A Gift of FireThird editionSara BaaseChapter 2: PrivacyWhat We Will CoverPrivacy and Computer TechnologyBig Brother is Watching YouPrivacy TopicsProtecting PrivacyCommunicationsPrivacy and Computer TechnologyKey Aspects of Privacy:Freedom from intrusion (being left alone)Control of information about oneselfFreedom from surveillance (being tracked, followed, watched)Privacy and Computer Technology (cont.)New Technology, New Risks:Government and private databasesSophisticated tools for surveillance and data analysisVulnerability of dataPrivacy and Computer Technology (cont.)Terminology:Invisible information gathering - collection of personal information about someone without the persons knowledgeSecondary use - use of personal information for a purpose other than the one it was provided forPrivacy and Computer Technology (cont.)Terminology (cont.):Data mining - searching and analyzing masses of data to find patterns and develop new information or knowledgeComputer matching - combining and comparing information from different databases (using social security number, for example, to match records)Privacy and Computer Technology (cont.)Terminology (cont.):Computer profiling - analyzing data in computer files to determine characteristics of people most likely to engage in certain behaviorPrivacy and Computer Technology (cont.)Principles for Data Collection and Use:Informed consentOpt-in and opt-out policiesFair Information Principles (or Practices)Data retentionPrivacy and Computer TechnologyDiscussion QuestionsHave you seen opt-in and opt-out choices? Where? How were they worded? Were any of them deceptive?What are some common elements of privacy policies you have read?'Big Brother is Watching You'Databases:Government Accountability Office (GAO) - monitors government's privacy policiesBurden of proof and 'fishing expeditions'Data mining and computer matching to fight terrorism'Big Brother is Watching You' (cont.)The Fourth Amendment, Expectation of Privacy and Surveillance Technologies:Weakening the Fourth AmendmentSupreme Court decisions and expectation of privacyModern surveillance techniques are redefining expectation of privacy'Big Brother is Watching You' (cont.)The Fourth Amendment, Expectation of Privacy and Surveillance Technologies (cont.):The USA Patriot Act and national security lettersNo court order or court oversight needed2003-2005 report found 'widespread and serious misuse' of the FBIs national security letter authorities'Big Brother is Watching You' (cont.)Video Surveillance:Security camerasIncreased securityDecreased privacy'Big Brother is Watching You' (cont.) Discussion QuestionsWhat data does the government have about you? Who has access to the data? How is your data protected?Diverse Privacy TopicsMarketing, Personalization and Consumer Dossiers:Targeted marketingData miningPaying for consumer informationData firms and consumer profilesCredit recordsDiverse Privacy Topics (cont.)Location Tracking:Global Positioning Systems (GPS) -computer or communication services that know exactly where a person is at a particular timeCell phones and other devices are used for location trackingPros and consDiverse Privacy Topics (cont.)Stolen and Lost Data:HackersPhysical theft (laptops, thumb-drives, etc.)Requesting information under false pretensesBribery of employees who have accessDiverse Privacy Topics (cont.)What We Do Ourselves:Personal information in blogs and online profilesPictures of ourselves and our familiesFile sharing and storingIs privacy old-fashioned?Young people put less value on privacy than previous generationsMay not understand the risksDiverse Privacy Topics (cont.)Public Records: Access vs. Privacy:Public Records - records available to general public (bankruptcy, property, and arrest records, salaries of government employees, etc.)Identity theft can arise when public records are accessedHow should we control access to sensitive public records?Diverse Privacy Topics (cont.)National ID System:Social Security NumbersToo widely usedEasy to falsifyDiverse Privacy Topics (cont.)National ID System (Cont.):A new national ID system - Proswould require the cardharder to forgehave to carry only one cardA new national ID system - ConsThreat to freedom and privacyIncreased potential for abuseDiverse Privacy Topics (cont.)Children:The InternetNot able to make decisions on when to provide informationVulnerable to online predatorsParental monitoringSoftware to monitor Web usageWeb cams to monitor children while parents are at workGPS tracking via cell phones or RFIDDiverse Privacy TopicsDiscussion QuestionsIs there information that you have posted to the Web that you later removed? Why did you remove it? Were there consequences to posting the information? Have you seen information that others have posted about themselves that you would not reveal about yourself?Protecting PrivacyTechnology and Markets:Privacy enhancing-technologies for consumersEncryptionPublic-key cryptographyBusiness tools and policies for protecting dataProtecting Privacy (cont.)Rights and laws:TheoriesWarren and BrandeisThomsonTransactionsOwnership of personal dataRegulationHealth Insurance Portability and Accountability Act (HIPAA)Protecting Privacy (cont.)Rights and laws: Contrasting Viewpoints:Free Market ViewFreedom of consumers to make voluntary agreementsDiversity of individual tastes and valuesResponse of the market to consumer preferencesUsefulness of contractsFlaws of regulatory solutionsProtecting Privacy (cont.)Rights and laws: Contrasting Viewpoints (cont.):Consumer Protection ViewUses of personal informationCostly and disruptive results of errors in databasesEase with which personal information leaks outConsumers need protection from their own lack of knowledge, judgment, or interestProtecting Privacy (cont.)Privacy Regulations in the European Union (EU):Data Protection DirectiveMore strict than U.S. regulationsAbuses still occurPuts requirements on businesses outside the EUProtecting PrivacyDiscussion QuestionHow would the free-market view and the consumer protection view differ on errors in Credit Bureau databases?Who is the consumer in this situation? CommunicationWiretapping and E-mail Protection:Telephone1934 Communications Act prohibited interception of messages1968 Omnibus Crime Control and Safe Streets Act allowed wiretapping and electronic surveillance by law-enforcement (with court order)E-mail and other new communicationsElectronic Communications Privacy Act of 1986 (ECPA) extended the 1968 wiretapping laws to include electronic communications, restricts government access to e-mailCommunication (cont.)Designing Communications Systems for Interception:Communications Assistance for Law Enforcement Act of 1994 (CALEA)Telecommunications equipment must be designed to ensure government can intercept telephone callsRules and requirements written by Federal Communications Commission (FCC)Communication (cont.)Secret Intelligence Gathering:The National Security Agency (NSA)Foreign Intelligence Surveillance Act (FISA) established oversight rules for the NSASecret access to communications recordsCommunication (cont.)Encryption Policy:Government ban on export of strong encryption software in the 1990s (removed in 2000)Pretty Good Privacy (PGP)CommunicationDiscussion QuestionsWhat types of communication exist today that did not exist in 1968 when wiretapping was finally approved for law-enforcement agencies?What type of electronic communications do you use on a regular basis?If the class doesn't mention it, make sure to mention that online opt-in choices may be pre-checked and require you un-checking the box to avoid opting in.Be sure to mention the 'subject to change without notice' clause found in most privacy policies.Use the list in Fig. 2.2 (page 58) to start the conversation. Probe for what concerns the class may have about the data that is collected.Except for hackers, these are not new to computer technology. Before computers, files were stolen, receipts were stolen, information was requested under false pretenses and employees were bribed. But, with computers, the extent and impact have grown.The meaning of pen register has changed over time. It originally referred to a device that recorded the numbers called from a phone. Now it also refers to logs phone companies keep of all numbers called, including time and duration.