The burgeoning anti-trans surveillance state
As Ohio prepares this month to hold hearings for its proposed rules, it seeks to move forward with a nebulously-defined data collection strategy that, they say, would allow the state to monitor trends in the provision of transgender care across the state.
The rules would require healthcare providers to regularly report concerningly granular detail about the patients who receive care. The requirements are onerous, and raise substantial civil liberties concerns that are becoming increasingly more important as we head into a contentious election around which the GOP has long held it will center anti-trans policies. DeWine announced these after his executive order issued after his veto of HB 68.
While DeWine claims it’s about monitoring the care being given, the focus of the data appears to be on patients. As Zinnia Jones reports, the scale of the proposed data collection is itself quite large: if the final rules are inclusive of adults, the combined adult and pediatric population of Ohio is estimated around 54,000 people. Even if the final rules are only restricted to youth, there’s very good reason to be quite concerned about the detailed medical information of 8,000 young people in the hands of a trans-hostile state government (see: Gender Analysis).
“This is intrusive, completely unwarranted, and an alarming escalation in the ongoing targeting of trans lives by right-wing administrations. The government has no business creating a list of who has transitioned, and transitioning in Ohio should not come at the cost of one’s medical privacy.”
The data requirements ask for age, demographics, any diagnoses and prescriptions, as well as the provision and duration of gender-affirming medical intervention which broadly speaking includes a very large list of potential interventions. It additionally seeks information on people who discontinue treatment or detransition. The data is exhaustive, and the Governor intends to publish it in aggregate every six months. While the government assures anyone reading this that the information thus collected will be de-identified, there’s ample reason to distrust that this will be true.
In the second notice for 3701-3-17, a memo atop the revised proposed rules includes a bullet list of changes, among which it includes “In response to privacy concerns, the rules are now even more clear that the data collected will not identify individual patients”, but any halfway-decent information security professional will tell you that ostensibly de-identified information is much easier to re-identify than we often want to admit.
As Latanya Sweeney (2000) discovered over twenty years ago, it’s possible to identify a specific person with only 3 pieces of information. But that was twenty years ago.
Researchers have since shown that using statistical models, identifying people using only credit card metadata was successful 90% of the time using simple seemingly useless pieces of information like the price of a sale, the location of the store and the time purchased. The study (2015) refers to these as “geospatial indicators” which can be used to monitor behavior. Similar research has shown that scientific datasets are prone to “re-identification”, which can allow someone to ascertain an individual study participant’s identity from data that has supposedly been de-identified in accordance with research ethics requirements. Ten years ago Sweeney again went on to demonstrate that it was possible to re-identify 40% of anonymous participants in the the Personal Genome Project. Today, generative AI models can be used to launch even more sophisticated attacks with astonishing accuracy.
While most of these re-identification attacks utilize data which will not be provided, at least to the public, inclusive of zip code and dates of birth, the relatively small size of the transgender community alongside the potentially unique combination of factors might make it possible to re-identify data even absent the indicators discovered by Sweeney. Certain procedures, such as phalloplasty are still rather rare due to the substantial burden of recovery involved in a multi-stage procedure — which is highly tailored to the individual patient. Since most clinics only do a handful of these procedures, even knowing the month that a surgery was done could be enough to link back to a specific patient.
Unlike what DeWine’s administration appears to be suggesting, data collection in academic research involves a dizzying array of information security and ethics protections often invisible to even participants. Data safety monitoring boards are comprised of third-party professionals who hold expertise in research ethics as well as the issue being studied. They ensure not only that best practice data privacy standards are adhered to, but that the manner in which the data is collected affords the least amount of potential risk to the person whose data is being collected. Data must be collected with consent, and with the explicit purpose of benefitting the community. DeWine’s regulations meet none of these criteria. If anything, as thousands of concerned citizens have provided written testimony to oppose these guidelines attest, it is done non-consensually, against our will and our express interests.
There are also substantial concerns over the collection of this data by a government entity, and that such data might exist in in raw form on servers. The aggregate data will likely be shown on the Ohio Department of Health’s impressive data reporting page but there is also an implied threat that DeWine laid out when he announced the initial rules. While he claimed that he was trying to protect the rights of trans people in vetoing HB 68, his rules thus proposed were in fact worse than the initial bill, and he implied that carefully monitoring outcomes data may lead to policy changes down the line. In other words, if his administration is able to justify it, they may propose even more stringent requirements or ban gender-affirming care across the board.
There are also research methodology concerns that make it more likely datasets like this will give unreliable information, skewed to fit the narratives which serve the interests of anti-trans actors.
Ohio’s strategy poses several key problems that would be obvious to anyone with a basic background in trans health research. The strategy before JCARR proposes to track the number of patients receiving care and those who at some point stop receiving care from that clinic. Those who stop, will be seen to have “detransitioned” for the purposes of analysis. This presents the first intractable problem with the proposed strategy, which is why longitudinal data is so hard to collect on gender-affirming care without large grants and enormous sample sizes: without uniquely identifying information passing between providers in the state which could be used to identify the same person at multiple clinics, a data analyst has no means of ascertaining the difference between a patient who stops filling their prescriptions and starts to fill them somewhere else. Moreover, that same person may be counted twice, simultaneously artificially inflating the recorded number of people accessing gender-affirming care in the state, while also creating the multiple “false positive” scenarios described above.
This problem is not unknown, such a sampling strategy has already been identified as a terminal flaw in the 2022 study of gender-diverse people receiving hormone therapy at a US military healthcare facility. While most studies examining contemporary discontinuation rates reveal enormously low rates of discontinuation over a similar time frame, that study stood out as reporting a 30% discontinuation rate over a 4 year period. But this is only an example of loss to follow up (LTF), which competent researchers understand as being distinct from prime facie evidence of discontinuation. Such an issue was alluded to in the limitations section of the paper, admitting that there was no way to discern from the data why someone was no longer seen filling prescriptions. In effect, the study authors admit that in that way, this is a essentially single-clinic study, not one that can be remotely generalized to the general population.
However, there are several additional problems with this method from a purely scientific and evidentiary perspective. Other evidence demonstrates that many transgender people start hormone treatment with the a priori intention of only using them for a small period of time, or who, upon achieving certain milestones choose to stop based upon satisfaction with the progress thus seen. Many also choose to stop simply because HRT was not ultimately something they realized met their embodiment needs, but remain in their affirmed gender. Transgender people are additionally more likely than our cisgender peers to lack access to basic healthcare, insurance, or stable finances. Thus, what may appear to be a discontinuation of desire to take HRT could just as easily reflect financial hardship or job loss. Medication shortages are additionally unaccounted for in any plans thus proposed.
So why propose the data collection at all? There are several answers to this question, but no reasonable interpretation of the facts as we know them thus far suggest that such an interpretation includes a genuine desire on Mike DeWine’s part to improve the quality of care for trans and gender diverse people. Nor could it be reasonably interpreted as an adequate estimation of detransition rates, which cannot be accomplished for all of the above reasons. Even if someone were to create a unique identifier to facilitate the tracking of patients across facilities and pharmacies— thus making it identifiable data— this would only account for those that stay in Ohio. Simply put, these data provide no scientifically useful information, yet still require compromising enormously on the privacy of transgender people.
Dewine’s rules are not the only ones attempting to enact widespread surveillance of trans people. They mirror similar data reporting requirements proposed by Florida and MIssouri, which have been decried as an enormous threat to the safety of our community and civil liberties at large. This is especially true in the wake of Dobbs, which overturned one of our biggest tools in our legal arsenal to protect the privacy between patient and doctor as a constitutional right. After being modified after the initial public outcry, the proposed rules still require exhaustive detail comprising what is, in effect, a registry for all recipients of transgender care and the providers who make it possible.
However, care provision data isn’t the only data being sought by states. Several Attorneys General have launched invasive probes attempting to force LGBTQ family support organizations like PFLAG to provide sensitive information about their membership, such as when notoriously corrupt Texas AG Ken Paxton demanded information on families creating contingency plans in the wake of massive anti-trans escalation. Thankfully at the time of this writing, a district court judge has granted a temporary restraining order on this massive overreach. In December 2022, Paxton also demanded data on the number of people who had changed gender markers on licenses, which evolved into a demand for a list of names and license plate numbers of transgender people in the state. One can only infer why license plate numbers would be useful in such a situation, and all of the potential uses for such data are terrifying.
In Florida, DeSantis has demanded state universities give up comprehensive information on trans students which are specific enough to create an identifiable registry of trans people in the state, even in their allegedly de-identified form. The methodologies described above have already successfully been used with the Florida data to re-identify individual patients. This also comes atop a flurry of subpoenas and demand notices for trans patient data targeting pediatric hospitals across the country, such as that sought by Indiana AG Todd Rokita. Perhaps one of the mot worrying examples includes TN AG Jonathan Skrmetti’s disingenuous “medicaid fraud” investigation into Vanderbilt University Medical Center’s transgender clinic which prompted the hospital to turn over patient records. VUMC is now being sued by those patients as an enormous breach of trust and medical ethics.
All this occurs as states increasingly demand trans people carry identification that would out them as transgender, either by blocking legal gender marker changes or by requiring special indicators on licenses and other state identification that would indicate if the ID-holder is transgender to a police office or anyone else requiring ID, such as a store clerk ringing up a sale for alcohol. In such scenarios, privacy and safety go hand in hand. Research consistently demonstrates that people whose gender modality is “outed” involuntarily are at elevated risk of interpersonal violence. Groups like the ADF are working hard to force schools to out trans youth, while bills are being proposed to require any suspected gender identity questioning or non-conformity in writing.
And yet all of this happens in the context of the Kids Online Safety Act (KOSA) which would require age verification for anything deemed “adult”. What constitutes adult? Bill Co-sponsor Marsha Blackburn indicated to the Heritage Foundations’ Family Policy alliance that her hope is that it will be used to “protect children from transgender content”. Digital privacy groups like Electronic Frontier Foundation have warned that KOSA will require online platforms to report evidence of emerging mental health challenges such as self-harm or purging. As states continue to argue that gender dysphoria should be reported and surveilled, and that transgender identities are evidence of mental illness, it is easy to imagine a future where big tech is reporting queer youth to states which very much do not have their best interests in mind. At the very least, it would create an infrastructure in highly LGBTQ-hostile states to surveil LGBTQ young people, looking for reasons to prosecute adults offering affirming content. If that sounds far off, remember that last year DeSantis started sending undercover agents to drag shows with this express purpose. Florida is already moving to enact its own version of KOSA at the state level with House Bill 3.
Parent’s Defending Education’s IndocriNation Map
We’re also seeing a rapid rise in the launching and use of reporting platforms, such as that which the Indiana Attorney General recently launched. AG Rokita’s new website allows members of the public to report people for, among other things. supporting transgender youth or even acknowledging they exist in curricula. The blueprint for this was created by groups like Moms for Liberty who provided facebook groups for this purpose. It was perfected in a horrifying sort of way by Cato Institute-funded group Parents Defending Education, who publish an “Indocrination Map” that allows aggrieved parents to write detailed reports about their child’s teachers, as well as upload documents.
Some of these documents include specific information about youth. One such report includes a suspension notice complete with dates, times and locations. PDE frames the incident as one where a child was suspended for an innocuous slip of the tongue. But the page includes the actual slip, which goes on to report that the suspended child was also heard referring to the trans boy in question as “it”.
The intention is obvious: to create an environment where schools can be targeting for sustained harassment campaigns and teachers feel that they’re being watched all the time. This occurs at a time where legislation is threatening teachers with penalties simply for affirming trans youth, and is likely intended at least partially to try and coerce teachers into forced outing of trans youth to their families, and in some cases to their peers. The stakes are not small. In Missouri, HB 2885 would require teachers who affirm trans youth to register on the sex offender registry.
The harassment campaigns are serious, and have moved firmly from protest to domestic terrorism. In Wisconsin, a school system dropped its investigation into a Title IX violation of a transgender students’ rights after a sustained bomb threat campaign that closed a district. As states implement more and more of these platforms, students, teachers and other school personnel must live constantly with the knowledge that they are under the watchful eye of the GOP, hungry for blood to feed the culture wars. With the appointment of LoTT’s Chaya Raichik to the Oklahoma Department of Education, we are now seeing state officials initiate these harassment campaigns, and to do so with the full blessing of the secretary of education and the governor.
Rokita is far from the only person to launch such a power. Last year, Indiana AG Bailey launched a “tip line” to report patients, families and providers. However, the form was so consistently targeted for civil disobedience that it has since been taken down. It exists in its original form here and here.
When anti-trans activist Alix Aharon appropriated Erin Reed’s informed consent map to create a “name and shame” list of gender care providers, she did so mimicking a long-known strategy with often deadly consequences from the anti-abortion far-right. Once the intention was made clear for the project, Aharon was eventually deplatformed from Google Maps. A new iteration appears on her Wix site running the Leaflet interactive maps code. While the map is even more complete than ever, with testimonials targeting specific providers, Wix — who hosts the Gender Mapper project — appears to have decided for now that this is fine. The intersection of private interests doing “citizen surveillance” projects and the anti-trans legislative push is quite a straight line. Aharon’s map was provided directly to legislators voting on HB 68 and HB 454 by Maria Polaris of the Cardinal Support Network.
