Monday, April 27, 2009
Lessons from the Identity Trail
"One uploaded photo, credit card number or status update at a time, we are relinquishing our privacy and anonymity." That's according to the results of a study on how society's use of information communication technologies impacts privacy and anonymity. University of Ottawa professor Ian Kerr and nearly two dozen researchers from across the globe spent four years examining the issue, ultimately determining that our anonymity and right to privacy is in jeopardy.The results of their research have been published in a book, On the Identity Trail: Anonymity, Privacy and Identity in a Networked Society, which is available for free download online. Kerr also provides an overview in this CBC podcast, which aired on April 17, 2009.
Among the findings:
While Canada, the U.K., the Netherlands and Italy all have national laws protecting privacy – that is, laws that allow citizens to control access to their personal data – such legal protection does not exist for anonymity.The researchers reported that governments are choosing laws that require people to identify themselves and are lowering judicial thresholds defining when identity information must be disclosed to law enforcement officials. That is allowing the wider use of new technologies capable of making people identifiable, including smartcards, security cameras, GPS, tracking cookies and DNA sequencing.
Consequently, governments and corporations are able to do things like:
- Embrace technologies such as radio frequency identification tags that can be used to track people and merchandise to analyze behaviour.
- Boost video surveillance in public places.
- Pressure companies such as internet service providers to collect and maintain records of identification information about their customers.
Wednesday, July 25, 2007
Ask.com and Microsoft call for privacy standards
According to PC World, Ask.com will be the first major search engine to offer an anonymous searching option to users. Their new AskEraser feature will give users the option to request that their search data not be stored.This is in stark contrast to Google’s recent announcement that they will reduce the time they save search data from over 30 years to “only” two years. In spite of Google’s voluntary reduction in cookie life, European privacy experts, among others, have soundly criticized the lifespan of Google’s cookies:
"Compared to the previous lifetime of 30 years, the period of two years seems to be short," Schaar wrote in an email. "But from a data-protection perspective, and considering the fact that the user's search behaviour is recorded and can be analysed for any purposes, this period is still too long."Meanwhile, Microsoft has joined Ask.com in calling on technology leaders to find a way to meet their need for advertising data without compromising user privacy:
"The first step is, we'll be in contact with all the other players in this space and talk about what a summit might look like," said Cullen. "We're very happy to host it, if that's the answer ... both Microsoft and Ask.com think that this is the time to make this happen."
Microsoft is planning to allow users to opt out of having their search data used to generate targeted advertising on Microsoft's Web sites, and under a new privacy policy, plans to scrub all search query data of any user-identifiable information after 18 months. While this is in part a shot at Google, it is encouraging to see some leadership within the industry to safeguard the privacy of their users’ search data.
The ability to search anonymously is essential in allowing individuals to explore any area of inquiry without fear of discovery or retribution. When companies track user data, their primary motivation is to inform their decisions about advertising. The abuse of search data has additional implications if the data is merged with that of advertisers, as I wrote in an earlier post about the proposed Google and DoubleClick merger.
When search data is breached, the consequences could be far more serious than mere embarassment. About a year ago, AOL inadvertently released the search data for about 650,000 searches on their site and New York Times reporters were actually able to identify one of the searchers. Breaches of this magnitude and specificity could ruin careers and reputations, while creating a chilling effect on the exploration and sharing of ideas over the Internet.
Google needs to stop hedging on privacy and get on board with this initiative.
Friday, May 11, 2007
Cops want covert cameras in public places
Police in Victoria, British Columbia want to install security cameras in public areas around the provincial capital in a bid to fight crime and reduce vandalism. I wrote an earlier post about the plethora of surveillance cameras in public areas and motorways in the United Kingdom and the concern that this was creating a “surveillance society” there.What’s different about the Victoria proposal is that while cameras in the U.K are visible to the public, police in Victoria want the cameras to be hidden. The rationale for hiding the cameras from public view is unclear. Visible cameras are designed to serve as a deterrent to crime, with the criticism that they only serve to move crime along to other areas. Hidden cameras are designed to catch criminals in the act, and could be argued to have a wider impact in deterring crime, as no one knows for sure where the cameras are located and when they are being watched.
Meanwhile, in a six-month pilot project, police in Toronto are extending the use of visible closed-circuit cameras from the downtown into residential areas with high crime.
"Wherever the analysis tells us that violence is likely to take place...those
are the areas we will use the technology," said police chief, Bill Blair.
Back in the U.K, police are building on their massive network of fixed cameras, by carrying camcorders with them on the beat in an increased effort to cut crime and reduce "anti-social behaviour. "
Sgt Craig Donald, of the INA's Safer Community Team, said: "Equipping officers with hand-held cameras has had great success elsewhere with reductions in anti-social behaviour and crime being recorded.
"It's a very effective way to secure evidence to support a prosecution and it's certainly a deterrent as people don't usually want to commit a crime if they think there is a chance they could be identified at a later stage."
The reactions from citizens in every jurisdiction where police surveillance cameras are being used is inevitably mixed. Some support the cameras as they believe they will improve social order and reduce crime, and besides, they’re not doing anything wrong. Others object to the intrusion into their privacy and how the very presence of the cameras may alter their decisions. When cameras are visible, people can at least choose to avoid them. Hidden cameras have a greater chilling effect on the average citizen, as they never know when or where they could be filmed.
What if you’re a gay man who regularly attends a local gay bar? Or, you are a concerned citizen who wants to participate in public protest rally against a police or government decision? Or, you’re seeking medical attention and you don’t want anyone to know about it? Would the presence of visible security cameras, or the threat of being monitored by hidden cameras make you think twice before participating in any of these lawful activities?
While the evidence to support the claims that cameras reduce crime is in dispute, the use of this surveillance technology by police is here to stay and citizens need to be informed about how and why it is being used. Police must be held to the highest standard of accountability to ensure transparency and to ensure that privacy laws are not violated. In our efforts to reduce crime and improve social order, we should not trade away our rights to privacy and to participate fully in society without fear.
So, as you go about your business today - do you really know if you’re being watched?
Monday, May 7, 2007
Shooting the messenger : Taking the Internet to court
Just for a moment, put yourself in the shoes of these two men:Case No. 1: You’re just an average guy who meets a nice girl and you begin dating. After a few months, the new relationship sours and you decide to move on. But your ex-girlfriend doesn’t move on. She is angry and decides to warn everyone about you on a website called dontdatehimgirl.com. Using an anonymous username, she posts a photo of you, along with your full name, city and state and writes an invective-laden comment, accusing you of being a herpes-infected homosexual or bisexual, who passed on a sexually transmitted disease, and fathered numerous illegitimate children. You ask the website owner to pull the post, but learn that your only recourse is to post a comment as rebuttal to the offending post. The original post will remain, searchable to anyone who accesses the site, just by looking up your name.
Case No. 2: You’re a prominent businessman, with clients primarily in the legal and judicial profession. You decide to join a fledgling political party and soon become the party’s campaign manager and financier. You make some decisions that aren’t popular with some of the party members and they use websites such as Wikipedia and P2Pnet to criticize your decisions. But some go further, posting anonymous statements which you maintain are untrue and which you fear will seriously damage your professional and political reputation. You ask the site hosts to remove the offending posts, but they are either unable or unwilling to comply with your requests, or they do not comply quickly enough.
What would you – what could you – do next? Ignore the posts? Put up your own website to refute the libelous statements against you? Try to track down the anonymous posters and sue them? Or, sue the site hosts?
In both cases, the men at the centre of these attacks decided to fight back in court by suing the site hosts.
In the first scenario, Todd Hollis took the owner of website dontdatehimgirl.com, Tasha Cunningham to court for allowing the posts in the first place and for refusing to pull them down. (Shout out to one-eyed view for bringing this site to my attention. He has an interesting post about it here). The factors leading to the judge’s decision to dismiss the case were not about the damage that may have been done to the plaintiff, nor about the fact that Ms. Cunningham is merely the messenger, not the originator of the message. The decision was made based on old-fashioned jurisdictional law: because the website originates in Florida and the lawsuit was filed in Pennsylvania, it was determined, through statistics from the site’s on-line shop, that few people in Pennsylvania would have seen the site. Therefore, the contacts in Pennsylvania were limited. It seems the door is open for Hollis to re-file his suit in Florida. In the meantime, he is planning to sue the woman who anonymously made the posting, which remains to this day on dondatehimgirl.com.
In the second scenario, Wayne Crookes decided last month to file suit against three sites: Google, P2Pnet.net and openpolitics.ca. Because Crookes is Canadian, this case has been filed in British Columbia, Canada. In a recent interview with the Globe and Mail, Crookes says that he is holding the site hosts responsible for the offending anonymous posts:
"I hope that the outcome is that people will realize they have obligations
and that they will be forced to accept responsibility for their actions. The
larger the organization, the greater the expectation that they will be held
accountable for their actions."
Both of these cases have wide implications for site hosts, free speech and anonymity.
Already, the Wikipedia article about Wayne Crookes has been all but expunged to the point that it is challenging to find the posts which ignited the lawsuit in the first place. What chilling effect will this particular lawsuit and others like it have on site hosts, as the laws vary from one jurisdiction to another?
Will more individuals feel less inclined to put their names to posts, even if they strongly feel they are serving a wider public good? Should there be a looser set of criteria for libel if one is a public figure, working in the public trust, such as Mr. Crookes, versus a more rigorous standard for the average citizen, like Mr. Hollis?
Anonymity on the internet is essential to giving a voice to those who might otherwise be silenced. We don’t all live in truly democratic nations, and the Internet is a global community. Even in Western democratic nations, whistleblowers still need extraordinary protections if they choose to go public.
It will be interesting to follow these two cases on both sides of the border – one private citizen, one public figure. How will the judges decide what is more important – the greater good, or the rights of the individual? The odds seem to favour the greater good, which will likely be small comfort to Mr Hollis and Mr. Crookes.
Just put yourself in their shoes.
Sunday, April 29, 2007
2K Bloggers: Anonymous Blogging
As a follow-up to my previous post, I highly recommend Elaine’s excellent post over at 2K Bloggers:The EFF (Electronic Frontier Foundation) suggests these six things you should do to be anonymous: Use a Pseudonym and Don’t Give Away Any Identifying Details, Use Anonymizing Technologies, Use Ping Servers, Limit Your Audience, Don’t Be Googleable, Register Your Domain Name Anonymously. But there’s more you can do, too... Read the rest of Elaine's post here.
