Slashdot Mirror
The Death of Privacy
Debra D'Agostino writes, "Why don't companies care about privacy? Because there's not enough money to be made from securing sensitive customer information, says Jeff Rothfeder in an article posted recently at CIO Insight. Furthermore, there's not enough money to be lost in privacy breaches for companies to care. 'Most companies claim that privacy is a priority — chiefly because they believe consumers are more willing to do repeat business with them if personal information is carefully handled,' he writes. 'But in reality, many companies are woefully inept at protecting privacy.'"
GMail isn't any more of a privacy mess than any other webmail, they're just a little more obvious about it. Anytime you have your mail saved on someone else's server, they can do anything they want to it, and you just won't know. So GMail has some bots looking for keywords for ads. You know that. Do you know if Hotmail or Yahoo have bots looking at your emails? Or if their security is tight enough that random employees aren't reading random emails?
"What is Internet Explorer 7? Are you saying we can't access the normal internet?" - I love tech support. Really.
With the Data Protection Act here in the UK and similar laws throughout the EU, companies are legally obliged to keep personally identifiable information confidential and if they do not they can be prosecuted. Implement that in the US, there's your answer.
We apparently live in an "information" age, and as such information is power and/or profit depending on your aims.
This article states the obvious, if you pass your data on to a company for the purpose of say making a transaction they are going to try and hold on to that data, because it has additional value.
The fact is that information about people, is worth a lot of money, not so much names, postal and email addresses (although it has some in a certain context) but data that includes demographic information or any other information that can be used to deduce trends or intentions, (like age, sex, income, health information, credit and spending history, even complaints).
Without a rigorous and enforceable framework to regulate the use and transfer of this information it is going to be used in whatever manner ensures maximum profit for the company, be that keeping the data secret and using it in house to "add value" and so that you continue to trade with them or spreading it far and wide to generate some cash quickly.
What is needed are real penalties for intentional and accidental information disclosures, after all if data has a value and its yours then surely you are entitled to be reimbursed if it is compromised, but that will probably never happen, especially given the complexity of identifying the leaks.
In addition the line FTA: "...offering these records to the highest bidder, despite an online privacy policy that explicitly stated the company would never share customer data with any third party" proves the point that regardless of what an online or other privacy policy might state it is just that, a policy, usually subject to change, and more over not a guarantee to the customer (unless it is described as such and you don't see that all that often)
As an example, I recently started getting a huge amount of junk mail (the old kind that comes through the letter box) mainly offering credit cards and other credit facilities, it was badly targeted (offering products aimed at people with bad debt, corporate entities, people with good credit, and people over 60).
I managed to speak to 4 of the more prominent companies (international banks) and a smaller number of the smaller firms to ascertain the original source of the data, it turns out that the finance companies making these offers where inter sharing data massively, leading to a web of sources. My search lasted just over two months of calling and writing (asking people to remove the data as I went along) that ultimately ended with a major credit reference agency (one of the 2 Major UK agencies), who I have never dealt with directly, but who were used for a credit check when I recently purchased a mobile phone through a very large and reputable telecoms provider.
It turns out that the credit reference agency ticked the little box on their computer system that said that I consented to the sharing of my data (something that I make a point of not doing and doubly so as I hadn't dealt with them directly...). They have offered to stop sharing my data, but that is all, and of course the "damage" is already done. All a bit late really as once your data is out there its out there forever, or until you move or your details change enough to make it useless.
So there really is no real way of protecting your data any more, and one mistake by you or someone else and you are stuffed. The only thing I can suggest is changing your name, address, phone number, email address and possibly your gender about every 12 months....
The benefits outwigh the costs only in some cases. To take your comments about process optimization and basic infrastructure you have to consider the costs of privatized infrastructure. Here in the U.S. private companies (varying from state to state) control more or less of the infrastructure. In California almost all of the power infrastructure is in private hands. Those hands recently determined that it was more cost-effective to shut down power stations rather than run them. This was effective because the resulting scarcity of power caused the price of all other killowat hours to go up.
The practical upshot of this was that companies such as Enron were able to stop spending money on some power plants and reap a much higher profit off of the others. For the consumers this meant that even as they faced surging utility bills (as much as 300% increases) they also were forced to deal with "rolling blackouts". The Government of California meanwhile felt its hands were tied and could do nothing to ensure that power was available to its citizens and thus that the essential infrastructure of the economy was running.
Incidentally all of this occurred just before a nasty recall election that booted the governor and brought the Gubernator into office, in part on the grounds that he would do better on the economy.
Just to forestall the obvious comments out the free market consider the cost of competition. If we are to presume that such excesses as I have described above will be checked by the action of the free market we face two problems.
Firstly the cost of getting into competition is extreme. Nuclear power plants don't grow on trees and neither do millions of miles of electrical lines. Infrastructural utilities are, in many ways, immune to competition because of the immense cost of investement and the infeasability of running multiple parallel infrastructure. Picture having multiple distinct road systems, power lines, sewers, or water systems. Picture the difficulty of switching from one system to another. Simple physical space and cost limitations make that infeasible.
Secondly, it was the free market that made that gouging possible. By having a free market on KwH pricing and opening up all aspects to competition and thus making the little intentional blackout scheme profitable.
To put it another way, do you want to pay the "market rate" for garbage removal?
Or, What security do you have when your elected officials can't guarantee the flow of water?