when you're logged into the facebook site. so social networks, identity is already there. second, there's the issue of leakage. that's what i'm going to focus on today. third, there's companies called,

that describe themselves as matching services. there in the business of providing e-mail addresses if a user, if a user is directed to their service. i'm not going to talk about that today but you can read about them in the blog post. fourth, there's some security exploit you can use to learn and users identity. i wish i could say other third party trackers data we recently learned in a study this summer that's not the case. can read more about some of the security exploits that can identify a user. and last, techniques often referred to as where you match a bunch of unidentified data with a bunch of identify data, such that you can identify the unidentified data. there's a whole body of computer science literature on this. also not going to get into that. so what i just want to emphasize to you is leakage is just one of

many ways in which identity can be injected into third party web tracking. okay. so we are focusing on leakage. i'm going to start with the main way in which leakage occurs, and that's through something called a referrer. a referrer is nothing more than technical jargon for a page that something is currently on. and so if third party content shows up on "the new york times" website, i refer which is be in my times.com. but, of course, that's not all url. so for example, let's suppose you were to register with a website called example.com. this could be the refer, and if this were the refer, then a third party would learn what your username is, what your name is, what your e-mail address is, anything else that is stuffed in there. a pretty common scenario we saw is on user profile pages, often times the username is part of the url. so the refer that gets sent to

third parties, includes the username. i want to pause here for a moment to talk a little bit about usernames. there's been debate within, within the legal realm, of whether usernames should be considered personally identifiable user in the legal sense but computer science, there's a growing body of literature that suggests that usernames can't identify you. there's a great study in france this year, where the authors looked at a large sample of usernames from google to ebay, and public profiles. and they found that the vast majority of usernames were quite unique, and they found that using pretty trivial algorithms to match profiles across different sites could achieve over 70% precision and recall. so, so linking usernames across sites is possible and given the prevalence of social networking,

oftentimes once you have a user network, or username for a social network, you can also have a person driven, possibly photo, possibly more. there's additional details on how username matching works in practice in the blog post. i do want to emphasize just to show this isn't a theoretical concern. there are companies that already do this. there are companies that offer technologies that make it easy to integrate username matching into your software. there are companies that are in business after getting profiles across social networking sites. by linking usernames, and there are companies, and our countries that are in the business of recommending linking your social networks. okay, so back to the ditch. the other main way in which is paged out there to oftentimes when a third party is embedded on a website, it also has access to page title. and so you could imagine that

page title something like this. there's the username would leak through the title. i want to do want other side before wrapping the topic on leakage and that's to say that in the term of art in the computer science community, leakage just refers to information between parties. leakage can be intentional in the examples i've been keeping today, i'm generally not taking a position on whether it is intentional or not. but here's a case where i think it is intentional, and to give an example that it does occur, there's a free online dating website, okay cupid that we looked at. when you go to okay cupid, when you go to this website, it tips off to companies with your gender, age, zip code, relationship status. strange enough how often you claim to use drugs, i'm not sure why they do that. it did occur to me that in the state of california that might be some relevance to advertisi

advertising, at any rate, so intentional leakage can occur. okay, so there was a great study done by a few authors this year with a look at information language on partner websites. they signed up and act with 120 popular sites and report an aggregate statistics. they found that 56% leak private information, including search queries, user identifier and a few other categories they determined. 48% leak user identifier. and i want to talk about our new results which very much build on the christian study. we follow -- first, we expanded the scope so we studied about 50% more websites. second, we had an explicit focus on user identifying information,

not a broader category of course no information. and last we are making all of our data public. that's going to be public in about 30 minutes or whatever i can get my lap top going. okay, so we begin with the top 50 websites. we looked for sites that had a sign that why didn't have to ask my advisor for his credit card to sign up for cable is something like that. and we didn't look at sites that were so large they were studies on themselves, were as the website was essentially a whole ecosystem that we didn't think a good reason to study in a short time, so we didn't look at facebook, we didn't look at google or yahoo!. the sites we studied art in the data we're releasing today. so also we signed up and interacted with 185 websites. not the most fun projects i've ever worked on, true story. okay, and while we interacted with the sites we use this tool we built.

it's a web measurement tool. used to enforce do not try. you can use this measure with other web properties. in this case we used it to measure latest up with on the most common form with username or user id. we found that 113 times, 61% of the sites we interacted with league the username or user id. user ids and today they are almost enough to get a user name, sometimes more. there's a little bit of detail as well. so i think the key take away here is leakage is a pervasive issue. the web is an awesome platform. it can run on any device whether your pocket, your laptop, and any website can write software. that's great to meet him what developers are not think about, privacy issues. it's a fact of life the information is going to lead to third parties when the page titles, intentionally, and i think we have to recognize that that is just the way the web works.

by just to highlight some of the companies that received username and userid most often, scorecard research, the most often, 44% of the websites we tested. google analytics, you can sit whether google analytics is a first party or third party, hotly contacted by 10 contested right debt. 42%. facebook also received username, user ids on a bunch of study fix all the data is going to be a fable -- available today. i want to know in some places this is in conflict with first party, third party policies are how you might interpret those policy. scorecard says we are unable to identify a certain page. google advertises we don't collect ads based on personal identifying information. i'm going to play the let's let the lawyers sort that when a car. suffice it to say, that there is amendments on issue of of

possible misrepresentation. .. >> could be used to identify which has already weaker than how computer scientists think about identifying information,

actually any information they could use to be -- it actually has to be used to identify you and if personal identifiable information is used the only requirement is that you notify consumers in a privacy policy and you let consumers have a choice how it's applied retroactively. i'm not claiming any violation of self-regulation. okay, i talked a lot. that's all i have to say about third-party web tracking and identity and our new results. i'm going to offer one concluding thought before concluding there's a legitimate debate about privacy. it's a balancing act that will involve a lot of actors but i think we can at least agree there's a privacy problem here. that's it. thanks. [applause] >> well, i have a question and then we'll take a couple of questions.

okay. what can the average consumer do if they don't want their information to be leaked this way? so the short version is you could just not use the web but that's certainly not advice. we don't want to give to people. the web is totally awesome. the best thing consumers can do right now we have a blogpost on just this topic appears to be, unfortunately -- the best thing they can do is to block advertising because the moment content is loaded in the browser there's a risk of tracking. and self-regulatory tools for opting out don't actually opt users out of tracking. they opt users out of seeing targeted ads. so i'm going to defer to the blogpost and say, check out this ad blocking list by this company in new zealand website by a guy

in a gas mask. sand boy. does that not get laughs? >> it's a tough audience. >> i don't think that will be something accessible to the average consumer but that's the advice. >> so we have another question before we turn to the press. >> if you're a member of the press and you have another question, raise your hand, pleas please. >> julianna with "national journal." do you know if these sites are aware of these leakage? is it intentional? maybe you addressed it earlier but i don't recall. >> we didn't gauge where this leakage is intentional. i think it's reasonable to inner that in the majority of cases it wasn't intentional. and the claim we're trying to make is not one about evil websites. it's rather just one before the way the web works today. that the web is diffused with identity. and if we're going to have third-party tracking on the web we have to recognize it's a fact

of life that that identity is going to get sent to third parties at some point. >> andrew hiller voice of russia radio. one of the things i'm wondering is the real problem that it's invisible and people don't know it's happening until after the fact so you don't get a lot of complaining so it gives people much more freedom to pursue this. >> well, it's certainly a case there's an information gap between consumers and business practices. i think it's very telling of user identification of do not track right now -- by way of background there are about half a dozen companies -- i think it's nearly a dozen companies that have pledged to honor the do not track and the number is growing. i think there are a couple of companies that are going on ad support very soon. so do not track is increasing in support. it's in a bunch of web browser says now. it's 5 or 6 of firefox users that are using do not track because their browser has gone out of its way to tell users

that they can have control on this. the information asymmetry is at the core of this. >> evan hendricks, privacy times. one of the things we've seen over the years are a lot of companies that are into this surveillance that don't end up making it. i'm wondering if you're tracking -- and second of all, does behavior advertising really work the way it does? does it really deliver the goods? and are you watching a potential shakedown in this industry as some of these companies that, you know, claim that they're delivering advertising are probably not going to make it and fall by the wayside and in which case why should we be

bending privacy rights of companies that are not that good of a business model? >> i want to take that in two parts. first a look at what companies are in the business of tracking users. it's certainly the case that some of those companies are startups. startups incidentally that might not have adequate security precautions or adequate employee training or the variety of things we expect of larger companies in handling consumer information but a lot of the companies that are involved in third-party tracking are larger companies. so i think it's fair to say that the practice is here to stay. whether the actors engaged in it remain the same will, of course, shift over time based on business and so on. many of the companies that are involved in this have a number of lines of business so i couldn't really say the entire industry is going to go belly up or something like that. as to the other part of your question around -- what is the

economic value of behavioral advertising? it's a very questionable case. we have a blogpost that we wrote about it. unfortunately, there's not a lot of information on the issue which is really frustrating because it's such a data-driven have i. there are a couple of studies on this that have been fairly widely circulated. i don't think those studies are particularly good. you can read about why on do not track.us. i would flag it as largely one of you don't know. i do want to make one quick point about behavioral economics. behavioral advertising actually accounts for a sliver of online advertising revenue so it's often talked about as though getting rid of behavioral advertising is going to torpedo the entire internet economy. i think it is uncontroversial to say that at least for now, that's definitely not the case.

>> thank you very much, jonathan. [applause] >> okay. [inaudible conversations] >> the next panel should come up. good to see you. is christian here? okay. well, why they're taking their seats i'll just go ahead and get started. my name is lily. i'm the associate director for the electronic privacy information center. our epic.org.

i have the pleasure of introducing the panel discussion how users are harmed. many of the problems that our panelists will describe directly from the failure of the united states to establish a comprehensive privacy law without clear standards for safeguards regarding personal information using personal information for the purpose it was collected and meaningful enforcement toward those who violate the privacy of consumers we will continue to see the u.s. spiraling -- u.s. spiraling instances of identity theft and security breaches. this is all a direct consequence of the failure of a sufficient number of policymakers to fully understand the problem so that they can address growing public frustration about the lack of data privacy protection. there has been a lot of discussion this morning about the relationship between privacy and information and innovation. in epic's view it is a

fundamental mistake to see privacy and innovation as inversely related as a zero-sum gain. in fact, without innovative privacy solutions such as a public key encryption there would be no online commerce. it is important to understand not all techniques for anonymousization are bad but many of the current uses are. >> that's why we need innovation to help solve the new privacy challenges. anyone who thinks we get innovation by pushing the site privacy does not understand the history of the internet. our panelists for this discussion on how users are harmed will begin with a representative from the consumer union. she will begin the discussion by giving us examples of discriminatory practices of online businesses that harm consumers. she will be followed by beth gibbons the founder and director

of the privacy rights clearinghouse, a nonprofit consumer education and advocacy organization based in san diego, california. beth will discuss the commercial data broker industry and unrestricted access to the public data they are selling. next we will hear from chris, the legislative and policy council for technology and privacy issues for the american civil liberties union. chris will outline how law enforcement and government agencies are using data brokers to gather information about individuals as an end run-around the first amendment. the panel's presentation will close with the perspective from the u.s. senate commerce committee which will be provided by christian fields, senior counsel with the u.s. senate committee on commerce, science and transportation. thank you for joining us for this discussion. thank you. >> thanks, lillie i want to

thank jonathan and that tracking on the internet is not anonymous. that your information can be found out and also that companies -- when they share certain key pieces of information about you, such as your date of birth, your gender and your zip code, these pieces of information, while anonymous can be put together to reidentify you. and i think we really have to push companies to truly and effective and anoymize data collection. and online tracking can be problematic even if your name, your address, your phone number cannot be deducted from the information collected. last year, a "wall street journal" article revealed that capital one had partnered a company to do something very interesting. when first time customers landed on the capital one home page an algorithm would analyze their online behaviors, their shopping habits, their demographics and based on that information they would personalize the home page with credit card offers that they believed that consumer

would be interested in. so someone presumed to have a good credit score may see offers with cards of lower interest rates. and others that may not be presumed to have a good credit score may see different offers. these decisions are not made based on actual credit reports but rather they're based on an aggregation and analysis of the user's web presence and their producing habits. capital one definitely argued that its customers are free to browse all offers on the site but these would be the personalized offers that would show up on the landing page. so the fact that a website can personalize its offers based on what it thinks it knows about you could be problematic in other instances. for example, imagine that two people are shopping for the same item at the same time on different computers. one of them often shops for luxury goods and is often visited the sites of high end retailers. their profile identifies them as high incomed luxury goods shopper. the other is a student who only shops at discount sites and does not buy anything if it is not on

sale. it really is not inconceivable that armed with these two separate consumer profiles, a website could choose to display different websites to the same item. the site may decide that the savvy shopper would be more likely to buy an item offered at a discount. by the same token the luxury goods purchaser would probably buy the item at any price so they won't see that same discount. quite a differentiation has been going on and it's not a bad practice in itself. for example, lights tend to cost more when they're purchased on friday from -- from friday to sunday as opposed to from thursday to monday. citizen and see children also receive low prices. they apply to everyone, though and they're not person-specific. they're either determined by supply and demand or by society's interest in reducing rates for certain citizens. what we're talking about based specifically to you on your web

browser habits and your shopping habits. a web tailer knows you and based upon the assumption made about you could be pay more or less or fm for certain services or you may end up seeing less favorable offers than someone else. like, for example, if you're a minority, you could be targeted with more subprime loans than your white neighbors. this is really not farfetched given out a 2009 study from the university of minnesota law school, showed that minorities regardless of income were much more likely to be denied loans and more likely to receive subprime loans. this type of pricing personalization can be unfair given consumers have no way of knowing that it's happening and why. that's why we need more transparency and consumer education into what websites are actually collecting about you and what they're doing with it. at the same time, consumers need to be able to stop the tracking if it makes them uncomfortable.

>> thank you, my name is beth givens, privacy rights clearinghouse. i'm shifting the focus just a bit to talk about the online information broker industry. chairman jon leibowitz raised two realms the online broker industry is one without those choices. by the way, other terms are data aggregators, data vendors, data exilers data search compilers and the like. it's largely run regulated and that's a topic i'll refer to in closing. data brokers aggregate personal information from public records and publicly available information. they package it and provide it online both as free services primarily directory information and fee-base services depending on the type and amount of information provided. a few require an application process and they vet those who apply. most do not. they sell to all users, no

questions asked. when we've compiled a list of such online information brokers we have over 140 of them listed on our site and we realized that is by no means a complete list. it's one of the more accessed sections of our website, privacyrights.org. this industry was largely unknown to the public until 2005 when there was a major breach by then choicepoint which has since been acquired by lexisnexis in that incident a crime ring created fictitious business it's and purchased over 16,000 data profiles including social security numbers and dates of birth, the key identity elements for identity theft. they went on to commit 5,000 -- at least 5,000 cases of identity theft so in terms of the theme of this panel, which is harms, that certainly is one of the harms of access to information obtained online. i won't go into any of the

details to say that -- except to say that choicepoint did settle with the federal trade commission and the attorneys general in 2008. there are three categories of data brokers very quickly. i mentioned directory providers generally free. you've heard of them switch board, abusearch and lot of the people names, peoplefind, peoplelookup. et cetera. going beyond the directory information are those information brokers that compile information public records and acgait them including county property tax assessor files on homeownership. court files, bankruptcy records, data, tax liens and utility customer data. a third category -- lexisnexis and axiom by the way are two of the more prominent companies but many of them. a third category adds social media content into the mix and additional information examples are spokio and people, pipl.com

and data brokers are moving on to mobile phones now. one of my favorite is an app called sleaze detector and if you say -- you want to check out that date, that person you just met at your favorite club you can do an instant criminal records check by entering their cell phone. imagine the accuracy of the information you'll find. a california man is suing sleaze detector. he found he has seven felonies when, in fact, he has none. data brokers are consistently in the top five of the complaints we receive on our hotline. we receive emails and phone calls nearly every day about this unregulated industry. people are frankly outraged oftentimes have to hold the phone out here because of these companies who without which without their consent compile the information and make it available and sell it to anybody, no questions asked. others have very specific complaints and since the theme of this panel is harms, let me

give you three stories. we were contacted by a woman who testified in an attempted murder trial and needed to keep her home address private for very obvious reasons. she said the murderer was due to be released soon. she didn't want to be located and she had found herself on the website of a data broker. phoned that data broker and asked to be removed and they said, yes, we will but please fill out the opt-out form. unfortunately, the opt-out form in her estimation asked for way too much information and this is a common complaint and her concern was, are they then going to add that information and piled their data profiles in that way. a police officer from an east coast state contacted us. she works in gang intelligence. wanted information removed from all of these data brokers. she'd seen our list of 140 and was quite daunted. she said isn't there basically one click to opt out of all. and was very disappointed to learn the answer is not only no. but not even -- not all of the

data brokers offer an opt-out. in fact, i don't know perhaps half of them do because it's unrejected they don't have to. and finally we were contacted by an attorney represent ago victim of domestic violence. the victim had hired the attorney to contact -- i'm sure at considerable expense all the data brokers that they could identify and ask that her information -- her home address specifically be removed. one refused. the company integrascan the ceo claimed -- well, even after receiving letters from her doctor and a therapist saying she was in physical harm if this information was not removed, he claimed that his first amendment right to post public records information outweighed the victim's personal safety. there are many more stories i could share with you. we've heard from mental health professionals. community activists on

controversial topics. court employees, parole officers, probation officers and more all who have found -- feared for their personal safety because of their information being online. but it goes beyond that. many individuals who don't have such concerns who are not in harm's way simply want to be able to protect their privacy, control their personal information by removing their data profiles. in the interest of time, i just want to talk about possible public policy perspectives. senator patrick leahy introduced his personal data privacy and security act this year, a bill that he's introduced for several years running. it's two parts. data breach notice requirements and in past years, not this year, data broker requirements as well. in the past, is the section would have given individuals the ability to learn what data brokers have about them and to have it corrected if errors and also it would have required a notice if an adverse action had

been taken based on information about individuals. these provisions are definitely a good start. i would add a requirement for an opt-out and a means to identify all players. the world privacy forum has recommended in ftc comments that they establish a registry of data brokers and we agree this this would be an excellent tool for consumers and policymakers alike. in short, we believe this industry needs to be profile like those in the fair credit act. in closing my organization recommends the federal trade commission convene a workshop about the data broker industry. i think -- we believe it's imperative that this issue be addressed in a public policy setting. we believe that the complaints that we are receiving and we're a small organization, harms that people have experienced because of the ease of access to such data broker information are, quite frankly, just a tip of the

iceberg. and i thank you for your attention. >> hi. i'm chris calabrese from the aclu and i'm going to talk a little bit today about our concern, which is the sharing of behavioral targeting -- behaviorally targeted information with the government. at this point it's our belief that the evidence is very -- while indirect, is very compelling that behavior -- the information from behavioral targeters is ending up -- in government databases and with government -- you know, with government agents. i mean, at the outset, i think it's useful to understand two things. the first is that we know that the government is interested in not spilling our water. in online information generally. google reported in the last six months of 2010 -- it received about 4600 government requests.

probably back in 2009, facebook said it was getting 5 or 10 requests a day. so we know that we have -- there's a government interest in this information. at the same time, we know that the government has been collecting personal information on american consumers from these data brokers that beth just talked about so compellingly at least since -- all the way back to at least 2001. companies like choicepoint and axiom have bragged that they act as an intelligence agency gathering data, applying analytics. one company, intersect described itself on its we can't as the silent partner to municipal, county, federal justice agencies who access our databases every day to locate subjects, develop background information, to cure information from cellular or unlisted numbers and much more. they freely admits that it has the authority to collect this

type of information because it comes from a commercial database and they purchase lots of information from commercial databases. so there's no question that government agencies are accessing this information from information brokers. so where does that take us? i think the useful answer to that is really found in axiom's web page, axiom is a data broker. well, one thing that axiom sells on one section of its web page is identity solution. investigative tools for government agencies, law enforcement and security. so that's one tab over here. and the other tab over here, they also provide addressable advertising. axiom helps you -- and this is a direct quote from the page. axiom helps you reach your most valuable customers. the most motivated to engage with your brand and transact. use what you already know about your audience in the offline world, combine it with gigabytes

of data available on anonymous online world and apply it with scale across emerging addressable media channels. it can ensure your customers and prospects receive exactly the message you want. so at minimum, we know that the same companies they're providing, you know, this identifiable information and linking online and offline information have it in their databases. we also know they have contracts with the federal government and with state agencies and all kinds of other government agencies. so while i can't -- because i don't have access to those contracts and those databases say to you the law enforcement agencies are accessing those databases that contain that information, again, the information while indirect seems pretty compelling. so from the aclu's point of view unsurprisingly we would consider this a significant harm. the benefit of internet to read

provocative materials and voice dissecting opinions are all based on the assumption of practical anonymity and freedom from government scrutiny. because of this information collection, these assumptions are rapidly eroding. and, you know, perhaps the most worrying thing of all is the larger system that we're creating here. behavioral targeting, as we've talked about, creates an economic incentive for tracking. better and better surveillance is rewarded with more and more ad revenue. of course, we've long been concerned, i think, many of the people in this room, the aclu certainly with the idea of big brother spying on us. but what if the danger here is really lots of little brothers, all with their own economic reasons for spying? the way the system is built right now, the government can just come along for the ride. thanks.

>> good morning. i am christian with the senate commerce committee. i work for senator rockefeller who's the chairman of the committee on the majority staff. excuse me. i'll be brief. just to say that consumer privacy has been and will remain a priority on the agenda of the commerce committee. senator rockefeller has been very public in his statements saying that protecting consumer privacy is very important. we've held numerous hearings in this congress and in the last congress, a couple of which several of us have testified at. it's going to remain a priority for him in this congress and he wants to proceed in a very deliberative and bipartisan issue. it shouldn't necessarily be one that is often mired in sort of the political fighting that you see a lot in washington nowadays. having said that, senator rockefeller has also introduced

do not track bill, legislation, that he thinks is very important. he thinks -- the concept of do not track even though it's somewhat of a misnomer and the term do not track is not completely actor in terms of capturing what the intent of the bill is. nonetheless, it's a very simple, it's a very elegant concept, something that i think it's easy for ordinary consumers to understand. that's something that senator rockefeller has always emphasized in all of his public deliberations on consumer privacy. we think that industry is moving in this direction anyway. and we think that we have made all of the necessary accommodations in the bill to accommodate technologies and basic functionalities and effectiveness of services. but having said that it's just the beginning of the process and we continue to work with all interested stakeholders in trying to have a good quality bill that can hopefully pass congress and in a bipartisan manner. senator rockefeller appearance really good relationship with senator hutchison who is the ranking member of the committee and we hope to foster that

bipartisan cooperation moving forward on these issues. >> we have some time with q & a. we want to begin with some questions from the media for the panelists. you indicate you have a question, we'll get a mic over to you. >> on the practical legislation front, does the committee mark up the bill on the bill. we don't have it. we don't have anything scheduled. i think we're deliberating over our options working with senator kerry's office and also with the republicans on the committee. >> right. we can open it up to the

questions, so the gentleman here. >> everybody is getting tired. [laughter] >> those are already regulated. the discussion on oba didn't show any harm. .. we should move on to the next question. >> anything else?

>> i just have one thing i would like to offer. i did a panel with a journalist who was working and there were people constantly being approached by the chinese government asking them about their relationship with her. and she asked him about that, did that make them feel uncomfortable and their response was "i'm not doing anything wrong." the very thought that you have to go there has a chilling effect and that is a harm in every society where communication is -- >> [inaudible] >> the harmid factor is this -- yes, yes. next question. >> ibm mar bin. i just have an informative question. chris, i know there's legislation arana privacy and private companies. is there any legislation or activity are of the government access, what's actually going on

legalese? >> sure. there is legislation going on to update the electronic communications privacy act. it was passed in 1986. it has not been substantially updated since then so the law protecting privacy from the government online is older than the world wide web. senator leahy has moved in to begin to fill the void by updating content protection and saying that all contant online, whether it is in a google doc or social net working page or e-mail should be protected by a warrant and that is a crucial protection. we are also seeking locations to updated tracking by representative chase in the house, a republican, and senator wyden in the senate, democrat. they both have bill still would require any location tracking by the government be done with a warrant. those are also important updates on the government side. >> another question.

>> this is susan, consumer federation of america. this is a question you talked about the potential for price discrimination. we've already seen that with the msn experimenting awhile back and obviously can also -- information about people can also be used to present different options to them for other kinds of goods and services. are there any laws that presently prohibit that or protect people from being offered less advantageous prices or terms than others? >> i believe there are laws that prohibit discrimination based on race and gender, but just in terms of prohibiting retailers from showing a different price based on your shopping habits and background, no.

>> okay. another question here. michelle. >> is it on? michelle from consumer action. beth, i was wondering, the consumers you spoke to -- who are of course also customers -- would you think they would consider themselves harm or would they say they were not harmed or it was just, you know, something that wasn't important, that was just no big deal, they were bored and wanted to call a hot line one day? >> specifically about the the brokers because we deal with a full range of complaints, the data brokers. i gave examples of compelling harm, domestic violence victims who cannot control the fact that there address is on the web, mental health professionals who

serve volatility to individuals, people who work in the court system who witnesses or another it assembles, individuals who fear, realistically fear for their personal safety. >> [inaudible] >> no, we don't have to wait for them to be killed as you say to experience harm. i think just the potential for harm is there. and by the way, there are numerous stories -- one of the reasons we got interested in this in many years ago was an individual who was murdered because of access to a data broker, of course it was a mentally unstable person who was stalking a young woman, found her address through a dealer broker. this occurred in new hampshire -- tracked her down and did murder her. rebecca schaffer incident in california, another example. in this case it was a private

investigator who obtained the information from the dmv was able to find her and again, murdered her. so those are very rare occurrence is put those things happen. certainly stocking is an issue. anybody who works in domestic violence is aware of this industry and the extreme difficulties these individuals have in suppressing their personal information particularly their address. just one bit of i guess you'd call with news. in california this year a bill was passed into law by state senator alan corbin that would give those individuals who were originally registered on the safe at home program and that is a mattress, confidentiality program that has a majority of the state's half for victims of stalking and domestic violence who must protect and keep confidential their home address. they can now come under this law we contact these on-line data

brokers and basically request, require them to remove their address. so this is, i believe a step in the right direction for individuals who are truly in danger of personal harm because of the address being on line. >> another question. >> julieanna with the national journal. this is for christian. to believe the study of the information they gave us and talked about earlier, will that have any impact on the debate in congress? it seems like there was a lot of momentum on the issue early in congress but it seems like a house wained in the process for legislation doesn't seem all that likely in this congress. if you have any comment on that? >> would be difficult for me to comment or even have an opinion for that matter. i have not read the study. i don't know the details of it and so i think there's going to be a lot of interested people to read it, but i just i can't comment on it because i have not in fact read the study.

>> [inaudible] >> i can get fairly safe to say that passing any bill out of congress is proving difficult lately, so, you know, i'm not necessarily -- i wouldn't be counting on us passing privacy legislation in this difficult political environment, but having said that, my boss, rockefeller, still committed with in a bit partisan matter to see how far we can get. and if it's not actually passing legislation, it can certainly still until conducting oversight and having public hearings on the subject in order to better air the issues and deliberate on this in a thoughtful manner. >> thank you for that. >> for anyone on the panel can respond. to be one of the most disturbing aspects and tracking the online advertising data collection system has been the inclusion of

race and ethnicity in the profile. obviously you want to see a robust, diverse publishing, online publishing system, so you want to see those leases monetized. but i want -- i'd like to hear from the panel what they think about the identification of someone's race or ethnicity without that person or individual giving affirmative. >> welcome from the aclu's point of view for quite a very long time we have been concerned about the misuse of information on an individual's race that would result in discrimination for really just a lack of choice. it's one of the reasons that we are concerned about the widespread sharing of this kind of information with the government.

i think that we would certainly be concerned about any race based or religious base because being a muslim can sometimes be a particularly, you know, being interested in islam can be something that you may fear will bring you to government scrutiny. so we would certainly be concerned about that kind of information and how it's being used and we would welcome any additional research or information on that. >> i think just in line with what i mentioned before we would be concerned that if a company makes certain judgments about you based on your ressa for example that you are less worthy of getting a loan or you have bad credit that the offers you could see or the price you could be offered would be calibrated to that. >> john? okay. thank you so much. [applause]

>> good morning. i am john simpson with consumer watchdog. i want to quickly wrap up. as christian just suggested, it is probably the case that it will be difficult to get privacy legislation passed in this congress. it's difficult to get anything at all past. but the fact that you are all here today shows that the issue is getting bipartisan interest, and we are all looking forward to some very important milestones the next couple of months. chairman lee lewis referred to the ftc report that's coming out. congress is likely to come out at the end of the month with its official position and that will probably be the administration's position on privacy. there are hearings this week before the house commerce committee, and of course the senate has got do not track bill

and this is not surprising the consumer watchdog poll found that 90% of the people responding favorably on online privacy legislation. i for one have doubts that self regulation is going to work. i think that jonathan's study shows that indeed these self-regulatory efforts often are not what they purport to be. the digital advertising alliance doesn't give you the right to opt out of being tracked. it simply gives you the right not to have behaviorally targeted ads. and today we have learned that this notion of tracking your behavior anonymously is not really what is going on. that information is not anonymous and it's often shared with sites. i.t. lillie made a very important point, and this is something about the way this whole debate is being he erroneously claimed.

it's not the freedom versus privacy and that there is a tradeoff. that is just wrong headed. what made the internet voluble for successful commerce was privacy innovation, various kinds of things that enable you with a reasonable security to send your credit card information over the net. you couldn't do that kind of thing. so what we need is not a false dichotomy between privacy on the one hand, innovation on the other hand. we need to get the people to come together and innovate necessary privacy technologies. i think if the internet is going to be viable as an economic base, consumers need to have faith in it. and to get that fifa the need to have control over their own

data. do not track a persistently to do a do not track. i think requires legislation. maybe the industry will step up to the plate. i don't know but if you can have do not track, you will instill in to the consumers the kind of control they will face in the internet and in the process, which only at the end of the day will mean a win-win for consumers and business alike. thank you all for coming. if you have not had enough of this yet, i want to remind you all that this entire proceeding is going to be available on the web at www.visualwebpastor.com/protecti ngconsumerprivacyonline. that is on the bottom of the sheep week handed out. this will be available the next

six months. thank you very much for coming. [applause] a quick reminder that if you missed any of this discussion you will be able to see it in its entirety on c-span.org, our website. you can go to the c-span video library to find programming. we do have more live coverage coming up on c-span2. at noon eastern about an hour and 15 minutes or so the heritage foundation will be hosting an event focusing on national security. speakers include former attorneys general john ashcroft and michael mukasey.

our military must remain the finest in the world. it must be an agile and deployable full spectrum force that can deter conflict, project power and win wars. that is a great challenge and that challenge will bring about difficult times in the difficult decisions, but i would tell you as well it is also an opportunity, an opportunity to shape, to change, to transform

the army not just to come to terms with the fiscal constraints of today, but to better meet the challenges that we know somewhere, sometime we will face. building a memorial to honor dr. king and the sun. what the official dedication of the martin luther king, jr. national memorial in washington, d.c.. live coverage begins at 9 a.m. eastern on c-span. remarks now by the president of kaiser permamente bernard tyson. he spoke about the challenges facing the health care industry, changes brought about by the health care law.

and now his company is leading the industry in disease prevention and technological advances. this was hosted by the marines memorial association in california. this is about one hour and 20 minutes. >> -- association might like to welcome you to the program. the 21st century healthcare hold kaiser permamente in solving was wrong with health care in america with bernard tyson, president and chief operations officer for the kaiser health and hospitals. bernard tyson spent his entire adult life working for kaiser permamente playing a key role in making kaiser the recognized model for affordable health care in the future. this evening he will explore the current state of affairs within the health care industry and the likely changes health care reform will bring. as the president and chief operating officer of kaiser

permamente, america's largest nonprofit health plan and health care delivery system mr. kaiser will share his knowledge on the issues affecting the access, the cost and the quality of health care in the united states put the building on his career in the healthcare leadership, mr. speed will also provide perspective on the work that kaiser permanente is currently undertaking to serve as a model of quality and affordability for the future of the health care industry. ladies and gentlemen, please help me welcome bernard j. tyson. [applause] thank you, mike. it's great to be here this evening. i've been looking forward to this event. i have to tell you one of the

heads of the i.t. guys this year, and dick got on my case saying i was bringing my ipad and pieces of paper. [laughter] so i have not gone totally techie but i am getting very close. i am really happy to be here this evening. this happens to be a topic that i care a lot about and spend a lot of time going around the country talking about health care, presenting a case, which i will do with you this evening. using the analogy of a patient, healthcare as a patient, i want to describe to you why my theory that the patient is sick, and i want to walk you through some evidence around that so we can

come together, look at the symptoms of this patient that on one hand can perform miracles with episodic care. in fact in this country you have a heart attack, have a stroke, have cancer, you can't ask for something better in terms of resources that i've brought to give her to deal with the issue. and yet, on the other hand, i'm going to show you a chart in a few minutes where we spend more money than anyone on health care coming and we lived less in this country. you know, when i was preparing that slide, i had to think twice because when i tell you the average life span is i don't want anyone in this room to get nervous that we have now reached that point in your lives. so i want to present the slide with making sure you don't ask me what do i do if i live that

average state, bernard, that you've given to us. [laughter] then i want to provide a context for what i called the treatment plant, and i want to build it also is what you have been hearing about, which is the obamacare, and maybe offer to you some thoughts about the strategic intent obamacare and with the elements of our and then i want to end with evidence based practices to show you and share with you some of the many things that we are doing in sight of kaiser permanente as a case study for what is possible now that we have our 8.9, 9 million members all of the electronic medical records. now that we have the capability of looking at each individual via the automation, automatic

technology that's in front of us have been able connecting them into a population, steady trend and not come. what's happening with the quality-of-care and the quantity of care and what results we see a red the country as we care for a lot of people. so, if that is what entices you that is what i want to do this evening and i am indeed happy to be here. the last thing i would tell you as i jumped into this when mike sherrard the story he shared with you he didn't tell my comment. it's good to know i will catch the audience this evening. [laughter] great to be here. one more introduction as i done even to this because i am very careful to make sure that i do

not leave anyone with the impression that the issues and the challenges that i'm going to talk about is about we have that doctors in this country, the bad nurses. we have wonderful doctors, wonderful nurses. we have wonderful care givers who are working 24/7 to help people deal with some of the most complex issues that you can imagine, this thing called health care so i don't want to minimize. i am always awe-struck my gloor around the country and i go into our kaiser foundation hospitals. i was visiting one of our hospitals recently and i looked at this little baby that was in the bassinet in the i see you to the to -- icu and i watched the nurse care with compassion and care and tenderness and i thought for a moment that is what we are all about in health care to all the resources

necessary to make sure this one life has a chance to live. so as i talk about some of the issues i'm going to lay out for you this evening, and do not want in any way for you to conclude that i am drawing the conclusion that the problem is we have the wrong doctors or their room nurses, the wrong caregivers around the country who provide high-quality care every single day. i'm going to go through a few slides and base my comments -- did it moved? laughter could do that, doctor, or did you do it? sometimes i think he makes me believe i'm doing something. [laughter] and their works every single time. i will continue to believe that

it's all about me that i did this to be another doctor is over there doing it. [laughter] let me first start with my first slide which is the foundation for users to consider. what i plan to do -- and most of the time, most of the time when i speak i don't use slides, but i have decided to use slides for you this evening. number one because you are a very special audience. number two, and i mean this coming you are a very high iq audience if i want to make sure i don't blow it up here and give information you can't go back and actually check to raise additional questions. however, as i worked my way through the slide, i will give you as a college might cheat sheet talking points so you can plant certain statements in your

mind as i am walking through this so we can build a case for a good dialogue and a few minutes. >> the first slide i want to build on is what we call the future of care, and we believe strongly that for health care of the future to live up to its potential as the health care system there are three components that must be dealt with across this country. for high-quality care be as high as quality as possible. it's got to be accessible access is a major issue in this country. especially for the people who do not have coverage. and for the ones who are uninsured in most cases, they wait until it is too late and they show up in the emergency department which is the last place to be because it is the most expensive place to start your health care.

..

>> i will show you a slide about just how much we are spending in this great country to provide health care to the 300-plus million americans. and then the third one is a word that we call replicate. replicatabl replicatable. part of what i'm going to build on is take the mystery out of managing care and, in fact, we can show you within kaiser permanente that there's certain protocols that should be followed at all times to produce certain results that enhances the quality of care being provided to millions of americans. so in this country we're almost at about $3 trillion of health

care. by the way, the talking point for this slide is we are spending more and we are living less. so this slide is intended to bring two pieces of data for you to consider. the first one is to give you a snapshot of the per capita spending that's going on around the world. and then to show you point blank how the united states is spending in terms of per capita. the second slide is to show you, that given that, the average american is living about 77, 78 years. you will notice next door to the united states there's a slide called cuba, which is spending about a couple hundred dollars per capita and their average age is about 75 or 76. so one might question how is it

that we are spending so much money to provide care in this country and yet by one of the key indicators of health care being better, why is it that the average life span has not peaked at the 80, 80-plus average years on this earth such as what you will see in japan and some of the other areas? further to build my case is funding is not the issue, with the exception of the united states, china, japan, india and germany, what we spend on health care in the united states is more than the total economy of each other company with the exception of the five that i just mentioned to you. so in other words, we're spending more on health care in the united states than the total economies of every other country with the exception of the five

that i just mentioned to you. and it's going up. so we are on our way to $3 trillion with no end in sight. so who's covered? this has always been a fascinating piece of information for consideration. it is true that even though the numbers of americans who are covered by employers, that number is shrinking. number 1. and number 2, the amount of coverage is changing dramatically. and as you will see on this chart we still have approximately 161 million americans who are covered by their employer but many of the employers are covering a part of their health care coverage and many employees now are paying

for more and more of their own health care which is a growing trend across this country. next to the employer is both the federal and the state government as the biggest insurer of lives through this country. 34th medicare program we cover 32 million americans and the medicaid and chip programs usually at the state level we happen to cover another 42 million americans, about 11 million americans are covered by private individual coverage and then you'll see that number, which was the target of obamacare in which there's approximately 47 million americans who have no coverage at all. many of those americans we tend to have a mental picture of them being poor and downtrodden but

many of those americans are, in fact, working, very productive in society, simply can't afford the health care coverage, covering themselves and their family. so let's take a look at a dollar that's actually spent on health care. a dollar that's spent on health care. about 25 cents of that dollar -- and i'm talking about now a whole dollar that's actually spent on care, not all the administrative services and insurance fees and stuff like that. so a pure dollar spent on health care breaks down to about 25 cents on that dollar is spent for acute care, episodic care, hospital care and 75 cents on that dollar is spent on chronic care. spent on diabetes, heart

disease, another way of looking at the distribution of care is to look at my peer map that i like to show people around the country. and i don't want to make this complex, thank you. he's turning it. didn't i tell you. he turned it. [laughter] >> you can do it now. i don't want to make this complex for you but i want to make sure you get the message and i call this the 20/80, 80/20 start. so about 80% roughly of the american population is spending about 20% of the dollar. it's an easy way of looking at that chart. about 20% of americans are spending over 80% of the dollar. and if you look at the top of that pyramid, which is the 1% of

the americans, the 1% of the americans is spending about 30% of that 80%. that's usually in the last six to 12 months of life. that's the most car -- the cost of care is predominantly driven toward the end of a person's life and it's generally in the last six to 12 months. and i often tell this story of the -- the side-bar story about inviting newt gingrich to come and speak to our board several years ago. and how i did it actually -- i met newt gingrich on an airplane and we were in washington, dc, and the plane was delayed from san francisco and we started talking about health care, and he started talking about everything. like he likes to do. [laughter] >> and he would engage anyone in a conversation. and he was talking about

medicare. and he was making some statements and i said -- i'm not sure that's totally accurate and, of course, you don't tell him he's wrong. so he took me on and we had a very lively debate on the airplane while we were waiting to take off. and then i invited him to spend some time of kaiser permanente and i would approve it. and to his credit, he actually scheduled time and came and we showed him around and he left saying, i'm absolutely convinced that i was wrong. i've misspoken and i will correct that going forward. and then i invited him -- george halberson invited him to speak at the hospital and newt was talking about the cost of care and talking about, you know, how much we spend when a person is getting ready to die. and someone in the audience said

something like, well, do you have a theory why is that? it's very simple. there's two things american people don't want to do. pay taxes and die. and that's true. we pay a lot of money to figure out how to not pay taxes and we want to pay exactly what we owe and then we spend a lot of money to live forever. which by the way i plan to do the same thing. [laughter] >> so don't think i'm to be left out of this. as a result -- as a result, when you have a in this country is an enormous amount of resources that are applied to the last year is a general statement of a person's life but now let me dig a little deeper now that i've shown you that i think we can draw a compelling case that it's

not about the money. that we're spending a lot of money. and the idea the problem that we're not spending a lot of money many of you will argue inside the health care industry that's not the fundamental issue. health care will continue to go up and i'll show you some reasons why it will continue to go up and until we start to address those issues, we're not going to see the dramatic change that we need to see in the health care industry. so first let me start the first thing. the first problem we have inside of the health care industry is that -- the majority of the industry we're still using paper. can you imagine going to your bank right now and asking for your balance and they pull out a big medical record and say i'll give you your balance in about an hour and meanwhile you've done 10, 50, 100 transactions.

impossible. well, think about it. can you imagine and many of you may have experienced it what happens when you go to one doctor and you're getting care and that record is kept there in that office and then you go to the next doctor and this doctor did not communicate with that other doctor or they're trying to figure out how to get the information there. and when you have a is a complete collapse of the system paw the fundamental foundation is not there, which is information. i can tell you as a student of health care for over 30 years, it's night and day. even inside of kaiser permanente, where we now have every single one of our members connected to an electronic medical record. it means that any of our authorized caregivers can have access into that information anywhere, anytime for any reason.

it also means that we can monitor the care that's being provided to make sure that they are receiving the highest quality care possible and the coordination of that care is so much better because we are depending more and more on artificial intelligence to make sure that everything is working right inside of our health care system. and so think about someone who's taking, for example, a certain kind of medications who's in for surgery, our computer will go and cross-check to make sure that all the medications are aligned appropriately before that person has surgery. and in the not too distant future, if we have you on certain medications and you have a 30-day supply and, in fact, it's 45 days later and you haven't refilled your prescription, the doctor will be notified that he or she should see what's going on with you because you may be off of your important medication. and being able to look at 9 million members across the

country and to do some comparisons for members who are coming in for the same set of illnesses and seeing what the results are across the country and, oh, by the way, now we have all of our information stratified by ethnic groups. and so we are the only organization that can honestly say that we are looking at disparities in a very different way now because we actually have the data to show the differences and to explore what might be going on in the broader communities that is creating the ongoing disparity. the first issue of the two issues i want to highlight that health care is disconnected. and the information is not there and many inside of the health care industry are struggling with how much it will cost to build this kind of a backbone to, in fact, provide the efficiencies of care. and i don't want to minimize how expensive it is. it was an investment of several

billion dollars inside of kaiser permanente in which befelt the need to do it and we felt it was that important to our now 9 million members. second argument that i want to offer to you what's wrong is what i call the incentive system. so the first issue is the information. the second issue is the incentive. most of the organizations inside of the health care industry is based on a fee for service basis, which is a volume-driven basis. so you get paid for producing more volume. and so no matter how ethical and loyal and everything else that people are -- and they are around the country, the fact of the matter is, if you crack that chest for surgery you will get the money. and so the incentive system

itself is one that needs to be reformed in this country, we would argue, as part of what creates some of the perverse activities of what goes on inside the health care industry. what we do inside kaiser permanente and what we're doing for others are showing that there are procedures and protocols that we are doing inside of kaiser permanente that produces better and healthier outcomes that if we were on a fee for service basis, there isn't a billable code for how we will bill for those services that we are providing. and yet, because we are incented to do it, our members are generally much healthier. we prevent illnesses early on and, in fact, we move upstream to figure out what's going on with the member, the patient and then prescribing the appropriate treatment and medicine to make sure they're cared for in a proper way. so in a fee for service organization, the fact of the

matter is, the sicker you are, the better you are. the organization. i deal with colleagues all over the country that talks about doing things to cut patient days in their hospitals. but the problem is, when they cut it, then they lose revenue. and so they are challenged to figure out how to keep the bed full if, in fact, they are reinventing their delivery system. and as a result of producing a better outcome, they lose the money from the government or from the insurer and then they're trying to figure out how do i make up for that volume. so we would argue that the incentive system is wrong. there are many more arguments that i can make for you but this is building a case and i wanted to focus on what i think are two of the biggest challenges, which is the lack of coordination on the incentive system. with that, let me finish and then we'll open it up for

questions on the last part of my talk, which is to talk about -- and so what is really going on here? what are we trying to do? what is president obama trying to do? and why is this so complex as a country in terms of what we're trying to do? and obviously, this is a difficult topic because as many would say, under the obama -- president obama administration, it's all about jobs, jobs, jobs as the number 1 priority and then right in the middle of this, we have this thing called health care reform and i want to spend a few minutes shaping for you the intentions of it and why we believe there are many aspects of it that must get addressed as we go forward. as you know in march of 2010, in fact, the affordable care act

was enacted and a timeline was put together for it to be implemented across this country. many have heard about this magical date called 2014 but i will show you in a few minutes that, in fact, health care reform has already begun and there are aspects of it that's already in place and will continue to move forward through 2014 and beyond. one way that we look at it and what we've been working on inside kaiser permanente well before president obama took this on, this is one of our agendas which is the whole issue of reform and looking at what do we need to do in this country as part of the whole health care system? and we believe that there are three things that need to get addressed in reform.

coverage reform, care reform and then community reform. and that's been the basis of our agenda as we -- as we have been addressing this issue for many, many years. as an organization. the key aspects of the health care reform that was passed was number 1 that everyone should be covered. so a big part of this was to freeway -- access to everyone who needed coverage with mandates that i will talk about. the second aspect that the consumer would have choice. and that the government said it is important that we figure out how to make sure that there's competitive choice in the marketplace. and that was a fundamental building block to the

legislation. the third aspect was to begin to really look how, in fact, will we create incentives to compete on quality? how to begin to really deal with the systems in the health care industry and beginning to really focus on how we're going to pay the high quality being provided by the millions of care providers across the country. and then the fourth one is that we were going to figure out how to reward what we call high performance or performance. and so from those pinnacles are those approximately six major components of reform that i want to highlight for you that is critical. the first one is the individual mandate. and i'm sure you've heard a lot about this. this is a mandate that every american should have covered. and as you know, that mandate is being challenged in several

states but the fact of the matter is, it is still moving forward as a mandate and obviously we will see ultimately how it turns out. but the first mandate is that every individual would have coverage. the second mandate is that the employer is to continue to provide coverage. and when the debate was going on around the country about health care reform, there was a question and a concern as to whether or not the employers will start to dump the employees from their coverage and simply figure out how to pay or provide some kind of coverage to the government that then would assume that responsibility. and there was a mandate that the employer was still to provide coverage to the workforce and, obviously, that is a critical issue in this country. the third one is what we call the guaranteed issue. and this speaks to preexisting

conditions and other issues that a small percentage of the american people have had to deal with in the past. earlier i showed you that chart of 11 million americans who have to provide individual coverage. that is the group who has been challenged the most in the health care industry as they have went out to seek coverage. in most cases and most states and most cities, if you had a small group, for example, of three individuals and you called any of the insurers and you say i have a small business. i have three people. i want coverage, we would simply cover you. we will price it and tell you based on the risk, here's when you have a to pay for. you -- you have to pay for. they each go out and buy individual coverage there's a laundry list of coverage that is asked of them. and they say did you take an aspirin on january 5th, 1981,

and you say yes, and they say there's a preexisting condition, we will not cover. i'm being a little dramatic for the folks but that's how people feel when they were on the other end of it. what we did as a country is say, look, if i'm going to mandate that the person has cover, i want to make sure that they get the coverage and that they can get the coverage at a reasonable rate by creating competition inside the health insurance which is intended to help small businesses and others and that's called the health insurance exchanges. and so each of the states around the country are now putting together a theme called the exchange which ultimately is intended to give the consumer the buyer of health care more power to negotiate best rates with the coverer of care, the insurance industry. the fifth -- the fourth

component is to provide expansion of medicaid which is a way of insuring the next generation of people. and next is the accountable care organizations. this is an incentive to make sure that the providers are, in fact, being held accountable and can carry out what they need to provide the care that they feel is appropriate for the patients that they are carrying for. many of the providers in the health care industry have shared complete frustration with having to get approvals from nonphysicians mainly from the insurance industry to get approval to provide care that they feel is appropriate for their patient. and so part of this is to create a more level playing field by making sure that physicians and other qualified caregivers are,

in fact, building accountable organizations to carry out that responsibility. and then the last one is to create an incentive in which -- what is called the star quality ratings where health care organizations who achieve certain stars, up to five stars, will be paid, in essence, a bonus for that high quality performance. the timeline that i talked about as you will see up here goes all the way from 2010 in which we extended dependent coverage to age 26. as many of you may know, to 2011, we're into the annual rate reviews. and 2012, we have the quality bonuses that are rolling out. we have the hospital readmissions reform that's rolling out. we have the medicare, medicaid payment advisory board that is rolling out. so there are a lot of activities

that will be happening into the future and then in 2014 is when a guaranteed issue is in effect and the mandate, in fact, really take effect. so most of the media is focusing on 2014 but, in fact, there are a lot of parts of the health care reform that is in effect or being implemented as we speak. and so what we have here is from the health care reform, we believe that this is a good start in terms of beginning to reform insurance and cover it. but it is only a start. and we believe strongly that if we were only reforming the insurance, only reforming the coverage, we will not address the issues that i've described to you earlier because the most important thing that needs to be reformed is, in fact, health care. but we believe there is a model for the future inside of health

care and we believe strongly that if we as health care industry focus on re-engineering care, making care safer, making sure that we connect care, reprice care then we do believe that there is a role for regulation in very specific areas that we can, in fact, begin to move to a different level of performance health care around the country. so let me end with a story about kaiser permanente. first of all, we have about 9 million members now. and by the way, technically we have about 8.9 million members but people inside the organization know i always round up 'cause i like 9. [laughter] >> and that's a way of telling them, let's go get the 9 million members across the country.

but we are caring for almost 9 million americans across the country. inside of the 9 million, we care for over a million seniors through our medicare advantage program and we are extremely proud of that. we care for about 1.2 million hispanics. we care for almost a million african-americans. we have over 500 or so of our members who are well above 100 years of age and we are extremely proud of that group. and, yes, we are extremely proud of that group. and so we do a lot in terms of our care protocols across the organization. we have over 15,000 physicians who are working full time at kaiser permanente. when we open up a position of a physician in our organization, we get the masses who apply to

join permanente groups across the country, we have now over 160,000 employees around the country. and on top of that, we have about 25 to 30,000 -- what we call contingent workers. i have a goal to get to know every single one of the employers across the country and that keeps me active working my way around. we're nine states in the district of columbia. we have over -- we have 36 hospitals now that we own. and we have 431 medical office buildings. and this year, our revenue is about 45 billion. we're on our way to 52 billion in 2012. our mission is actually very simple. and i tell this story all the time that a lot of people don't know about how kaiser permanente actually came into existence. many people know about henry j. kaiser who was just a tremendous

individual when he lived here. and by today's standards, obviously, would have been a multibillionaire. but the secret is that when henry j. kaiser was a teenager, his mother died. and they were very poor as a family. and he had always said that he believed strongly that his mother died because he and his family did not have access to care. so after he made all of his money, did all the things that he did, he is on record as saying the most important thing that he will leave behind as his legacy is what is today known as kaiser permanente. so his jet stream and the mission that he put forward through the organization was to simply do a couple things. try to make the care as high as quality as possible. and make it as affordable to what we call the masses.

so everyone has a chance to a high quality life so for over 60 years, we've been trying to carry out that mission which as i call we simply wake up every day trying to do good. trying to help people when they need the help and trying to help people when they live as a healthy of a life as possible and as you may have heard, inside at kaiser permanente and through the world, we call that pride. part of the advantages of the kaiser permanente system in terms of organizations who have studied us and, in fact, we have been studied from all over the world and we spend a lot of time traveling around the world talking about the results of the kaiser permanente organization factually what's going on with patient care and the amount of care and how we bring it all

together. part of the reason why we have been successful and, in fact, bringing the care together is for these stated reasons. number 1, we're vertically integrated organization which means that we own many of the pieces inside as i call it the four walls of the kaiser permanente. so we own many of the pharmacies and we own lab and we own the technology and we own and we own and it was part of bringing together all the pieces that allowed us to really coordinate the care to make sure that the patient was getting what he or she needed inside of the four walls of kaiser permanente. the second advantage is we are a prepaid system, which means that -- and this was set up by henry j. kaiser when he first set up kaiser permanente which means that most or all of our purchasers of care pay out ahead

of time. as a result, we don't have the incentive to simply do a lot of volume stuff that then would create a lot of money. they pay us based on historical data based on what our plans and projections are and we are able to leverage those resources based on patient care based on the quality results that we get across the country. the third area that we have from day one focused in a couple of critical areas where the money is. prevention, which is to say you're healthy today and you're doing well today and we want to do everything possible for to you stay healthy because at the end of the day, no one is really waking up in the morning saying to themselves, i want to have a heart attack today so i could just see the great care at kaiser permanente. [laughter] >> and so we're working with you not to have that heart attack so you can go out and do the things that you want to do in life.

second area that we focus heavily on acute care and then we obviously focus extremely heavy on chronic disease management and chronic protocols across our program. and then we are technology enabled. that's not just the electronic medical records. we have leaned on technology to provide us the highest quality care possible. we, in fact, have studied the aviation industry to learn much more about how to provide the safest care possible from inside of our hospital settings and so we actually do protocols very similar to the airline industry to prevent unnecessary errors inside of our hospital system. and then the last thing is we obviously focus on the total health. i've already touched on that we are connected, which is the fully electronic care that we

provide over 10 million who are on medical records. we do over 30 million contact through the electronic use of data and information across our program. and we have the largest electronic medical library for care support in the country now. you can imagine, i'm sure, what it might be like to be a physician and how protocols are changing every single day. and the idea that someone can process all of that with their brains is just an expectation that is too hot for anyone. so what we've done we've complemented the brilliant physicians and other caregivers with the kind of artificial intelligence to assist them in the best practices and the best protocols that are going on across the country. the benefits of the activity you got 24/7 care being provided whenever -- wherever you want it. a couple of years ago i was on my way to italy and newly

married. and i told my wife i needed to stop by kaiser permanente. we pulled up at the oakland medical records department and i went in there and i said i'm on my way to italy and i need my information and about 30 seconds they took a flash drive and downloaded all my medical information and i was able to put it in my little pouch. as we were leaving the medical office building, i was, you know, feeling kind of bullish about how impressive that was. my wife said that's very impressive. i said yes, the only i got the state con -- i got to stay conscious to tell them i have the flash difficult. so the information is readily available to all of our members inside our system and now we're providing access to make sure that as people are traveling, they have all of their medical information available to them. we real time provider access.

obviously we could do a population management now. we have a project where our physicians what we call gone fishing. that means you go inside the system that you look all diabetic patients who have a hemoglobin of 9.0 who have not been in to see you in the last 6 to 12 months. they go in and they find all of those patients and they actively reach out to those patients and get them in and to do their physicals, do their checking and make sure the medications are fine. now, why do we do that? because we can prevent an emergency. we can prevent them from having to have their leg cut off or lose their eyes and those kinds of issues by managing their diabetes very early in the stages of their lives and last what i call the new waiting room. our members love the fact as a metaphor that you no longer have

to necessarily come in to our waiting room, sit in one of our chairs and usually read one of our outdated magazines. you can sit at home. you could be at the beach. you could be at the airport and you have access into your provider and be able to find out what you need from your care provider. we have had challenges with this especially for patients like myself and this is a true story. i had blood tests about six months ago and i went in on a saturday morning and had the blood test and it was 8:15 and at the lab. at 10 30 i was at the barber shop and my blackberry went off and i got a call from kaiser permanente and that my blood test results were ready and i got online and there's a thing where you can graph your blood results and see how you did over time and everything like that.

and then i saw one of my blood tests kind of went up a little bit and it was just a little bit but it was enough to really worry me 'cause i don't like my blood going up. and so i took a -- i sent the mental to my doctor and said, you know, i'm looking at my blood tests and okay, and it was a weekend and she didn't respond back until late sunday. and she looked at it and she said, you know, i looked at it. your blood is fine. you should stop worrying so much and wait until you see me in three months and i sent her a note back, wow, it took you sunday evening. i thought you would get back to me on saturday. [laughter] >> and then she sent me back a note, this is what's wrong with health care in america. [laughter] >> the challenge that we do have

is that with all this information and people looking at this and taking this kind of seriously and you start asking these questions and so being able to dial in as i call it directly to your physician has been very empowering for our members across the country. i've already touched on the electronic medical library that i told you about. we have key protocols. we have best practices. we have real time information. our caregivers, our physicians absolutely love it because they get the latest thinking and can make choices from the known best practices at any given time. this is one that i wanted to make sure i highlighted for you because i've touched on this before. we have 35 million visits that would be individually billed if we were in a nonconnected fee for service environment. so we literally -- we see about

50 million outpatient visits a year. close to 60 million a year outpatient visits each year at our kaiser facilities across the -- across the country. i like to brag all the time. you think disney land have a great crowd. we have the best one because we have millions of people who come in to our facilities every single day to get care. about 5 years ago, there actually probably wasn't anything like an e-visit inside kaiser permanente. now that we have the technology, it's just amazing. and this is for members to volunteer to use the e-visits and that is what they're doing much more as part of our service. so let me end on some of the successes based on the results of what we're actually seeing inside of kaiser permanente. we have 60% fewer heart attacks inside kaiser permanente. you may have seen the study that

was performed in terms of our heart care and heart care program in california and across the country. we have the highest screening and early detection for breast and colorectal cancer. that was a major initiative that we launched several years ago, which is really to say at kaiser permanente we want to focus on early detection, early screening and dealing with it up front and then we want to focus much more on critical care. we are one of the best in the nation on comprehensive diabetes care. our protocols are studied all over the world and how we care for the diabetic population inside kaiser permanente. we have fewer asthma complications from our protocols in how we work with families and children about early detection of asthma. how to care for asthma. how to treat asthma and the latest technology around it.

we have the broken bones program as we call it where through our programs across the country, we have reduced broken bones in particular for our elderly population now approaching by 50% as an organization and we rolled that out several years ago. 16 of our -- of the 53 leapfrog, which is a classification of top hospitals are now occupied by kaiser foundation hospital and health plan and we plan to get all of our hospitals to leapfrog status. ncqa -- we're one of the top health plans for commercial and medicare. and we've had a drastic reduction in hospital-acquired infection. you may have heard of this called sepsis, which people come in and get some kind of germ or infection that could have

detrimental effects. we have focused southwest the spire health care industry in this area but by using the aviation safety program, we have demonstrated that it is very possible to reduce. and we're on our path to having zero of sepsis-related deaths in all of our hospitals across the country as a role model to the rest of the industry that it is possible. and i equate that to a patient in a kaiser foundation hospital bed will be as safe as a customer getting on a united airline airplane and that's the safety record that we're going after in the industry. and then last is our commitment to affordibility, which is one of our pillars as an organization. the highest quality care possible and best care possible and most affordable care possibly.

we set a goal of a rate of 5% which is less than the rest of the industry and we're achieving those results pretty much across the country with the dedication of our staff with improving results. by doing this we can keep our expenses down which then translates to the rate that we then give out to the market. and that's the last point which is to keep our rates below the market. and even with that said, health care is still very expensive. even for members of kaiser permanente. and we keep that in front of us as our goal that we do not want to come across as if we now have reached that state of total affordibility when there's still millions of americans who can't afford kaiser permanente. so we are still working on

affordibility inside of kaiser permanente. thank you very much. [applause] >> we have a whole bunch of questions here. we have some time for some. i've really got them in four categories. and the first one you started with -- closed with, affordibility and cost. a flat cpi, why do health care costs continue to rise? another person wrote, you said that health care costs will continue to rise. why? explain, please. >> yes. several things. one is as the population continues to get older, the risk and the illnesses start to present themselves. and so when you have a going on

in this country is the fact that our population is getting older. and as you know, it's not also being replenished as much with children being born. that's the first thing. the second thing, probably the most important thing is to put on the table is that there are a couple of underlying issues that is wreaking havoc in this country and now i would offer to you around the world and that's called obesity. the fact of the matter is, obesity is the underlying issue for many of the issues that we're dealing with inside of the health care industry. and inside of our homes across america. it's what drives people to diabetes. the number of children now who is getting diabetes is startling. if you look at it across the country, the number of children who are dealing with obesity and parents who are trying to grapple with what to do with it.

in our society, we are still a fix me society. and so bariatric surgery and other types of techniques are very popular across the country. in a lot of cases they are warranted when appropriate and some cases people see it as the next best thing to deal with the issue that they have. there are two ingredients that is inside of obesity that we still have to come to terms with in this country. those two ingredients are sugar and salt. i don't want to minimize how difficult these issues are. i was -- i sit on the board of directors of the american heart association. and we were talking about this initiative that we're launching to try to get the american people to reduce their salt intake. and we wanted to get them down from the average male consumes

about 4,000, i think, it is, milligrams of salt per day. the average female about 3500. we want to get them down in the range of 1500 to 2,000. and i discovered and i didn't know this. i discovered that about 80% of what the average american consumes every single day in salt intake is already programmed in the ingredients in which you're eating. and so you got to back go all the way up to the chain where all of this is coming from. so it's those kind of issues and inside of the health care industry, it is very expensive to provide the care. insurance coverage, technology, malpractice, an aging population -- all those expenses are continuously going up. and we're not offsetting those with the efficiencies you want to see inside of the health care industry. and so every other industry outside of health care has figured out now how to improve

the quality and the service and reduce the cost inside of their industry. and that's the work that we still have to do. >> you mentioned the elderly. there's a question that deals with long-term care. is the culture dealing with long-term care or should we continue to look at long-term care insurance? >> you know, that's -- that's a great question. the whole issue that i touched on earlier about how to deal with the latter stages of life. and one is to focus on the long-term care issue. we are actually working on a very innovative project -- by the way, we're not the only ones although i think we're slightly ahead and that is to look at how we want to provide medical home care for families who are dealing with long-term illnesses, long-term crisis. how do we bring now the

technology and the intelligence of providing care into that -- into that environment? and we have several pilots going on in the northwest and denver and in parts of northern california. we have not gotten into the long-term care business so that is still a tough issue that we're working through inside kaiser permanente and as an organization. and so i wouldn't offer to you that we're looking at that kind of long-term insurance coverage, et cetera, but the issue of the provision of long-term care is definitely one of our priorities. >> staying with the costs and obesity, there's talk of dealing with a scale that everyone must be responsible for his or her own health. should there not be a sliding

scale that penalizes those with bad health choices? >> yeah, that's a great question. who asked that question? [laughter] >> we're debating this issue inside our organization, for example. one of our initiatives -- because we have 160,000 people who work at kaiser permanente and one of our initiatives is we want the people inside of kaiser permanente to be as healthy if not healthier like everyone else. and we were having a lively discussion on this exact topic which is what's the best approach to going after this? should we penalize in the form of increased co-pays and/or other means? should we create different incentives where if you eat healthy, we give you a better discount and those kinds of incentives, et cetera. we are struggling as an industry of how to deal with the issue of penalties because in most cases,

the penalties affect the people who need the care the most. one of the concerns that we have -- and we've studied this inside at kaiser permanente. we can show you the difference both in our studies and in the industry that as you begin to put more and more of the financial burden on the individual, the individual starts to make different choices about care that they're getting. .. >> and the fact of the matter is we end up paying much more to

provide that care. and inside of kaiser permanente, that is a cause because unlike many of our competitors, our members stay with us on average about 15 years or so. so we love it when our members join kaiser permanente because overall we know we'll have them for the long haul and, therefore, willing to make all kinds of investments in their health and well being because we'll be caring for them for years to come. so very tough topic in terms of what's the right balance for penalties and/or positive incentives for people who are practicing good behavior. >> do you want to switch to some technology, and you've mentioned and talked in great deal about electronic medical records. and people, several questioners have what is kaiser's particular

campaign now to make and prove that electronic medical records can be interoperable with other systems? >> we have, um, several projects that we're sponsoring across the country. we're doing, we've done one with the va to show that you can, in fact, build that interoperability, and we're very proud of that, and that's, in fact, up and running. um, we also have created a consortium in which we're looking at this whole topic with multiple organizations. and so what we are demonstrating and what we feel strongly about is that the information will need to flow across boundaries if we, in fact, are going to provide the highest quality care possible. it is, by the way, no different in my mind from taking, being able now to take my bank of america atm card and putting it into a wells fargo atm and

getting cash out. granted, i don't like paying that fee, but you can get the money out which is the point. and so as you think about, um, where you might end up at any given time requiring care, the ability to, um, seamlessly transport the information is really critical, um, across this country. it will also lead, ultimately, to, um, the public debate as to who owns the information. should it be the care organization, or should it be, in fact, the ownership of the individual which means that i can then freely transport that information anywhere i want at any given time when i, um, require care of the health care industry. >> folks, we're -- a lot of great questions here, many of them that you've asked, i think, he actually answered in his presentation, and we're really going to run out of time, but i do want to end it with a question that i think is much the theme of mr. tyson's talk. how do we as a nation change the

way we think about health in terms of wellness instead of illness? >> yeah. we, um, we did a little campaign that you may have heard about called thrive which really was, um, our, um, voice in the market to say that, um, people generally want to live, um, healthy lives. that in our research, um, we did not find people who aspire to bad health. we did not find people who are, um, praying to have a heart attack so they can deal with those complications. what we have also discovered is, um, health and health care is very, very complicated.

things that we may take for granted, um, other americans are suffering through. there are many neighborhoods in which there's no such thing as a grocery store. and so the idea that i can incent you to eat your fruit and vegetables is a foreign language when, in fact, there's nothing but liquor stores or, in fact, no stores around. we've closed parks across this country, and in some neighborhoods it's so dangerous you wouldn't dare go out at night. and so our incentives around getting people the exercise and active living, obviously, is a complicated topic. and then, um, as we said in our, um, thrive campaign, we do believe that good health and health, um, is a journey, it's an everyday journey. i'll end on this personal story. five years ago, in fact, i'm gettinad