privacy in the age of forever

i've written before about what i think privacy is, though classifying it as an obscurity-based strategy for satisfying a basic need for safety was very high level and abstract. it could also be taken the wrong way, since people often think about safety as only applying to their physical person (i.e. physical safety). our physical bodies aren't the only thing we want to keep safe, of course. our families, our property, our reputations, our opportunities, etc. are all things we want to keep safe, all things we want to protect, and all things for which privacy can help offer some protection.

privacy is often described in terms of controlling information but on reading danah boyd's thoughts on privacy i realized it can and should be expressed a different way. controlling information is the means by which privacy is often accomplished, but it's not what privacy is actually about. while i don't agree with the narrow scope boyd used ('asserting control over social situations'), at it's root was a kernel of truth. while the means by which privacy is achieved may be the control of information, the point is the control of outcomes related to that information, whether they be social outcomes, business outcomes, educational outcomes, housing outcomes, health outcomes, political outcomes, legal outcomes, etc.

controlling outcomes is, of course, the point of any strategy. the thing about strategies, though, is that their appropriateness depends heavily on the situation, and what people largely don't realize is that there is a situation which is becoming increasingly ubiquitous under which many traditional privacy strategies don't work very well.

in the online world everything is recorded and stored for consumption at a different time or in a different place. it is essentially a persistent medium through which we can interact with each other. this is a significant point because for most of human history the real world has largely been an ephemeral medium for interaction. our behaviour, the strategies that we develop as we mature in the real world take great advantage of the ephemeral nature of our interactions with others. if you weren't present the day your best friend made a hurtful comment about you to others in your peer group then you missed out, that experience is gone, "you had to be there" as it were. this ephemeral property of the event, the fact that the information only exists in a very particular point in time and space, serves to restrict access to that information to only those who were present at the same point in time and space.

once we start interacting online that ephemeral property ceases to exist, so access to the information that we might have otherwise expected to be restricted due to it's ephemeral nature is no longer restricted in that way. we often don't realize that, however, because we take that 'ephemeral-ness' for granted. it's not easy adapting to a situation where that no longer applies.

for example, imagine for a moment that every word you speak goes into a speech bubble above your head, like in the comic books, except unlike the comics the speech bubble doesn't go away, it stays with you and allows people to read what you said 5 minutes ago or even 5 hours ago. every swear word, every uncharitable thought uttered under your breath in the heat of the moment, everything. can you imagine how you'd adapt to that sort of situation? you'd probably censor yourself a lot more than you currently do - since your utterances have become persistent the natural adaptation that would allow you to continue to control the outcomes associated with what you say is to say far less.

at first blush that might not seem unbearably bad, but let's take things a step farther because that example really only dealt with your words. this time (this is inspired by danah boyd's post, by the way), imagine you are stuck in a very large room and surrounded by everyone you ever have and ever will meet. imagine trying to live your life in this room. how do you play with your toddler in front of your business partner or a potential client? how do you woo your future wife in front of your children or your parents? how do you hang out with your high school friends in front of your future employers? how do you project an image of cool professionalism to people who saw you fall face first in a mud puddle? again, in such a situation, surrounded by people from disparate contexts of your life, the natural adaptation is to reduce the amount of information that you reveal about yourself, but think about those questions; there are certain outcomes that can't reasonably happen without revealing sensitive things about yourself.

these examples may seem absurd, but this is what it means to interact in a persistent medium. anyone, anywhere, at any time can (in theory) see the footprints you've left in that medium. your interactions in a persistent medium transcend time and space, allowing people to effectively 'TiVo' your life (or at least the portion of it that's been recorded).

obviously this represents an unacceptable state of affairs for online interaction. there's very little utility in it if it requires such profound self-censorship. that's the reason that technological privacy controls and privacy settings were invented - to help replace the access control that was lost when the information became recorded. unfortunately the technological controls don't operate the same way that ephemerality does, so trying to achieve a simliar outcome with them is complicated and often not intuitive.

sean sullivan (at least i assume it was that sean) made a post on the f-secure blog that highlighted a talk given by clay shirky where he said (as quoted by sean) that "managing privacy isn't natural". technically what shirky said was that managing privacy settings isn't natural. we manage privacy every day in every interaction we make with others, but managing privacy settings by definition can't be natural because the settings themselves are artificial. this has implications for the kind of privacy one can achieve though managing such settings - it is itself an artificial, man made analog to natural privacy, and prone not only to being incomplete in comparison to it's natural counterpart but also to breaking down as all man made things do.

but as untrustworthy as that sounds, it will have to be good enough, because we can't turn back the hands of time or halt progress. we can't even opt out of the persistent medium. oh, we might get away with staying out of the online world ourselves, but persistence is intruding into the real world more and more. public photography, for example, is turning the public sphere (which used to represent an ephemeral medium) into a much more persistent medium than it used to be. this can be a good thing when it helps to expose things like police brutality, but it poses a not insignificant problem for us as a society.

paul ducklin raised some concerns about this very problem last year on the sophos blog. at the time i didn't think his concept of public privacy made much sense, but when examined through the lens of a traditionally ephemeral medium of interaction being changed into a persistent one without people noticing or appreciating the consequences for their existing privacy strategies, it starts to be clear (to me) that this is a problem that deserves some consideration. i wouldn't consider it an invasion of privacy, per se, but perhaps it would qualify as a subversion of privacy, since it changes the environment to one where the strategies people were using to control outcomes no longer work properly, and it does so without making it clear that that had happened.

are we ready for the implications of living in a world where our actions live on beyond the moment? i don't really know. certainly we can manage our privacy settings online, and maybe we can obscure our identifying features offline (though that may interact poorly with some of our cultural norms) so that public photography becomes less of an issue. i just wonder if explaining to the next generation what it was like before everything became persistent will be the last time we ever get to use the phrase "you had to be there".

facebook's ticker: a ticking privacy timebomb?

there's a lot of pixels and bits being dedicated to the major changes that are underway at facebook, but most of the attention seems to be focused on the timeline feature. i tend to think the ticker feature deserves a lot more attention and, frankly, concern.

first off, it seems clear that facebook wants to be the destination for an ever increasing number of activities - not just farmville or mafia wars, but consuming print, audio, and video media, and even purchasing goods too. fine, facebook wants to be the web portal to end all web portals - the next AOL or compuserve - it's fine to have aspirations like that; although actually being AOL or compuserve doesn't seem to have worked out that great for AOL or compuserve in the end.

but with that breadth possible activities in mind, the idea that facebook will now be sharing everything you do automatically seemed really rather stupid to me at first. maybe there is too much friction inhibiting sharing right now, maybe clicking a button isn't easy enough, but truly "frictionless" sharing that happens without any action taken on the user's part takes the intent out of sharing. sharing loses all meaning that way. it no longer tells you the sharer thought this article was insightful or that video was funny, it doesn't give any hint what so ever as to whether the sharer thought something was worthwhile, it just collects everything in one big activity profile. indeed, was the person performing those activities really the sharer in that situation, or is the sharer facebook themselves?

at first you might think that the resulting poor signal/noise ratio would render facebook as irrelevant as myspace and it's blinking, glittery profile pages has become. the folks at facebook seem to have realized this, though. they don't want people's main feeds to get filled with all that noise. they recognize that from a personal interaction standpoint, this data is too voluminous and unimportant. that's why they've relegated the data to a new place - the ticker.

the question you should be asking yourself right now, however, is this: if this data isn't actually useful to users when they're connecting with their friends, why is facebook interested in automatically sharing it? who is interested in that data? the answer is simple - advertisers. a large profile of everything you read, watched, listened to, and did online is for all intents and purposes your web history. in this case it will be your web history as seen through the eyes of facebook. we in the security community get upset about browser vulnerabilities leaking our browser history, or tracking cookies being used to track where we've been; the data collected for ticker is not going to be inherently different than the data acquired through those other means. furthermore, it's too voluminous and granular to be useful to anything other than an automated process that looks for certain types of patterns and trends. the kind of process you'd use for the automated targeting of ads - targeting based on your activities, your behaviour.

the ruse of "frictionless sharing" appears to be a trojan horse (not the malware variety one might traditionally think of, though) for introducing behavioural profiling for the purposes of targeted advertisements. social spyware at it's best.

but even if that's not the case, even if that data really is meant for a user's friends to see and use, there is a profound implication buried in the automated sharing of everything. you can't control your public image if the choice of what you share about yourself is taken away from you. for all the hand wringing recently about the damage that real name policies do (eliminating your ability to control the personal information that your identity represents), the elimination of your ability to control your public image means the elimination of the persona - something that has been part of the social experience of humans since the dawn of mankind if not longer.

our true selves, the nature that we keep hidden behind the masks that we each present the world, is something that we innately keep private. i simply cannot believe that our social norms are headed in the direction of completely removing those social masks. giving up that private information in exchange for access to a service is a privacy bargain that we have never faced before.

so, if you thought the ways facebook could violate our privacy couldn't get much worse, you were dead wrong.

social networking vs. privacy

the privacy issues surrounding social networking sites are nothing new by any stretch of the imagination, but it seems to me that many people have mismatched expectations when it comes to privacy and social networks - and i'm not just talking about the people who are not yet aware of the issues. even those people who are actively criticizing the privacy implications of the technologies and policies in play at social networking sites seem to be experiencing a fundamental disconnect from the reality of social networking.

the fact of the matter is, no social networking site can be both socially useful and promote privacy in a meaningful way at the same time. if we ignore the practical concerns of how to get funding or similar topics that lead us to call social networking users products rather than customers - even an ideal social networking site must necessarily be a privacy failure.

before i explain why, i think it's important to understand what social networking sites are for and by extension what successful ones (including our ideal one) must do in order to be compelling. the core goal of a social networking site is to enrich our social experiences, either by allowing us to have rewarding social experiences with more convenience (like keeping up to date when you've got a spare moment, even if it's in the dead of night) and less expenditure of resources (time, energy, money, or some combination of the three) than we would otherwise be able to have, or by allowing us social experiences that wouldn't otherwise be possible at all (such as reconnecting with long lost friends).

to that end it should come as no surprise that social networking sites have to focus on facilitating the establishment, maintenance, and strengthening of social connections. it should also come as no surprise that social connections flounder in the absence of openness. that is a social network's undoing from a privacy perspective, because openness is incompatible with the guardedness engendered by the strategies we use to protect our privacy.

now there are a couple of specific complaints that i'm sure come to the reader's mind at this point, chief among them being that sites like facebook should still be able to use an opt-in model for information sharing instead of an opt-out one. you have to understand, however, that the opt-in model is essentially equivalent to being guarded-by-default (you could also liken it to default-deny or even whitelisting). no one can dispute that this would be a superior model from a privacy perspective, but as someone who is guarded-by-default in real life i can assure you that it is not a winning social strategy. by going with an opt-in model you put people in the position of having to make conscious decisions about what they need to be open about in order to get the most rewarding experience for themselves (where such calculating behaviour might be familiar only to a select few) as well as figuring out precisely how to go about being open about those things. in other words the opt-in model forces the user into a kind of simulated social awkwardness, which would not be a compelling user experience at all.

you could be thinking right now that even if an 100% opt-in model would scare users away, a more balanced model than 100% opt-out should be possible - and yes, it certainly is. privacy lobbyists (for lack of a better term) have certainly managed to pressure facebook (and i assume others) to change various features to be more privacy-friendly. that being said, without such pressures (representing a broadly held preference to the contrary), social networking sites should be expected to go with the opt-out model and let those who feel they need to protect the information in question actually make the conscious effort to opt-out. the reason for this is purely practical (and i don't mean in the making things easier for lazy programmers sort of way). there is no single sharing strategy that both optimally meets everyone's social needs and their privacy needs as well. that means any attempt at making more balanced sharing defaults amounts to trying to second-guess what's going to work best for users at the risk of making it more difficult to be open in a way they may have found rewarding. defaulting to opt-out is essentially erring on the side of caution with respect to not compromising the primary goal of an ideal social networking site.

all this being said, when it comes to sharing data with advertising partners or other third party organizations, that has nothing to do with enriching the social experiences of the user. those are entirely business-driven decisions, and while they make sense for the business, they provide no direct benefit to the user and so there is no reason to believe the user would appreciate that sort of openness being facilitated (or rather foisted on them) by default. those sharing practices rightly deserve to be made opt-in rather than opt-out, but i don't expect the business people running the social networking sites to draw this distinction between sharing that facilitates social connection and sharing that facilitates advertising revenue. at least not without a good swift kick in the arse on a regular basis.

(2010/10/21: edited to correct typo spotted by @ChetWisniewski)

privacy implications of cloud-based security

in my continuing efforts to get caught up on my rss feeds (i'll get there eventually) i came across an interesting post at the stopbadware blog about establishing expectations for av vendors. it raises some interesting concerns about data collection and lack of transparency / informed consent.

this is a tough call. recall that when trend bought hijack this and added a button to send the log to trend for analysis people went ape over the idea that it was sending data without informing the user (even though the behaviour seemed clear to me just by looking at what the UI stated).

all cloud-based security inherently is going to collect data and send it into the cloud - that's how you leverage the cloud for security. clearly there is the potential for a privacy violation if the vendor isn't careful and there is certainly room for people to assume there already is a privacy violation. some people are inevitably going to cry foul if you tell them that their security software is sending data into the cloud.

and yet on the other hand if you don't tell them then they can't make intelligent, informed decisions about whether they want to accept the risk associated with cloud-based security technologies and so may fall into a false sense of privacy (not unlike a false sense of security).

i'm a big fan of informed decisions - i think that given enough information, reasonable people will be able to make intelligent decisions and hopefully that works out in the vendor's favour (if they're doing enough to protect customer's privacy).

i think security vendors absolutely need to inform their users, and i think the failure to do so should be considered a badware sort of behaviour. i think the risk of backlash can be mostly mitigated by informing the user HOW their privacy is being protected in spite of the data collection (ie. exactly what data is being collected and how the data is being anonymized - maybe even let them audit the data being sent). assuming the vendor is doing an adequate job of protecting users' privacy, only unreasonable people should continue to have a problem in the face of such transparency - and there isn't really much you can do for unreasonable people. all cloud-based technologies involve data collection, so those unreasonable folks will simply have to learn to be reasonable or seek out one of the dwindling number of products that don't have any cloud-based components.

public privacy is an oxymoron

i was just reading (yes, i know i'm behind) this post by paul ducklin about public unprivacy and i was struck by how absurd it sounded. perhaps things are different in australia but where i come from there is no reasonable expectation of privacy in public spaces. this isn't new, either, it's been this way for a long, long time - long before google arrived on the scene, that's for sure.

apologies to paul, but he seems to be misapplying the concepts of privacy outside the scope where it makes sense. i've seen similar things in my professional career as well. even so-called 'privacy experts' seem to want to try and get the benefits of privacy in situations where it just doesn't work.

privacy has limits. there are situations where the strategies that comprise privacy make sense and work well and there are situations where they fail for practical reasons. it doesn't matter if keeping X private would be useful or desirable, if the practical realities prevent it then privacy is the wrong tool. being out in public where everyone can see you is one situation where privacy logically can't work (unless perhaps you wear a shroud, but even then only if lots of other people are wearing shrouds too and only if one can't tell the shrouds apart).

i see london,
i see france,
i see the colour of paul ducklin's pants.

preventing filming in public doesn't protect or restore anyone's privacy. if you're in public then the public can still see you, they can see where you're headed, what you're wearing, what you're holding, who you're with, etc. everything that could be photographed can still be seen by the people around you. all preventing filming will do is make it more difficult to disseminate the information you were misguidedly trying to keep private in public. that information hasn't really remained private, it's just harder to share in some cases.

one wonders, if public photography were limited (and british cops, with their penchant for harassing photographers, would love such a policy) what would come next? would public twittering become outlawed? after all with a cellphone i could just as easily tweet that tom cruise and katie holmes are walking down john street and give away as much information as i could with a photo, if not more (a photo might not give any geo-location data - and real-time geo-location data is something celebrities really don't want getting out there). perhaps we should outlaw public observation in it's entirety.

in order to effectively protect ourselves it's important to know when and how to apply the various protective strategies at our disposal. privacy doesn't work in public - you can't magically stop people from seeing/hearing/sensing you. when we step out into a public space it should be understood that everything people can see or hear is no longer hidden and therefore not private. if there's something we want to keep private it's necessary to keep it hidden away where people can't get access to it, which means not bringing it out into a public space.

mark zuckerberg, privacy, and default behaviour

a while back graham cluley had some choice words about how facebook founder mark zuckerberg has shaped the privacy paradigm at the social networking site.

Mark Zuckerberg, the founder of Facebook, says that most people want to share.
If he really really believes that, then why doesn't he give those users the ability to "opt-in" to share their personal data rather than force people to "opt-out"? After all, if he's right then that business model would work just fine.

now graham used to make software, once upon a time, and i wonder how long it's been since he's done so.

zuckerberg's stated belief that most people want to share is completely compatible with an opt-out privacy paradigm. don't make things too difficult or too much work. if most people want X then give them X by default, don't make them jump through hoops to get it. even if X is sharing.

that being said, i personally would prefer opt-in over opt-out and if you look at zuckerberg's own facebook profile you might be mistaken for thinking he'd prefer that too - his stated belief that most people want to share appears to be hypocrisy because he certainly does not share very much. granted his date of birth and hometown are up there, but if you're looking for anything truly personal the best you'll get are a list of "like"s (including himself, so i guess he's sharing a bit of narcissism). does zuckerberg think he's somehow different from the average person? does he not believe in eating his own dog food? no one wants to share willy-nilly, everyone is at least somewhat selective about what they share and with whom. facebook's privacy defaults should be designed with that in mind.

privacy NOT versus security

i've been growing increasingly perturbed by the notion that there is some tension or conflict between privacy and security and i want to set the record straight.

there is no such conflict. my privacy is completely compatible with my security. there is no tension between them, no conflict. ultimately they have the same goal - protecting the things i think need protecting.

often when people talk about privacy vs security they're not talking about the purely person perspective, though. they're talking about other organizations that are expected to help protect an individual's privacy. here there can be a conflict, but not because of some tension between privacy and security, rather because the organization's interests are not aligned with those of the individual. they never are, they aren't supposed to be, it's not reasonable to expect them to be. even amongst individuals alone, my interests, values, and priorities are different from your interests, values, and priorities - by chance we might happen to agree on what needs protecting on a general level but when it comes to the finer details there will always be disagreement.

when we hand over our information to an organization (or when it's handed over for us) we expect that organization to act as our partner in protecting that information - and to the extent the law requires them to do so they usually do. but the organization's interests, values, and priorities are not the same as our interests, values, and priorities.

that is where the true tension exists - not between privacy and security, but between the interests of different parties. whether those parties are two individuals, an individual and a company, or an individual and a nation - any conflict exists between those parties (because they have different needs), not between privacy and security. security of the whole vs. privacy of the individual is a conflict between entities, not strategies.

adware and why tracking usage sucks

phorm, the isp-side adware/spyware technology being tested out in the UK, has been getting a lot of attention in the press for the past couple of weeks... on reading the description of it on the f-secure blog i got to thinking about why exactly this sort of advertising is so bad...

leaving aside the question of all the company's past bad acts (which i know is important but i'm focusing on the type of advertising, not this particular instance) and the isp-side implementation (and all the consequences that has for informed consent), i want to look at just the basic idea of targeting ads based on where a user has browsed in the past...

obviously this requires tracking the user's activities and adware companies will no doubt try to assuage our privacy fears by claiming they don't keep identifying information... for my purposes i'm going to assume they live up to their word, regardless of how unlikely that may seem... my contention is that simply displaying ads based on past browsing behaviour represents a privacy breach because we very often don't use our computers in a vacuum...

what do i mean by that? let's consider the scenario of the road warrior employee... he (or she) has a laptop they take with them on the road and most likely also take home with them... chances are good they will do some personal browsing at some point... chances are also good that at some point they're going to come back into the office and turn on their computer... what happens then is that their co-workers or perhaps even their boss may see ads linked to browsing they were doing while in the privacy of their own home... maybe the ads are of an adult nature (porn), maybe they're of an immature nature (cartoons), or maybe they reveal employment intentions the employee isn't prepared to share with their boss (why are there ads for monster.com on your computer?)...

of course there are those who would say that such an employee shouldn't be doing private browsing on the work computer anyways (ignoring the possibility that they're actually doing work on their own personal laptop - something that can happen in smaller companies) so how about a more reasonable scenario... lets say you're a single guy browsing the web the way single guys do... lets further say you get a new girlfriend and she comes over to spend time with you... at some point she may ask to use your computer to check her webmail because she's been staying over quite a bit and hasn't been home in a while... you concede because letting her use your computer is the least you can do for her considering all the time the two of you have been spending together... then she sees the ads linked to your past browsing behaviours and stops coming over and doesn't return your calls anymore... alternatively, perhaps you're over at her place fairly often and all of a sudden dating site ads start showing up on her computer...

accurately targeted ads are a wet dream for the advertising industry - their efforts would be so much better received and have so much more impact if only they could get the right ads in front of the right people at the right time... developing sophisticated profiles based on past usage makes a certain amount of sense in that context... unfortunately, when it comes to computer use it's pretty much impossible to accurately tell who's looking at the screen, so there's a very real risk of revealing things about people and what has meaning to them to the people around them if your ad targeting is based on anything other than what the user is doing right this instant... you cannot capitalize on knowledge of the user through ad targeting without revealing that knowledge to the user and possibly others as well...

when people can start inferring things about you based on ads targeted at you then then the ads themselves represent a privacy breach, regardless of what personal information the ad company may or may not be keeping... the more accurate the targeting the more likely you are to breach the user's privacy... the more you try to protect the user's privacy by throwing random ads into the mix, the less accurate the targeting becomes and the less impact the ads have because they get buried amongst garbage ads...

advertising is big (and arguably legitimate) business, but those considering the kind of optimization that phorm or really any kind of targeted ad serving represents should be aware of these kinds of less obvious privacy implications...