Thank you Chairman Crapo and to the committee for inviting me to speak today.

My name is Maciej Ceglowski. I run a small online business called Pinboard, and I operate what in Silicon Valley is considered an extremely exotic business model: I take a small amount of money, 11 dollars a year, for a useful service.

As you know, in my world the economic basis of the Internet is mass surveillance. We all have some sense [of] the extent to which our behavior is being constantly monitored, not just the data we provide to the services that we use, but the observations that computers make about us in every aspect of private and public life.

This data is simply not regulated. As a tech person, I'm not used to wearing a necktie. Putting mine on this morning, I saw that there was a small tag on the back of it. I realized that my necktie is better regulated than my entire industry. We collect this data; we have no transparency in what we do with it; and we are simply deceiving the American people -- because, as a technologist, I know that we lack the technical capacity to keep large collections of user data safe over time.

And I think you've seen in the news the litany of data breaches, year after year, time after time -- whether from industry [or] from government. It is simply easier to attack computer systems than it is to defend them, and that reality is going to hold for the foreseeable future.

I worry that we're in [the] same position as the nuclear industry was in the early 50s: We have an amazing new technology, with real potential, but we are not being honest about the risks and our incapacity to store a wasteful and harmful byproduct for periods of time much longer than how long the companies storing them have existed.¹

The last reactor in the United States was built in 1977, and the reason that we don't have new ones is in large part because we don't have the public trust. As a small businessman in a big industry, I worry that we are losing the trust of our users. It is hampering our ability to innovate because every time someone uses a computer service or product, they have to ask themselves: "What am I giving away?" "Where is it being stored?" And they're not getting clear answers. People are being asked to make irrevocable decisions about their online lives over and over again.

The pattern that I've seen in my industry is one of deceit. We are not honest about what we collect, the uses we put it [to]; and we are ashamed, frankly, of our business models. (I'm not ashamed of mine. Like I said, I take a small amount of money and I provide a service; and if you don't like it, I refund your -- your 11 dollars.)

But you'll never get someone from Google or Facebook to speak honestly about what it is they're actually doing with their data, and the uses they put it to. Instead, what Silicon Valley seeks to do is evade. They see a regulation and they find a way around it.

- We don't like banking regulations, so we invent cryptocurrency and we're going to disrupt the entire financial system.

- We don't like limits on discrimination in lending, so we're going to use machine learning, which is a form of money laundering for bias, a way to blame mathematical algorithms for the desire to simply avoid rules that everybody else has to play by in this industry.

- And we see now that Facebook is about to enter the -- the banking system -- again, through the side door -- by releasing its own cryptocurrency.

I worry about this because Silicon Valley has been a force of dynamism. It's one of the great success stories of American capitalism, and we're putting it at risk right now by not having sensible regulation in place that creates the conditions for innovation.

I came to the United States as a kid from Communist Poland. And I remember calling my father sometimes, a very expensive phone call, and every few minutes it would be interrupted by a recording that said: "Rozmowa Kontrolowana."² And that was the Polish government informing us that the conversation was being listened to by the Secret Police.

At least the Polish state had the courtesy to say that it was eavesdropping.

We should at least give people that courtesy -- have openness into what is being collected, what is being done with it, and give some sense of agency so that people no longer feel like their data is being extracted from them. And we can have new business models and a new flourishing again of innovation in an industry that was once famous for it.

Thank you very much.