Nadella envisions a new platform of “conversations” in which users interact with bots that induce them to eagerly disclose the details of their daily lives.111 The platform promises to deliver experiences such as “conversational commerce,”112 where, for example, a bot
knows what shoes you bought last week, it knows your preferences from your past purchases, it knows your profile and can call a recommendations model to determine what products you have the most affinity to buy.… Using the power of data and analytics, the bot can respond back with recommendations that it determines are most relevant for you. It can also invite people from your social network to help you make a choice. Once you make the selection, it will use your size information, shipping address, payment information to ship the selected dress to you.113
The release of Microsoft’s new operating system, Windows 10, in July 2015 drove home the seriousness of purpose and urgency that the corporation now assigned to establishing and securing supply routes to behavioral surplus.114 One software engineer writing in Slate described it as “a privacy morass in dire need of reform” as he detailed how the system “gives itself the right to pass loads of your data to Microsoft’s servers, use your bandwidth for Microsoft’s own purposes, and profile your Windows usage.”115
As many analysts quickly discovered, the system pushed users toward the “express install” function, in which every default setting enabled the maximum flow of personal information to the corporation’s servers. An investigation by tech website Ars Technica revealed that even when those default settings were reversed and key services such as Cortana disabled, the system continued to access the internet and transmit information to Microsoft. In some instances those transmissions appeared to contain personal information, including a machine ID, user content, and location data.116
According to an analysis by the Electronic Frontier Foundation (EFF), even users who opted out of Cortana were subject to an “unprecedented” amount of information capture, including text, voice, and touch input; web tracking; and telemetry data on their general use, programs, session duration, and more. The EFF also found that the company chose to hold security functions hostage to personal data flows, claiming that security updates for the operating system would not function properly if users chose to limit location reporting.117
In 2016 Microsoft acquired LinkedIn, the professional social network, for $26.2 billion. The aim here is to establish reliable supply routes to the social network dimension of surplus behavior known as the “social graph.” These powerful new flows of social surplus from 450 million users can substantially enhance Microsoft prediction products, a key fact noted by Nadella in his announcement of the acquisition to investors: “This can drive targeting and relevance to the next level.”118 Of the three key opportunities that Nadella cited to investors upon the announcement of the acquisition, one was “Accelerate monetization through individual and organization subscriptions and targeted advertising.” Among the key factors here would be unified professional profiles across all services, devices, and channels and Microsoft’s comprehensive knowledge of each individual user: “Today Cortana knows about you, your organization and about the world. In the future, Cortana will also know your entire professional network to connect dots on your behalf and stay one step ahead.”119
Once again, the market richly rewarded Microsoft, and Nadella, for the pivot toward surveillance revenues. When Nadella climbed into the CEO’s chair in February 2014, the company’s shares were trading at around $34, and its market value was roughly $315 billion. Three years later, in January 2017, the corporation’s market capitalization topped $500 billion for the first time since 2000, and its shares rose to an all-time high of $65.64.120
VI. The Siren Song of Surveillance Revenues
The unprecedented successes of Google, Facebook, and then Microsoft exerted a palpable magnetism on the global economy, especially in the US, where the politics of lawlessness were most firmly entrenched. It did not take long before companies from established sectors with roots far from Silicon Valley demonstrated their determination to compete for surveillance revenues. Among the first in this second wave were the telecom and cable companies that provide broadband service to millions of individuals and households. Although there is some debate about whether these companies can effectively compete with the established internet giants, the facts on the ground suggest that the ISPs are nonetheless determined to try. “Armed with their expansive view over the entire web, internet providers may even be in a position to out-Facebook Facebook, or out-Google Google,” observed the Washington Post.121
The largest of these corporations—Verizon, AT&T, and Comcast—made strategic acquisitions that signaled a shift away from their long-standing models of fees for service in favor of monetizing behavioral surplus. Their tactical maneuvers demonstrate the generalizability of surveillance capitalism’s foundational mechanisms and operational requirements, and are evidence that this new logic of accumulation defines a wholly new territory of broad-based market endeavor.
Verizon—the largest telecom company in the US and the largest in the world as measured by market capitalization122—publicly introduced its shift toward surveillance revenues in the spring of 2014, when an article in Advertising Age announced the company’s move into mobile advertising. Verizon’s VP of data marketing argued that such advertising had been limited by “addressability… the growing difficulty of tracking consumers as they move between devices.” As one marketing expert complained, “There isn’t a pervasive identity that tracks users from mobile applications and your mobile browser.” The article explained that Verizon had developed “a cookie alternative for a marketing space vexed by the absence of cookies.” Verizon aimed to solve advertisers’ tracking needs by assigning a hidden and undeletable tracking number, called a PrecisionID, to each Verizon user.123
In fact, Verizon’s incursion had launched two years earlier in 2012 but had been carefully hidden from the public. That was probably because the ID enables the corporation to identify and monitor individuals’ habits on their smartphones and tablets, generating behavioral surplus while bypassing customers’ awareness. The tracker can neither be turned off nor evaded with private browsing or other privacy tools and controls. Whenever a Verizon subscriber visits a website or mobile app, the corporation and its partners use this hidden ID to aggregate and package behavioral data, all without customers’ knowledge.
Verizon’s indelible tracking capabilities provided a distinct advantage in the growing competition for behavioral surplus. Advertisers hungry to redefine your walk in the park as their “marketing space” could now reliably target ads to your phone on the strength of the corporation’s indelible personal identifier. Verizon also entered into partnership with Turn, an advertising technology firm already notorious for the invention of an unusual “zombie cookie” or “perma-cookie” that immediately “respawns” when a user chooses to opt out of ad tracking or deletes tracking cookies. As a Verizon partner, the Turn zombie cookie attached itself to Verizon’s secret tracking number, adding even more protection from discovery and scrutiny. Turn’s chief “privacy officer” defended the arrangement, saying, “We are trying to use the most persistent identifier that we can in order to do what we do.”124
By the fall of 2014, Verizon’s stealthy new claim on free raw material was outed by Jacob Hoffman-Andrews, a technologist with the Electronic Frontier Foundation. An article in Wired called attention to Hoffman-Andrews’ analysis of Verizon’s surveillance program and his additional discovery that AT&T was using a similar tracking ID. The article quoted a Verizon spokesperson admitting, “There’s no way to turn it off.”125 Hoffman-Andrews observed that even when customers opt out of Verizon’s targeted ads, its tracking ID persists, as the corporation bypasses or overrides all signals of a user’s intentions, including the Do Not Track setting, Incognito and other private browsing modes, and cookie deletion. The ID is then broadcast to every “unencrypted website a Verizon custo
mer visits from a mobile device. It allows third-party advertisers and websites to assemble a deep, permanent profile of visitors’ web browsing habits without their consent.”126 Alarmed by the threat of fresh competition, Google, posing as a privacy advocate, launched a campaign for a new internet protocol that would prevent “header injections” such as Verizon’s PrecisionID.127
Privacy expert and journalist Julia Angwin and her colleagues at ProPublica reported that similar tracking IDs were becoming standard throughout the telecom industry. As one ad executive put it, “What we’re excited about is the carrier-level ID, a higher-level recognition point that lets us track with certainty.…” Hoffman-Andrews would eventually call the telecom’s tactics “a spectacular violation of Verizon users’ privacy.”128 True as this may be, the corporation’s tactical operations suggest an even more far-ranging development.
Verizon would not retreat from the territory already claimed with its incursion. The hidden ID would stay, and the company assured customers that “it is unlikely that sites and ad entities will attempt to build customer profiles.”129 However, it didn’t take long for experts to discover that Twitter’s mobile advertising arm already relied on the Verizon ID to track Twitter users’ behavior.130 Then computer scientist and legal scholar Jonathan Mayer found that Turn’s zombie cookie sent and received data from more than thirty businesses, including Google, Facebook, Yahoo!, Twitter, Walmart, and WebMD. Mayer investigated both Verizon and Turn’s opt-out policies and found both to be deceptive, concluding that every one of Verizon’s public statements on the privacy and security of its tracking ID was false. “For an ordinary user,” he wrote, “there simply is no defense.”131
Verizon’s substantial entry into surveillance capitalism necessarily tethered the corporation’s interests to the extraction imperative. We can see this in the way that Verizon discovered and implemented the dispossession cycle, moving rapidly through its sequence of tactical phases from incursion to redirection. Verizon’s initial incursion bought it three years of internal experimentation and discovery. During that time it crossed the threshold of public awareness, beginning the gradual process of public habituation to its new practices. Once its strategies were public, it endured a barrage of critical news articles and the scrutiny of privacy experts, but it also bought more time to explore revenue opportunities and supply route expansion. Public reaction to its incursion forced the corporation to map the next phases of the cycle.
Public pressure triggered the shift toward adaptation in early 2015. An FCC investigation into Verizon’s illicit tracking practices had been launched a few months earlier. The Electronic Privacy Information Center circulated a petition in January 2015 demanding that the FCC penalize the company. By the end of that month, the Senate Committee on Commerce, Science, and Transportation published a letter to Verizon expressing “deep concern” over its new practices.132 The committee chastised Verizon and Turn for their “seemingly” deliberate “violation of consumer privacy” and “circumvention of customer choice.”133 Within a day of the letter’s publication, Verizon announced, “We have begun working to expand the opt-out to include the identifier referred to as the UIDH [unique identifier header], and expect that to be available soon.” The New York Times called Verizon’s announcement “a major revision of its mobile ad-targeting program.”134
The Times could not have known that the redirection phase of the dispossession cycle was already in motion. In May 2015 Verizon agreed to purchase AOL for $4.4 billion. As many analysts quickly appreciated, the real attraction of AOL was its CEO, Tim Armstrong, the first head of advertising sales at Google and the man who oversaw its transition from Madison Avenue–style advertising to AdWords’ breakthrough discoveries. He was president of Google’s Americas sales division when, like Sheryl Sandberg before him, Armstrong left Google for AOL in 2009 with a profound grasp of AdWords’ surveillance DNA and the determination to rescue AOL’s balance sheet with surveillance capitalism gene therapy. As Verizon’s president of Operations told investors, “For us, the principal interest was around the ad tech platform that Tim Armstrong and his team have done a really terrific job building.” Forbes observed that Armstrong needed Verizon’s resources “to challenge the duopoly of Google and Facebook.”135
Any serious challenge to the giant surveillance capitalists must begin with economies of scale in behavioral surplus capture. To that end, Verizon immediately redirected its supply routes through AOL’s advertising platforms. Within a few months of the acquisition, Verizon quietly posted a new privacy notice on its website that few of its 135 million wireless customers would ever read. A few lines slipped into the final paragraphs of the post told the story: PrecisionID is on the move again. Verizon and AOL would now work together “to deliver services that are more personalized and useful to you… we will combine Verizon’s existing advertising programs… into the AOL Advertising Network. The combination will help make the ads you see more valuable across the different devices and services you use.” The new notice asserted that “the privacy of our customers is important to us,” though not important enough to compromise the extraction imperative and allow raw-material providers to challenge the corporation’s dispossession program. Opt-out procedures were available but, as usual, complex, difficult to ascertain, and time-consuming. “Please note,” the post concluded, “that using browser controls such as clearing cookies on your devices or clearing your browser history is not an effective way to opt out of the Verizon or AOL advertising programs.”136
The FCC settlement with Verizon was another gloomy example of a public institution outmatched by the velocity and resources of a determined surveillance capitalist. In March 2016, long after the announcement of Verizon’s tactical redirection, the FCC reached a $1.35 million settlement with Verizon over its hidden ID privacy violations. Although Verizon agreed to relaunch its cookie on an opt-in basis, the settlement did not extend to AOL’s advertising network, which is where the action had moved. Verizon’s burgeoning new supply routes would remain unchallenged.137 Later that month, Armstrong would meet with ad buyers, a rendezvous described by the Wall Street Journal as “his first real chance to pitch that AOL—fresh off its sale to Verizon Communications Inc.—intended to become a credible threat to Facebook Inc. and Google.…”138
On March 31, 2016, the FCC issued a Notice of Proposed Rulemaking that would establish privacy guidelines for ISPs. The companies would be allowed to continue to collect behavioral data that enhanced the security and effectiveness of their own services, but all other uses of “consumer data” would require opt-in consent. “Once we subscribe to an ISP,” FCC Chairman Tom Wheeler wrote, “most of us have little flexibility to change our mind or avoid that network rapidly.”139 The proposal was aimed exclusively at ISPs, considered under the jurisdiction of the FCC, but did not include internet companies, which the Federal Trade Commission is charged with regulating.
In light of the high-stakes dispossession competition already under way among key ISPs, it is not surprising that the proposal quickly became a political lightning rod. ISPs, their lobbyists, policy advisors, and political allies lined up to kill the effort, stating that ISPs’ competitive prospects would be unfairly impeded: “Telecom companies are against this proposal, arguing it puts them on an unequal footing with other internet companies that collect data on users, like Google.…”140 In October 27, 2016, FCC commissioners in a 3–2 vote delivered a landmark ruling in favor of, in this case, consumer protection on the internet. It was a historic day not only in the young life of surveillance capitalism but also in the venerable and long life of the FCC, an agency that had never before passed such online protections.141
Neither the original FCC proposals nor the final vote chilled Verizon’s bid for economies of scale in behavioral surplus. If law was coming to its town, it would simply buy a new town without a sheriff. In June 2017 Verizon closed on the purchase of Yahoo!’s core business, thus acquiring the former internet giant’s one billion act
ive monthly users, including its 600 million monthly active mobile users, for a mere $4.48 billion.142 “Scale is imperative,” Armstrong had told journalists a year earlier.143 “If you want to play in the Olympics you have to compete against Google and Facebook.”144 Armstrong touted Verizon’s advantages: its complete view of users’ behavior and download activity twenty-four hours per day and its continuous tracking of their locations.
By 2017, the elements of Verizon’s new ambitions were finally in place. The new internet company headed by Armstrong and dubbed Oath would combine Yahoo! and AOL for a total of 1.3 billion monthly users. As the New York Times summarized, “Verizon hopes to use its range of content and new forms of advertising to attract more viewers and marketers as it competes against Google and Facebook.”145
In a chilling epilogue to this chapter in the history of surveillance capitalism, on March 28, 2017, a newly elected Republican Congress voted in favor of a resolution to overturn the broadband privacy regulations over which the FCC had struggled just months earlier. The rules had required cable and phone companies to obtain meaningful consent before using personal information for ads and profiling. The companies understood, and they persuaded Republican senators, that the principle of consent would strike a serious blow to the foundational mechanisms of the new capitalism: the legitimacy of unilateral surplus dispossession, ownership rights to surplus, decision rights over surplus, and the right to lawless space for the prosecution of these activities.146 To this end the resolution also prevented the FCC from seeking to establish similar protections in the future. Writing in the New York Times, Democratic FCC appointee Wheeler went to the heart of the problem:
The Age of Surveillance Capitalism Page 21