Very Handy Privacy Calendar

Kudos and thanks to PogoWasRight.org for maintaining this very handy calendar of privacy-related events.

ID Theft Insurance: an update

A handy update on the state of ID theft insurance can be found in this article on the Canadian Underwriter web site.

Teenage Tracking Systems: do kids have limited privacy rights?

Noticed this article recently on tracking systems that help parents keep tabs on teen drivers. As my friends will confirm, I was trying to put one of these together myself about 12 years ago. I happen to think it might have altered the course of my daughter's life if I could have mated GPS to CDMA or GPRS. And I think anyone who has a teenager will understand the desire to track their travels. But it raises interesting questions (a great way to spark classrooom discussion of privacy). For example, at what point does a person achieve their right to privacy?

Some people will be eager to point out that, legally speaking, in the United States, driving is a privilege and not a right. And no right to privacy exists as to your location when in public. But still, I think some teenagers would be inspired to research this question if you told them they were going to be tracked.

Are People Quitting Google in Droves? Time will tell

After pondering aloud in my last post about consumer attitudes to Google I did a little digging and found this on the "browser blog" at Fortune.com:

Google corners nearly two-thirds of US search market

The latest search market share numbers are in from Hitwise: in the four weeks ended March 31st, Google (GOOG) racked up fully 64.13% of all US searches. That’s up more than 10% since March 2006, and, if trends hold, Google’s share will pass the two thirds mark by August. In the same period, Yahoo (YHOO), Microsoft (MSFT), and Ask (IACI) all lost share. As the old Wall Street hands like to say: “Liquidity begets liquidity.”

Clearly, this is not good news for the search also rans, particularly as it covers a period when all of them made major and costly improvements to their search engines. Ask.com for example, rolled out an impressive local search service in 2006 and also greatly improved its image searching, and yet its share declined nearly a half a point, to a fragile 3.48%, in the course of the year.

Conventional wisdom has long held that Google is vulnerable to vertical attacks, i.e. search engines that carve out category niches. The new Hitwise data suggests, however, that Google is actually gaining influence in valuable verticals...

That post was dated April 11 and Google was at 64.8% by June according to the blog at Hitwise, readable here. I will keep watching these two sites to see if there is any evidence of a prviacy-fear induced slowdown in Google growth. If Google does not pass the 2/3 mark by August, look for Privacy International to claim some credit.
.

Google Brain Implants: Not yet, likely never

You have to love the opening of this recent article about Google, sourced from Reuters, but written up by New Zealand TV:

Most people missed the announcement about how Google Inc. wants to burrow inside your brain and capture your most intimate thoughts. That's because it never happened. But Google, the world leader in web search services, is the focus of mounting paranoia over the scope of its powers as it expands into new advertising formats from online video to radio and TV, while creating dozens of new internet services.

Interestingly the article -- available online here -- quotes two people at Google who work on privacy. A lot of the recent Google/privacy stories, sparked by the Privacy International press release about its interim report, give the impression that nobody at Google bothers with privacy. The NZ story quotes Nicole Wong, "the Google attorney who oversees a team of lawyers who consider privacy and other policy issues that go into the making of each product," and Peter Fleischer, "Google's global privacy counsel."

So it sounds like Google has a lawyer devoted to privacy and another attorney leading a product review team that has privacy as part of its remit. This is clearly not enough for some privacy advocates and so, if I was Google I would very publicly create a job entitled Chief Privacy Officer and then hire someone with a good industry reputation for the post. That might allay the fears of privacy advocates. In the meantime I am keeping a watch out for any surveys that indicate consumers have any privacy fears that are keeping them away from Google.
.

The Actual Interim Privacy Rankings: Is Google really hostile and aggressive?

With so much chatter about the "Google Sucks at Privacy" story put out by Privacy International, I thought it would be useful to provide a link to their source document: interimrankings.pdf . Here's a quote:

We are aware that the decision to place Google at the bottom of the ranking is likely to be controversial, but throughout our research we have found numerous deficiencies and hostilities in Google's approach to privacy that go well beyond those of other organizations.

I have to say that the use of the word "hostilities" in this context is surprising. I've been involved in some pretty serious privacy and security cases and nobody was accused of hostility in their approach to privacy. For example, I was involved when the Federal Trade Commission brought charges against Eli Lilly for violating privacy. I helped Microsoft comply with certain requirements imposed by the FTC to settle charges arising from security and privacy issues. But hostilities? Here's more:

While a number of companies share some of these negative elements, none comes close to achieving status as an endemic threat to privacy [my emphasis]. This is in part due to the diversity and specificity of Google's product range and the ability of the company to share extracted data between these tools, and in part it is due to Google's market dominance and the sheer size of its user base. Google's status in the ranking is also due to its aggressive use of invasive or potentially invasive technologies and techniques.

If Google is guilty of "aggressive use of invasive technologies and techniques" where are the regulators and politicians and consumer outrage? Surely Google hasn't bribed them all.

Google's increasing ability to deep-drill into the minutiae of a user's life and lifestyle choices must in our view be coupled with well defined and mature user controls and an equally mature privacy outlook. Neither of these elements has been demonstrated. Rather, we have witnessed an attitude to privacy within Google that at its most blatant is hostile, and at its most benign is ambivalent. These dynamics do not pervade other major players such as Microsoft or eBay, both of which have made notable improvements to the corporate ethos on privacy issues.

I feel compelled to add a phrase to that last sentence: "after consumer outcry." Microsoft was dragged before the FTC and eBay was heckled by members. I'm not aware of widespread consumer outcry over Google. So, I suggest you read the above-referenced "interim" document and decide for yourself. Note that the report was compiled

...using data derived from public sources (newspaper articles, blog entries, submissions to government inquiries, privacy policies etc), information provided by present and former company staff, technical analysis and interviews with company representatives.

and

Because the 2007 rankings are a precedent, Privacy International will regard the current report as a consultation report and will establish a broad outreach for two months to ensure that any new and relevant information is taken into account before publishing a full report in September.

Does Privacy International make its case or is it really just trying to force Google into a dialogue by holding out the hopes of a less critical final report?
.

In Corporations They Don’t Trust - New York Times

An interesting angle on the privacy debate was revealed in a piece by Paul Brown in the New York Times a couple of days ago. The gist of the piece was that "senior executives really do not have a clue." Brown cited a study in the McKinsey Quarterly, the business journal of McKinsey & Company, that found “a trust gap between consumers and global corporations, as well as a lack of understanding among business leaders about what consumers really expect from companies.” For example, when asked what three concerns would be most important to them over the next five years,

“Executives predicted consumers would put job losses and offshoring first, followed by privacy and data security, and the environment...[whereas]...almost half of the consumers picked environmental issues, followed by pension and other retirement benefits, and health care.”

In other words, CxOs think consumer concern about privacy and data security is greater than it really is. Why would this be, apart from the obvious generalized conclusion that CxOs are out of touch with consumers? I suspect it has something to do with the relentless pressure from security and privacy advocates as well as extensive negative media coverage of security breaches that expose private data. And you might add to that the increasing likelihood that such breaches will be followed by lawsuits, some of which may name CxOs. They may be out of touch with consumers but they are very likely to be in touch with their own self-interests.

Is the Web Built on a Lack of Privacy?

There are some interesting observations in this TimesOnline article triggered by a BlueCross privacy breach: The web is built on a lack of privacy. The writer is Jonathan Weber, the founder and editor in chief of NewWest.Net, a regional news service focused on the Rocky Mountain West in the United States. As co-founder and editor in chief of the Industry Standard, Mr. Weber is no stranger to the vagaries of the digital age. I'm sure many of us share his righteous indignation:

A few weeks ago I got a letter from Empire Blue Cross, my one-time health insurer, explaining that there had been an unfortunate incident regarding my personal information (and that of my wife and children too, as it turned out). The letter explained at some length how the company had rigorous policies to insure the confidentiality of patient information, requiring that such information be encrypted and so forth. But the company didn't take the trouble to ensure that it's high-minded – and legally required – policy was actually being implemented, and a CD containing unencrypted personal information on many people, including me, had gone missing.

(To digress from privacy for a moment, this letter sounds like it was written by the same BlueCross hack that penned a recent letter to my wife and I informing us that, as a result of cost savings, increased efficiency, and improvements in health care, our monthly premium was being increased by 20%.)

Weber goes on to muse about the potentials for abuse now that so much data about us is stored somewhere out there, by somebody over whom we have scant control (often somebodies who themselves have less than complete control). Yet at the same time, it is our willingness to share information about ourselves that has enable many features of the web, not least of which is the amazing amount of valuable content that is dished up for free (where 'free' equals 'in return for knowledge about the person accessing the infrormation').


The extent to which people accept, or feel comfortable with, this state of affairs varies greatly, as you might expect (particularly if you have listened to my podcast on The Privacy Meter--plug, shameless plug). This is reflected in the comments on the article which display a range of privacy attitudes. They include the infamous quote from Scott McNealy, founder of Sun Microsystems: "You have no privacy. Get over it." (Note: This quote is almost always used out of context but has become a handy verbal marker, serving as everything from a rallying cry or portent of end times, depending upon the quoter's point of view).

The fact is, this stuff is complicated. Some people are more 'open' about their lives than others but you can be very 'open' and still object to careless handling of your data. On the other hand, some people who like their right to privacy have a tendency to confuse it with a right to anonymity, which gets even less of a mention in the Constitution and Bill of Rights than privacy.

There is also a non-trivial socio-economic element to choices about personal privacy. Some people can afford to let the world know all about them without fear of the economic consequences. As someone well-established in his profession, I don't see that much harm would come to me from announcing to the world that I am gay (I am not) but other people fear, sometimes with very real justification, that they will be discriminated against if some of their private choices are made public. The U.S. military's "Don't ask, don't tell" policy towards homosexuality would seem to be a case in point. (During the first 1o years of this policy some 10,000 members of the armed forces were discharged for being homosexual--suggesting that the policy's intent, respect for the privacy of military personnel, was somehow not met).

The whole area of medical privacy, which is where this post started, is a massively complex can of worms. Suppose I present myself to my doctor with a huge bruise on my leg. If the 'fact' that this bruise was caused by me skydiving (it was not) gets into 'the system,' then the cost of various insurance policies involving me could go even higher (yes, there is a data bank somewhere that stores information on your lifestyle and yes, insurance companies do consult it). In other words, if you're Bruce Willis and command $20 million per movie, you can do and say just about anything you like and not care who knows it. The rest of the world needs, for economic reasons, to be, to varying degrees, more circumspect.

TJX: Data breach damage $25 million and counting

Here is a pretty good reason to make sure your company is doing a good job of protecting customer data: TJX: Data breach damage $25 million and counting.

That's right, according to SearchSecurity, the bottom line for TJX Companies Inc. took a big hit in the first quarter of 2007, thanks to a $12 million charge tied to the security breach that exposed at least 45.7 million credit and debit card holders to identity fraud. In total, the breach has cost the company about $25 million to date. And that doesn't include the cost of customers who decided to shop elsewhere.

TJX Faces Suit From Shareholder: Cost of privacy breach expands

You can get an idea of how much trouble a privacy breach can cause from this article: TJX faces suit from shareholder. As predicted by myself and other security experts at least ten years ago, shareholders are suing over a security breach that hurt the value of their stock.

TJ Max-imum Impact: The big name in privacy breaches

After 54 million private records exposed in 2005, 48 million in 2006, it only took one month, January, for 2007 to set records. The TJX Companies experienced an "unauthorized intrusion" into computer systems that process and store customer transactions including credit card, debit card, check, and merchandise return transactions. While the intrusion was discovered mid-December 2006, it was not announced until January, 2007, and the numbers are staggering:

• 45,700,000 credit and debit card account numbers
• 455,000 merchandise return records containing customer names and driver's license numbers

Apparently this was the result of deliberate hacking, not just a badly configured web server or stolen laptop. But it puts 2007 on track to be the worst year ever for security breaches. Check out the Privacy Rights Clearinghouse chart for 2007.

The Privacy Year: 2006 sent mixed messages

So, as the year ends, what did 2006 do for privacy?

Well, there was plenty of coverage of security breaches that exposed personal data. According to the good folks at Privacy Rights Clearing House, the approximate minimum total number of PII potentially compromised in 2006: 48,419,936. They have a very interesting breakdown right here.

And this was the worst year ever, right? Wrong, the total for 2005 was 54,843,000. But aren't we getting better at catching the culprits? Well, according to Privacy Rights Clearing House, the number of data-breach identity thieves sentenced in 2006 was, wait for it: 5.

So, not a good year for privacy. But maybe not the worst year ever. Let's see what 2007 brings.

The Real Meaning of Privacy Invasion

At this time of the year some people like to talk about the real meaning of things. So how about the real meaning of "privacy invasion"? These days people often say "my privacy was invaded" after somebody has exposed private information about them. Journalists write "Lax security leads to huge data breach, privacy invasion."

But what is there about Personally Identifiable Information being exposed that suggests the verb "invade" or the noun "invasion"? When we learn that Google keeps a lot of data about how we use the web, data that can be linked to us individually, what aspect of this suggests "to enter forcefully as an enemy; go into with hostile intent"? You might not like it, but surely the term invasion is wrongly applied in cases such as this.

Indeed, the term "invasion of privacy" started out as a way of describing what today we might characterize as people "putting their stuff in your face." Consider a couple who are arguing in voices so loud that the neighbors can hear. That is an invasion of their nieghbors' privacy, information about other people forcing its way in your world. Here's a real world example. I think my privacy was invaded when I was sitting in an aisle seat on a plane a few years ago and a young woman stood in the aisle, waiting to deplane, with her back to me, wearing a bolero top and low cut jeans, thereby revealing to me--before I had time to avert my eyes--an elaborate tattoo reaching down to her butt crack and featuring the word: Daddy.

This is not something I wanted to see. But I was pretty much forced to see it. My space was invaded. My private world was invaded. This might sound old-fashioned, but that's partly the point. People used to be able to go out in public without too much fear that deeply personal aspects of their fellow citizens would intrude upon them. I'm all for people doing whatever they like in private (as long as it causes no harm to the person or property of others) but I think I have a right not to be forced to know about it. That is one privacy right that is too often overlooked.

Spam really is getting worse, TEOS to the rescue?

"Between May and the end of 2006, the absolute volume of spam has increased by about 100%, said Michael Osterman, president of Black Diamond, Wash.-based Osterman Research. In fact, some estimates suggest that up to 85% of all email is spam."

No, it is not your imagination. You have been getting more spam this quarter. Check out this great set of links to spam statistics. Despite all the laws, lawsuits, fines, filters, counter-measures, the surges of spam continue to clog the net and waste our time and resources.

Of course, this was fairly predictable. We researched this back in 2001 and developed some potentially effective technical responses that were ready to roll by 2002. By early 2003 we were prepared to offer them to the world as the Trusted Email Open Standard or TEOS. The missing ingredient back then was cooperation between the major email providers. That ingredient is still missing today, which is a pity because between them these companies have the power to impose improved email protocols that would greatly reduce spam. Sadly, they prefer to use spam, or rather anti-spam features, as a product differentiator, a way to attract customers, particularly from the smaller, regional Internet Service Providers.

If ever these companies have a change of heart, TEOS is still there, and is still a wealth of good ideas about how to attack the spam problem more effectively than anything we have seen so far.

TEOS Lives On: And its time may yet come

For those who missed it the first time round, TEOS is the acronym for Trusted Email Open Standard, a proposal for reducing spam by increasing trust in email. TEOS was introduced in April of 2003 at a Federal Trade Commission Anti-Spam. More than 30,000 people downloaded the 35-page standards document in the first eight months that it was available online. The FTC still hosts a pdf copy of the document today, at the FTC web site. There is some archival coverage of the FTC summit here and coverage of TEOS here and also here.

But what has spam got to do with privacy?

First of all, a lot of people would probably agree that spam is an invasion of privacy, the privacy of one's in-basket. Second, it can be argued that, if there was a trustworthy way of ensuring that the privacy preferences of consumers were respected, it would be possible for email to be widely and beneficially used for commercial purposes without creating spam.

So what happened to TEOS?

Well, a lot of people read it (c.f. the 30,000+ downloads) and Bill Gates plagiarized it in a letter to Congress in May of 2003. Here is what he wrote:

...we support the establishment of an independent trust authority or authorities around the globe that could spearhead industry best practices, and then serve as an ongoing resource for email certification and customer dispute resolution. In short, these authorities could provide mechanisms to identify legitimate email, making it easier for consumers and businesses to distinguish wanted mail from unwanted mail. Of course, any technology designed to establish the identity of legitimate commercial firms and associate them with a trusted sender "seal" should be based on open standards and developed with broad input from affected industries.

This is exactly what TEOS had earlier proposed but he conveniently omitted mention of the standard or its authors at ePrivacy Group (which included me). However, TEOS also proposed, and depended upon, cooperation between the large email vendors. They talked about it. Meetings were held. But nothing came of it. Which is sad news for all email users.

UCLA Taser Video Incident Raises Many Privacy Questions

First of all, if you have not seen the video, you can view it here on YouTube.

Then read some of the comments people have left. Now ask yourself how you feel about our society today. What do you think is most disturbing:

• Not having your student ID on you can lead to something like this?
• The other students didn't leap to this guy's defense and prevent repeated tasing?
• Taking pictures to post on the Internet seemed to be more important to some students than preventing a fellow student being physically abused?
• A lot of people left comments on YouTube that are very disturbing?
• Somebody in there was shouting something like "this is the Patriot Act in action."

When I was a high school student, my friends and I went toe-to-toe with police to protest racial injustice, risked suspension and worse, like being run down by mounted police. Has that kind of "teen spirit" wilted away?

On the narrow topic of carrying an ID, I actually think an ID is a good idea. But short of shooting the student who didn't have one, those UCLA campus police could not have more to poison the notion of identifying oneself to others.

Mixed Privacy Messages May Point to Future Trends

Numerous studies have shown that many people will hand over sensitive data about themselves in return for relatively minor benefits (an ice cream cone in one case I recall). This tendency has perplexed many privacy professionals and social commentators, myself included, as it seems to run counter to expressed fears about privacy (remember that privacy fears topped the chart of "what worries you most about the new century" in a large-scale 1999 survey, beating terrorism).

One way to resolve the apparent dilemma is to declare these studies flawed, suggesting they somehow fail to reflect people's underlying attitudes to privacy. But I can't accept that explanation. The empirical evidence of a strong "exhibitionist" streak in modern society is just too strong and you must account for it in an theory about privacy. Now I see that some people are making progress along these lines. Check out Douglas Rushkoff's perceptive piece in a recent issue of Discover magazine.

"It's as if we humans are not simply wiring up a communications infrastructure but creating a shared platform for self-awareness as a collective organism. And this goal--this almost instinctive push toward gaining access to one another--far outweighs our concern over how this data might be used."

This meshes quite nicely with my view of how humans are evolving. And it also jives with ideas I advanced in one of my first columns on privacy, back in 1994, which I will post here as soon as I can find the darned thing (Google probably has it somewhere).

Here Begins Privacy Think

A blog about privacy, with a focus on the far horizon. Asking questions like:

• Where is privacy headed?
• If people fear Big Brother why do they reveal all on MySpace?
• Could a loss of privacy ever be a good thing?
• What's the difference between privacy and anonymity?
• What does the exposure of hundreds of millions of personal records mean?

Interested? Stay tuned. Get the feed.

Stephen