Slashdot Mirror
Schneier On a Generation Gap In Privacy
goompaloompa writes "In the Japan Times, Bruce Schneier writes that a passing conversation online is not what it may seem and that maintaining your privacy is becoming even more difficult as social media and cloud computing become the norm. Furthermore, while users in Japan may think they are secure, their level of protection may vary when the computers that store their data are overseas. At the root of the problem is a new generation gap: old laws incapable of covering current-day scenarios. Quoting: 'Twenty years ago, if someone wanted to look through your correspondence, they had to break into your house. Now, they can just break into your ISP. Ten years ago, your voicemail was on an answering machine in your office; now it's on a computer owned by a telephone company. ... We need comprehensive data privacy laws, protecting our data and communications regardless of where it is stored or how it is processed. We need laws forcing companies to keep it private and delete it as soon as it is no longer needed, and laws giving us the right to delete our data from third-party sites. And we need international cooperation to ensure that companies cannot flaunt data privacy laws simply by moving themselves offshore."
Some 20 years from now, the confirmation hearings for supreme court justice nominations will get to be really interesting. Also the mud slinging and sliming and negative ads during election campaigns are going to be even more entertaining than it is now. We will be living in really interesting times.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
If someone breaks into your ISP, it's not just your information they get. Say the ISP has the data for N people. If more than 1/N people of loose morals are capable of breaking into the ISP, your odds of having your data exposed are larger this way than your odds of having your data exposed by someone breaking into your house. Making simplifying assumptions like people being equally interested in breaking into houses and ISPs, and one person per house etc of course.
My gut feeling (which may be wrong, gut feelings often are when it comes to security) is that your correspondence is much much safer in your house, unless there is a particular reason someone wants your particular information rather than information to fish through. Furthermore, most people are STILL vulnerable to the house break-in, as there is sufficient information there to fool the ISP through a social engineering vector. Also, the people who broke into your house probably didn't care about your information, from your description they were likely just after the tangible properly.
Finally, the ISP may simply sell the information anyway.
Dammit, it's "flout", not "flaunt".
It's not that people are paranoid, but there are occasional events that are creepy, which point to a need for more privacy.
The one that was the tipping point for me actually happened to a co-worker: in the mid-late 90's he was taking AZT (yes, he had AIDS). The creepy part came shortly after getting his first AZT prescription filled...a few weeks after his first prescription he started getting mailed advertisements for graveyard plots. Yes, his pharmacy had sold the fact that he was taking AZT to a marketing company, who realized he was about to die & tried to sell him a grave. It's not that he was being targeted in any malicious way, but I think it's clear (at least, to me) that his privacy had been badly violated by his pharmacy.
That's the sort of thing I use as a model for privacy. In the intervening years, health data has been (somewhat) protected, but I think it's still a valid point for consideration: you may not think of your own information as important, but some of it can still be used to make some very creepy conclusions about you, and will be used in some very creepy ways if you're not careful.