December 24, 2007

PRIVACY 2007: HIDING IN THE CROWD

by Andy Oram
American Reporter Correspondent

CAMBRIDGE, MASS.—Three issues recently highlighted in the news lay out privacy risks that modern Americans face on three fronts: from our own government, from faceless criminals, and from the companies we turn to for most of our purchases and services.

Summary: unless you never use a phone, pay for everything with cash, and stay off the Web, your data is out there for governments, criminals, and large companies to use in any way they want. And often these three groups overlap. TJX’s implicit collusion with the criminals who repeatedly broke into its computers pales beside the acquiescence by phone companies, Microsoft, and Google alike to government demands for information.

Bush’s bypassing of the 1978 Foreign Intelligence Surveillance Act (itself a notoriously spy-friendly law) was revealed last December by the New York Times. The newspaper actually heard the news a year beforehand and suppressed it, in what is probably the best Christmas present a major media outlet ever gave a politician.

We don’t know what carrots or sticks were waved over the phone companies by the Administration, but one thing is sure: the increasing concentration of that industry (fought by public interest groups for the past decade) was necessary to make the collusion possible. Had phone and Internet traffic been handled by thousands of small firms as it was in the 1990s, the exploits could not have been kept secret.

Less publicized is an alarming ruling by the Sixth Circuit Court of Appeals last October that allows the government to demand anyone’s email without a court order. The court (reversing its earlier ruling) decided that users have "no reasonable expectation of privacy" in email. Of course, I technically have no way to read your email—only governments, employers, and ISPs do.

And more and more industries are experiencing concentration (particularly in the financial area), creating massive data stores that governments can dip into and criminals eye greedily. A centralized medical database (proposed by many medical professionals with scant understanding of computer security) would offer yet another juicy target. I believe fervently in the electronic storage and sharing of medical records, but it must be done by individual providers with training and rules for protecting data.

Microsoft, among others, gave search data to the Justice Department as part of an odd research project in child pornography. Google refused to cooperate with the Justice Department, but feels compelled in China to comply with government censorship.

Yahoo! went even further, turning over information on a Chinese journalist to the Chinese government. U.S. Congressmen made a federal case of it, although I'd rather have them push the U.S. government to respect privacy around the world.

On December 23 the Washington Post reported the creation of a new FBI database listing the physical characters of millions of people, ranging from scars to iris patterns to the fingerprints collected by employers for background checks.

How do we preserve our right to autonomy in the face of this assault? We can encrypt our email—but few people do, so the privacy freaks who insist on doing so mark themselves as suspicious.

We know that anybody from the NSA to the Recording Industry Association of America can get our IP address from our Internet provider, and a clever hacker even figured out how to track down contributors to Wikipedia through their IP addresses. So we can’t "hide in the crowd" by posting from home or work.

We can (in some countries) use Internet cafes to distribute information anonymously, and can use "onion routing" networks such as TOR to wrap our message in one email after another to make it unfeasible for interceptors to figure out where it originated.

Some people use complicated protocols to provide proxy systems through which people can request sensitive web pages, thus offering a fragile anonymity to residents of countries that routinely snoop on traffic and block web sites. All of these are ways to protect privacy by letting us "hide in the crowd."

Marketing invasions of privacy (such as those feared by critics of the Google/DoubleClick purchase) flip the coin on the other side. Marketers force us to "hide in a crowd" we may not want to be part of. Essentially, they extract isolated data points from our lifelong stream of behavior and assign us to demographics that determine how we’re treated.

Such categorizations sometimes stand out as absurd, as with a man who visited Provincetown, Massachusetts several years ago. Provincetown is a lovely Cape Cod tourist attraction that doubles as a gay mecca. After the man’s stay in a hotel there, guess what kinds of marketing solicitations started to arrive at his home in plain brown wrappers?

More recently in Massachusetts, consumer advocates protested when automobile insurance companies decided to assign rates based not only on driving records, but on actuarial data that had nothing to do with driving: debt, credit rating, and so forth. The companies’ number-crunchers had found a correlation between these behaviors and safety in driving. But who wants to be treated like a number?

The sub-prime mortgage crisis that seems to be dragging our economy into a recession (one that was probably imminent anyway) was facilitated partly by discrimination against individuals by various categories, including race and income.

In addition to the three types of privacy violators described so far, we have to worry about casual searches by random individuals. Digitized data that are nominally public but have never been easily accessible before sudden lead to new privacy threats. Someone might be able to learn all manner of details by digging up records of your divorce or bankruptcy proceeding. Data mining can also combine details from multiple sources into a rich portrait.

Thus, we find it harder and harder to hide in the crowd when we want to, while we are submerged into crowds when we wish to be recognized as individuals. But no tracking system is air-tight. With increasing public understanding of the problems, we can all take individual steps to protect our rights while demanding institutional solutions as well.


Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 International License.

Editor, O’Reilly Media
Author’s home page
Other articles in chronological order
Index to other articles