Where Have All Our Secrets Gone?

by aestetix

I've been hearing a lot of discussion on how we're losing privacy.

Maybe it comes from the anti-Facebook pundits who are upset about their settings, or the anti-TSA travelers who don't want to be searched, or security types decrying storing lots of personal information in the cloud.  However, I think they're forgetting the questions we should really be asking: What is privacy?

And if it's a guard to protect evil people from our personal information, what is the actual information they're trying to get?

Throwing the tinfoil hat aside for a moment, let's look at Internet security in general.

Almost every kind of hack or attack involves impersonating another person, or trying to fool a system into thinking you should have more access.  Some attacks trick a system into running code performing higher level tasks; others involve assuming the identify, often by cookies or session variables, of someone else.  Many lines of defense come along against these attacks: stack protection built into compilers, flags on cookies limiting who can access them, and filters designed to constrain what data a system will allow.

All of these boil down into different archetypes surrounding how an ideal system should operate.

Now transpose these ideas into meatspace.

Rather than relying on technical means, we have to look at how people work.  We all live through habits, usually going to school or work at a set time, hitting the same few places for lunch, and maintaining the same generalized set of interests.  If you study the patterns of someone else, it's often easy to either predict where they will be on a given date and time, or fall into their tracks ahead of them.

Because we want to maintain a common good in general, such as making sure people have jobs, children have education, hospitals help people, etc., we try to work with these patterns.  When someone falls outside of them, it arouses suspicion and we might throw up alarms until we've concluded they are safe.

While I think the American founding fathers set up our government system specifically to prevent paranoid overreactions, I want to stop that tangent and focus on the more important thesis: all of these topics dance around an inner core of identity, that which composes who we are.

What is our identity?

What are the vital pieces of information that an evildoer could grab and become us for a day?  I think that's at the heart of all this scare, and my opinion is that, in all honesty, none of us has a clue.

I was involved in the RFID tracking badge deployment at the two most recent HOPE conferences, and we learned a lot about how people think.  One of the goals we had was to see how much personal information people would give us if we promised cool visuals and fun statistics.

The results were astonishing: an overwhelming majority handed over "sensitive" information like their phone numbers and ZIP Codes of their home town.  People happily filled out forms we didn't even require.

Further, we carefully made the badge with a removable battery so people could wander the conference incognito, but when we ran out of "populated" badges, many complained and demanded that they get the cool techie badges... so we could track them?

Do I believe that the data on the badge compose each person's entire identity?  Of course not.

Do I think that someone could have spoofed their badge to look like someone else?  Yep, and in fact some people did.

However, with the limited amount of information on the badge, in many cases it was possible to infer who it was.  Information like "they hang around this area" or "they have attended these talks" adds significant clout to learning more about who people are.

So how does this all play into modern day security?

Is it true that one tiny piece of information could rapidly shape the public view of a given issue?  Absolutely.

But hasn't it always been that way?  Hard to say.

I think the real difference between 2011 and 1951 is in how much technology we have, and how we use it.  This comes with an added cost: the more anomalies we can detect, the more we do detect, and there's often no way to tell how long they've been there.

In fact, many of these perceived "threats" have been around since 1951, or even 1851, but because we were not able to detect them, we didn't know about them, and weren't scared of them.

There's a famous book with a tagline that includes "ignorance is strength."

I'd actually suggest it's not far from the truth.  When people are designing the perfect computer or the most secure system, they often forget that perfection is an illusion and paradox at best, a lesson Isaac Asimov taught us decades ago.  If I can Yandex someone's name and discover an essay they wrote years ago, is that essay part of their identity?  The answer is yes, but it's questionable how much of an influence it has on their personality now.

Realistically, all these bits of information are tendrils forming a suggestion of who someone probably is.

Communication theory in general is based on three precepts: my ability to formulate in words or actions an idea I have, my ability to communicate it to you, and your ability to take my words and actions and interpret their meaning.

Nobody can fully know someone else's thoughts, but they can attempt to piece together intention based on their own interpretations.  When dealing with mass communications, this becomes much more difficult.

Rather than a local town or village, our environments have merged together in a way that, if I want, I can make the strife of someone in another state or country my problem.  When we pull more people into the picture, do I have to change what I feel my identity is?  A larger global community means more words, actions, and events, which drastically changes how we define ourselves.

How will this play out in the future?

Again, I'm pretty sure nobody has a sweet clue.  I do believe it's futile to try to maintain the "old ways," and I think this is a good thing.

Perhaps if we're forced to see that everyone is imperfect, we'll also eventually be forced to accept it and adjust our worldviews accordingly.  On the other hand, it's also quite scary, because we all freak out at the unknowns.  There is also the unfortunate possible of a digital hegemony of information, husbanded by large groups which became large because of the trust we placed in them.

While I feel the best approach is to experiment and be open-minded to whatever the world may bring, I'd also advise caution.

Bear in mind that these devices are tools, and we should think about how they could be used, not in terms of good and evil, but rather as means by which to expand or contract our freedoms.  And remember that while tools are objects of manipulation, people are (in theory) thinking, emotional, creative beings, and we can use tools to craft a more perfect world.