Three Strikes and Goodbye World

In this post I’m going to briefly note just how bad an idea it is, for citizens, that ISPs and content providers are working together to resolve ‘copyright infringement’ without having a substantial degree of government involvement.

Rules of the game
Perhaps you’re familiar with baseball (or California penal rules). In either case, you’ll have heard of the ‘three strikes and you’re out’ rule. In baseball, this would mean that a batter returns to the dugout, and another person attempts to swat a ball and race towards first base. In the penal system, it indicates that you’ve committed enough criminal offenses that you’re going to have the book thrown at you . . . the next person behind you in court can then try to argue why they’re innocent, and go free (first base?).

Viva la France! Continue reading

Do RFID Security Worries Still Need a Reality Check?

A few years ago Computer World ran a particularly good piece on Radio-frequency identification )RFID entitled ‘Opinion: RFID security worries need a reality check‘. I’d highly recommend taking a look at it, for a pair of reasons:

  1. It identifies that hackers will only look at RFID tags once the data they transmit is easy to send along electronic mediums, with the data being transmitted itself valuable (i.e. not simply the location of valuable goods, but the information must be a valuable good in itself);
  2. It blindingly misses the point that RFID opens a new avenue of attack that could seriously contribute to an e-warfare application.

RFI-What?

You might have heard about RFID in the news over the past few years. In case you need a quick primer/update, here’s the basics on RFID:

  • It’s not new – RFID has been in use since WWII to organize valuable assets and more effectively track them;
  • RFID can either actively broadcast information, or have the chip activated when placed within ‘hot’ zones – an RFID device does not necessarily always broadcast information;
  • There are different ISO standards for various RFID types – some support encryption, some do not, some support active transmission of data (i.e. they are always broadcasting information), and some do not (these are termed passive RFID devices);
  • RFID Tag are often confused with Contactless SmartCars (CSCs) on the basis that they mutually use radio transceivers to broadcast information. Different ISO standards are used for these two types of devices, with CSCs having been developed with encryption and privacy issues in mind;
  • On the topic of read ranges – RFID tags can be read up to 10 meters or so away, whereas CSCs are usually read from a maximum of about 5cm away from a reader;
  • RFID Tags are to be placed in many of the Enhanced Drivers Licenses (EDLs) in Canada, whereas CSCs are being insert into the e-passports that are being deployed in Britain and the US.

Continue reading

Privacy worry over location data – Solution is from Facebook?

Yahoo! has recently released a new product called Fire Eagle. Fire Eagle is an application that developers can integrate into their software suites, enabling users to identify and broadcast their geospatial location to others on the application’s network. There are many very positive features of Fire Eagle (at least relative to other applications of this nature):

* It’s opt-in
* It allows for granular, application level, sharing of information
* It keeps limited historical data – it “keeps only the most recent piece of location information it has received for each of the major levels it understands: Exact Location, Neighborhood, City, State, Country etc. If a new piece of “Exact Location” information comes in, then we throw away the old one.” (Source)
* Yahoo!’s developers anonymize user data, and assert that they will exclusively use it for system statistics as it pertains to updates and improving service (no notes on how data is anonymized, however)
* The privacy statement makes note that users need to read the privacy agreements of the applications that utilize/integrate Fire Eagle
* Yahoo! notes that their partners must consent to terms and services, and a code of conduct, and Yahoo! provides a space for users to complain if they think that a Yahoo! partner is violating their agreements with Yahoo!.

But, but, what about those third parties!?!

A BBC article that talks about this new service (Privacy worry over location data) really identifies the core privacy concern that most advocates seem to have with this service:

The problem for privacy watchers is that privacy policies across the web are all very different and using a service through a third party could raise some real issues

This is a very, very real concern, but one that I think is misidentified by the popular media. While it’s true that people (such as myself) are concerned about the actual legibility of privacy policies (most are in complicated legalese, and as such effectively meaningless – someone can’t reasonably be expected to consent to a contract that they have no way of understanding), another (perhaps more significant issue) is that when most contracts state that they won’t share information with ‘third parties’ they really don’t clearly identify what a third party is.

Let me unpack that last bit, just a little. Let’s say that you enter into a contract/agree to an EULA with Company Alpha (Company A). Unbeknownst to you, Company A is a subsidiary of Company Big (Company B for short), who is a subsidiary of Core Company (Company C, for short). When you enter into an agreement with Company A, your information can often be passed around the rest of the corporate family without violating the contract that you consented to. Of course, the average consumer has no clue who is a member of a ‘corporate family’, and is still vulnerable to the commonplace divergent understandings of corporate privacy policies in the various subsidiary corporations. Most people are also unaware that this means that their granular data, which is on its own not terrible useful or informative about themselves as users, is drawn together to compose substantial data doubles, and that these doubles are (a) valuable; (b) used to discriminate against consumers without their being aware of the discrimination taking place.

Alleviating third-party worries

I hesitate to say that I necessarily LIKE this way of doing things, just because I’m hesitant about how facebook actually operates. That said, Facebook is releasing a new service (Facebook Connect) where the privacy settings that you establish in the Facebook environment will carry along with you to the other websites that you access. Of course, this means that Facebook will be gathering information on where you go, what you do, and so on. It also means that to enjoy a unified privacy policy that you’ll need to be a member of Facebook – you’ll need to be willing to give a corporation access to your personal data to enjoy something that you really should be able to expect a government to set up for you.

Nevertheless, Facebook’s Connect Platform may offer a way for Facebook users to enjoy a common attitude towards privacy. This is one of the solutions that Lessig notes in Code 2.0, but I remain concerned about the solution for the reasons that I addressed in my MA thesis. Namely:

  1. Without federal/state/provincial regulations, violations of a corporate policy lack a clear punitive strategy. Without a monetized penalty, corporations may be less willing to entirely abide by the codes of conduct.
  2. It makes it challenging to enjoy a granular privacy policy – I may not want to let Nike know much about me, whereas I’m comfortable telling the local government a great deal.
  3. What happens if a particular group chooses not to ‘buy-in’ to the Facebook program for their own, valid, reasonings? Are citizens to become citizen-consumers, where to enjoy their constitutional rights they are limited to the corporate brands that they see as ‘healthy’ to them?
  4. Why *shouldn’t* government be the body responsible for setting these kinds of rules and regulations, and developing the IT frameworks to allow all citizens to have consistent privacy frameworks across their browsing experience. I’m not suggesting that citizens would subsequently be required to use the government systems, or that there aren’t inherent challenges with any large body establishing a common privacy level that travels with me across the ‘net, but I’m far more comfortable with a democratically legitimated body doing this than a for-profit corporations who just wants to harvest my personal information.

Ultimately, however, I want to quickly return to Yahoo!’s own stance toward privacy and Fire Eagle. Yahoo! is being reasonably up-front, honest, and genuine with the consumer – they’re doing their job in providing the information that consumers really need to be aware of, in language that is easily accessible. Whether or not people read the privacy policy, the policy isn’t one that is so filled with legalese that it’s non-sensical to the average person. This, in and of itself, is a massive change in how the industry constructs their privacy notices, and is something that reflects well on their division of Yahoo! services.

Pro-privacy initiatives are getting out of hand – Or Are They?

Don Reisinger’s posting on Pro-privacy initiatives are getting out of hand is a good read, even if I don’t think that he ‘gets’ the reason why privacy advocates are (should be?) concerned about Google Streetview. If you’ve been under a rock, Google is in the process of sending out cars (like the one at the top of this post) to photograph neighborhoods and cities. The aim? To let people actually see where they are going – get directions, and you can see the streets and the buildings that you’ll be passing by. It also lets you evaluate how ‘safe’ a neighborhood is (ignoring the social biases that will be involved in any such estimation) and has been talked about as a privacy violation because some people have been caught on camera doing things that they didn’t want to be caught doing.

Don: Privacy Wimps Stand Up, Sit Down, and Shut Up

Don’s general position is this: American law doesn’t protect your privacy in such a way that no one can get one or take a photo of your property. What’s more, even if you were doing something that you didn’t want to be seen in you home, and if that action was captured by a Google car, don’t worry – no one really cares about you. In the new digital era, privacy by obscurity relies on poor search, poor image recognition, and even less interest in what you’re doing. Effectively, Streetview will be used to watching streets, and little else.

Continue reading