Gazetteer of the Weird

To start the DROP process, you must first create a Login.gov ID. This is an incredibly invasive process that involves photographing multiple pieces of ID and taking several selfies using special apps and webpages that hijack your device's camera and processor in a bid to prevent bad actors from spoofing the process. There's a plausible reason for this rigmarole: Login.gov is the authentication system for multiple federal, state and local IT systems in the US, so a fake or stolen Login.gov ID could be used to access your IRS, Social Security, and other very sensitive accounts.

The corollary of this is the promise of Login.gov: once you create your ID (a lengthy, multi-stage process) you won't have to jump through lots of painful bureaucratic hoops to access a wide variety of government services.

DROP didn't get the memo.

After you log in to DROP via Login.gov, you are sent a text message – to the phone number in your Login.gov profile – with a link to access a "secure" website that takes over your camera to let you take a "secure" photo of the front and back of your California driver's license or your US passport. What if you don't have either of those? I guess that means you want to be spied on by data brokers.

Note that these are the same credentials you have to supply to get the Login.gov ID that you've just used to get to this step in the process. In other words, in order to get to the stage where they ask you to photograph your driver's license, you have to have already photographed and validated your driver's license.

Once you complete this (pointless, redundant) step, you're directed back to your computer, where the process continues. Here, you must fill in all kinds of biographical detail, as well as specialized pieces of information, including your car's VIN. This is a piece of information that most people don't have – but which the California DMV does have and could auto-feed into the system, given that you've repeatedly affirmatively identified yourself to the service.

You also have to provide your mobile advertising identifier, a long, unique number that you may or may not be able to extract from your phone, depending on the model and the OS version. If you can't get it that way, you can install an app like AAID, which comes with a long list of – you guessed it – permissions to extract, store and process your private information.

Here's the thing: the whole point of a mobile ad identifier is that apps can access it (this is how they identify and track you). That step, where the system made you switch to your phone and use your camera to photograph your driver's license? That step could have automatically pulled this data off your device. That's the whole fucking point of this exercise: that web-pages and apps can request your mobile ad identifier.

Instead, DROP wants users to dig through their phone's deepest settings and/or install an app to retrieve a 32-digit number, which they then must key into a webform on their computer or in a different app on their phone.

Once you've done this, you must fill in another page of biographical information, including information that you've already provided to Login.gov and information you've already filled in on previous screens.

On this screen, you must also verify your phone number by sending yourself a text and then pasting in a unique number the system sends to you. But remember how this whole thing started? The first step is that you authenticate with Login.gov, which sends a text to your phone so you can take a (redundant) picture of your driver's license. There is no way you could get this far in the process unless you controlled the phone number you've just "verified" with the system.

Next, you must verify your email address, by receiving an email with a unique code in it and keying or pasting that into the webform, too. Again, remember how this process started: with you logging in with Login.gov, using your email address, which the system has already treated as verified since the very start of this (very) long and (very) complicated process.

This whole thing is terrible, and it is predicated on the absurd premise that Californians have to be defended from the threat of strangers who pretend to be them in order to sneakily opt them out of surveillance. DROP requires stronger authentication than any other US government system I've ever interacted with. I file my tax returns with fewer authentication steps. I renew my car's DMV registration with fewer authentication steps. I became a US citizen with fewer authentication steps.

This is either a system with no coherent threat model, or (far more probably), its threat model is that people will use it. This is California's answer to "a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard'":

https://en.wikiquote.org/wiki/The_Hitchhiker%27s_Guide_to_the_Galaxy

It's especially instructive to compare this process to the steps you have to take in order to "opt in" to having a data broker open a file on you and stuff it full of your sensitive, personal information, which is then sold to all comers:

Step one: Exist.

Step two: There is no step two.

It's also instructive to compare this process to the steps a data broker has to take to spy on you and sell your data:

Step one: Exist.

Step two: There is no step two.

Though there are many obvious ways this could be made better, I want to stress here that you shouldn't have to do this at all. It's entirely backwards. The process for not being spied on should look like this:

Step one: Exist.

Step two: There is no step two.

If anyone is going to be forced to jump through hoops to participate in the mass collection and catastrophic mishandling of private data, it should be the data brokers, not the people they spy on.

This kind of malicious compliance is the inevitable outcome of a process that starts by taking the obvious best measure off the table. The answer to the problem of data brokers is banning data brokers, not creating a demented hairball of form-filling that maintains the fiction that data broker surveillance is consensual.

In its own way, this process reminds me of the whole "carbon credit" fiasco. The answer to too many carbon emissions is to democratically decide to ban certain kinds of carbon emissions. But that would require states to do things, rather than simply "nudging" a process that is guided by "the market." So we end up with these junk "credits" that companies manufacture by promising not to log forests, many of which are already wildlife preserves and/or subsequently burn down:

https://pluralistic.net/2023/10/31/carbon-upsets/#big-tradeoff

The best critique of this whole thing came in 2021 from the Climate Ad Project, who produced a short video in which people were allowed to kill one another provided they purchased "murder offsets":

https://pluralistic.net/2021/04/14/for-sale-green-indulgences/#killer-analogy

In a state of nature, murder exists. We, as a society, have decided this is bad. Rather than creating "incentives" not to murder, we just banned murder. Admittedly, we still get some murders, but when these happen, we don't treat it as "a mispricing of the anti-murder incentive" – we treat it as a crime.

The commercial surveillance industry may not be a criminal enterprise (yet), but it is the source of a torrent of crime, a flood of crime, a tsunami of crime. Every piece of your information that a data broker possesses exposes you to the risk of being victimized by a criminal. For this reason, I strongly believe that you should go through the tedious, performatively difficult DROP process:

https://consumer.drop.privacy.ca.gov/

But let's not pretend that this is good – or even adequate. There is no demand for being spied on. There is no basis for taking such enormous care in making sure people aren't maliciously removed from surveillance databases. If these databases exist at all (they should not), then we should make spies go through all this paperwork, to prove that you do want to be spied on, and unless they manage it, then spying on us should be treated as the crime it is.

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog: