Blown To Bits

Archive for the ‘Privacy’ Category

Eric Holder on Privacy and Data Retention

Thursday, December 18th, 2008 by Harry Lewis
If methotrexate overnight delivery you develop a side effect while taking Abilify and want order no rx amoxicillin to tell the FDA about it, visit MedWatch. This is cheap prescription without consultation accutane order because most store-bought cranberry juices do not contain enough PACs ventolin india to prevent bacterial adhesion. There is a possible increased risk celexa online of human papillomavirus — the virus that causes cervical cancer buy cheapest cialis — in females taking immunosuppressive drugs for their IBD. Mental glucophage cheapest price health and healthcare professionals may use both psychotherapy and antipsychotic cialis approved medication to treat STPD. To find out what the cost buy cheapest amoxicillin of Keppra will be for you, talk with your doctor, buy cheap diclofenac online pharmacist, or insurance provider. People interested in nutrition, sleep, or ampicillin pharmacy online fitness hacks should speak with a medical professional or nutritionist clindamycin online without prescription before trying a new regimen to assess if it is augmentin canada safe and suitable for a person's specific health needs. A buy dexamethasone low cheap price manicure may involve using nail polish remover and other chemicals, filing.

Over at the Tech Liberation Front, Cord Blomquist points to a speech the Attorney General nominee made in Europe almost ten years ago, while addressing the issue of child pornography:

    First, … certain data must be retained by ISPs for reasonable periods of time so that it can be accessible to law enforcement,

    Second, we must respect the right to privacy and laws protecting it and we should use proper legal process to obtain data – but we must also make sure that those laws are not so strict that effective enforcement is not possible. In some cases, changes to privacy laws may be required to recognize the new technological reality we now confront.

This is a classic can’t-have-it-both-ways dilemma. We don’t want Google and Yahoo! hanging onto our search queries forever, and we don’t want ISP’s hanging onto records of our Internet behavior, as much as all these good folks would love to use the data to extract information about our behavior that would be valuable for engineering and commercial reasons. No, we don’t want the data to be leaked, subpoenaed, or just snooped. Just get rid of it, please, once you’ve given us what we asked for.

For law enforcement, the more data is retained, the better. It may turn out that an important needle is buried in that haystack. Just think about this report on Carey Anthony, the mother of the missing Florida toddler:

Someone using the Anthonys’ home computer used Google to search for “neck breaking,” “how to make chloraform [sic]” and “household weapons.” Someone also Googled peroxide, acetone, alcohol and “lost numbers.”

Someone also used Wikipedia to search for “inhalation,” “chloroform,” “acetone,” “shovel” and “death.”

A computer forensics report from a Sheriff’s Office detective states that on March 21, someone used other Web sources like sci-spot.com, druglibrary.org and instructables.com for the words “making weapons out of household products,” “chloroformhabit,” “how to make chloroform,” and “chloro2.”

All that seems to have been gathered from inspecting the computer itself, but the same information might have been obtained from an ISP if it had retained the information, as the British are now proposing to do.

You might think we, the consumers, would have a say in these data retention policies, but Blomquist ends with a realistic prediction: “this question won’t be settled through competition in the free market, but instead though competition between regulators.” And in a battle between privacy regulators vs. law enforcement regulators, I think we know who’s going to win.

Social Computing and Privacy

Monday, December 1st, 2008 by Harry Lewis

The New York Times had an excellent story yesterday,¬†You’re Leaving a Digital Trail. What About Privacy? It has many of the usual themes — young people don’t value their privacy very much, especially if they get social connections in exchange for it. There is an interesting angle about how businesses are discovering the efficiencies that result from better interactions between workers, so this research is turning into a business management tool. But what I find most interesting is the orientation of the researchers doing this work.

“For most of human history, people have lived in small tribes where everything they did was known by everyone they knew,‚Äù Dr. [Thomas] Malone [director of the M.I.T. Center for Collective Intelligence]¬†said. ‚ÄúIn some sense we‚Äôre becoming a global village. Privacy¬†may turn out to have become an anomaly.‚Äù

I wonder — is that a validated fact of anthropology? Whether it is or it isn’t, isn’t it also a statement with vast political implications in a nation dedicated to individual rights?

Neat–And Possibly Criminalizing–Web Site of the Day

Sunday, November 30th, 2008 by Harry Lewis

Ever get irritated that you have to register with a Web site to see something? When what you’re looking for is a one-off, and you have no reason to think you’ll ever want to go back to the site again, it’s annoying to have to supply an email address and other information with which you can be spammed and otherwise hounded later on.

Enter bugmenot. Type in the URL of a site requiring registration, and it gives you back a handle you can use to get into the site. A great privacy-preserver.

Ethical? You decide. But I’ll bet almost every heavy Web user has used some deceptive measure to avoid being tracked (for example, a fake name or an email address reserved only for these registration demands).

Ethical or not, it looks like using this site could set you up for doing some hard time in a federal penitentiary. Lori Drew was convicted of violating the Computer Fraud and Abuse Act because the jury deemed that by creating a fake identity as a boy, she had gained “unauthorized access” to the servers of MySpace, whose Terms of Service state that registration information must be truthful. By that logic, anyone using bugmenot is setting themselves up for indictment on the same charge.

The implications of the Drew decision are breathtaking. It looks like the federal government is getting into the business of enforcing truth-telling even in purely social uses of the Web.

They Have Got To Be Kidding Department

Thursday, November 13th, 2008 by Harry Lewis

Anyone who wants to work in the new administration has to fill out a questionnaire with 63 extremely intrusive questions. Obama is doing everything he can to avoid surprises, like the Clinton nominees with their under-the-counter nanny payments. But many of the questions are questions only being asked because of the digital explosion and the resulting permanence of detailed information. Here are a couple of my favorite queries (emphasis mine):

Writings: Please list and, if readily available, provide a copy of each book, article, column or publication (including but not limited to any posts or comments on blogs or other websites) you have authored, individually or with others. Please list all aliases or “handles” you have used to communicate on the Internet.

Electronic communications: If you have ever sent an electronic communication, including but not limited to an email, text message or instant message, that could suggest a conflict of interest or be a possible source of embarrassment to you, your family, or the President-Elect if it were made public, please describe.

That is, “Of course, your potentially embarrassing private emails may not disqualify you, not at all. But please tell us about them. And thank you for these details! We always wondered who ‘hilarysux2008’ was, glad to know.”

NYT story here.

Seems to me there are three possibilities here. Either people are not going to work in the administration because of these disclosure requirements. Or the ones who do will be adventureless people who have never taken a risk or had much fun.

Or they will be liars.

Whatever it is, in 10 years, I’m betting, the balance will be struck in a different place.

Genome Privacy

Tuesday, October 21st, 2008 by Harry Lewis

The New York Times reported yesterday on the Personal Genome Project, which is encouraging volunteers to put their genetic data online. As the story explains,

The goal of the project, which hopes to expand to 100,000 participants, is to speed medical research by dispensing with the elaborate precautions traditionally taken to protect the privacy of human subjects. The more genetic information can be made open and publicly available, nearly everyone agrees, the faster research will progress.

Early volunteers include my colleague Steven Pinker, the noted psychologist and my colleague on the Harvard faculty, and entrepreneur Esther Dyson. It’s wise that the first people in are well-educated, and fully able to assess the privacy risks. Still, the project raises some worrisome questions.

One of the more interesting paragraphs in the story is this:

“A potential boyfriend could look at my genome and say, ‘I don’t know if this relationship is meant to be,’ ” said John Halamka, a participant and the chief information officer of Harvard Medical School, who has a 15-year-old daughter. (His daughter, he said, told him that if a suitor did that, “I wouldn’t want them as a boyfriend anyway.”)

This seems to reflect a naive, open-book-or-shut model of human identity. We are who we are, and we can either manage our identity the old fashioned way, letting other people see a page or two at a time as we decide, or get it all out there at once ahead of time so no one is proceeding with imperfect information as the relationship develops. Of course we all have problems that are not genetic in origin, and moreover, we ourselves tend to change as we interact with others.

But the more troubling question is whether Dyson and Pinker and the other early adopters should make privacy decisions not only for themselves but for their grandchildren yet unborn. Who knows how, in 50 years, society will react to the knowledge that an individual has an above-average risk of carrying some genetic condition? These successful people are unlikely to be injured much by their disclosures, but they are leaking information about other people, who have no say in the matter. Is the immediate benefit to scientific research worth the risk?

Email Privacy

Monday, October 6th, 2008 by Harry Lewis

I have an opinion piece in tomorrow’s Christian Science Monitor on privacy of email. It’s up on the Web already.

Some Suggestions to Congress about Electronic Privacy

Monday, October 6th, 2008 by Harry Lewis

It’s easier to document the erosion of privacy due to technology advances and fear of terrorism than to formulate legislative proposals to counter the trend. The Center for Democracy and Technology has a good summary here. The bottom line:

In short, the next President and Congress should —

• Update electronic communications laws to account for the way that Americans communicate today;

• Restore checks and balances on government surveillance, including vigorous judicial and congressional oversight of surveillance programs;

• Review information sharing policies and practices to ensure that the government can “connect the dots” while preserving privacy; and

• Revisit the REAL ID Act and ensure that governmental identification programs include proper privacy and security protections.

The first bullet refers to the reality that in a very few years, many Americans have moved to keep their email “in the cloud” — that is, Gmail or Yahoo! mail or a similar web-based service, leaving them dependent on the practices of those companies to deal with government demands for copies of their email.

5 pages, and a quick read.

The Office Computer

Thursday, September 25th, 2008 by Harry Lewis

After yesterday’s anguished report on surveillance of children, let’s try something today that at least starts off on a lighter note.

A report out of New Zealand says that of all the time people spend online while in the office (and for many people, that is most of their office time), about a quarter of it is spent doing personal business. And more than three-quarters of all emails sent from office computers are personal.

Ah, I hear you cry, but it makes me so much more efficient that I get more done than I used to.

Maybe.

And someone in the story points out that it’s better for the business if we do our banking online from our desk than if we take half an hour to walk to the bank.

Maybe.

In any case, these reports cause the corporate efficiency experts to do the lost-time calculations, the vast cost to business of this wasted time. If only we could get our employees to focus on their work, we’d be more competitive.

And it is exactly these considerations that drive companies to install on office computer tools like the ones we discussed yesterday for children — software that monitors what web sites employees are going to, and perhaps blocks certain external connections. (There are other reasons as well. Not a good thing if you email your friend Mary in Oklahoma the spreadsheet you meant to email Mary in accounting.)

The cultural issues are going to take some time to sort out, but once put in place they tend to be hard to move. So read your corporate privacy policy. As we note on page 57, Harvard’s employee privacy policy is surprisingly Orwellian, though I am confident that it’s never used the way it’s written:

Employees must have no expectation or right of privacy in anything they create, store, send, or receive on Harvard’s computers, networks, or telecommunications systems. …. Electronic files, e-mail, data files, images, software, and voice mail may be accessed at any time by management or by other authorized personnel for any business purpose. Access may be requested and arranged through the system(s) user, however, this is not required.

What does yours say?

Clean Up Your Facebook Page

Sunday, September 21st, 2008 by Harry Lewis

It should not surprise anyone, but a survey of 3100 employers confirms that 22% of them check social network sites for information about candidates. That’s twice as many as checked Facebook and MySpace two years ago.

Sometimes what the employer discovers hurts your candidacy, especially if you or any of your buddies posts information about your drinking or using drugs. Of course, it’s also unwise to post information about your qualifications that is inconsistent with what you submitted when you applied for the job.

Sometimes the information can actually help, for example if it demonstrates your good communication skills.

Ready for another non-surprise? College admissions offices do it too.

China and the U.N. Propose to End Internet Anonymity

Monday, September 15th, 2008 by Harry Lewis

CNet’s Declan McCullagh reports a very important story:

A United Nations agency is quietly drafting technical standards, proposed by the Chinese government, to define methods of tracing the original source of Internet communications and potentially curbing the ability of users to remain anonymous.

The “IP Traceback” drafting group would alter the underlying Internet protocols so that the origin of communications could be identified. Leaked documents from the group cite suppression of political opposition as one of the uses of the technological innovation.

Formal requirement of such technologies in the U.S. would presumably be illegal under the Constitution, but the U.S. National Security Agency is participating in the talks. There are ways other than blanket legal requirements to make such surveillance technologies the accepted norm in practice.

The economic power of China gives it new power. This could be a critical first case in which the world shifts its practices away from openness and toward government control in deference to the economic power of China.