A few weeks ago I participated in a Westminster eForum Seminar (PDF) on Behavioural Targeting, Social Networking and the Challenges of Online Privacy.

I’m honour bound not to talk about the content of the meeting other than to note that I found the Phorm folk to be even more comprehensively slimy than I imagined, and I came up with a idea to suggest that Phorm should be immediately nationalised, since I felt the data they collect/monetise would then be in the hands of an entity marginally more trusted than they.

I found myself speaking in a 5 minute slot shortly after Jonathan Bamford – Assistant Commissioner, Director of Data Protection Development, Information Commissioner’s Office – had had 30 minutes to explain the ICO’s take on the future of data protection in the blog age. It was interesting to note that in some areas we overlapped precisely, and in others we were poles apart; I also seemed to strike a chord for the day in referring to the online environment as “Darwinian” – in the very real sense that folk are still learning how behave in ways that do not result in their being “eaten”.

I suspect the attendees may have thought it was Government or Regulation under trial, rather than the general public – but you can’t have everything; perhaps I should have analogised it to people learning that it’s unwise to stand on railway tracks, in the 1800s.

Anyway – prefaced by the theme for the day – here is what I said:

What challenges do Web 2.0 environments, Social Networking sites and cloud computing, pose to those keeping data safe online?
What users, and data, is [sic] most at risk of theft, and unauthorised use?
How can users be empowered to protect themselves? How can the industry protect user’s data from unauthorised use?

(insert thanks)

In 2005, the socialite Paris Hilton’s cellphone / web account was hacked because she chose “what is your favorite pet’s name?” as a “password recovery question”, regardless that her chihuahua’s details were plastered all over the tabloid press

In 2008, Jeremy Clarkson published his bank details in his newspaper column, essentially as a “dare” to the world to misuse them and in the expectation that they could not; persons unknown used the information to credit 500 pounds to a diabetes charity

In 2007, Boris Johnson’s personal website vanished temporarily from the web because of a lawsuit between a russian oligarch and another person whose website was co-located on the same machine.

To me the “security challenges” posed by these three examples are not quite as they seem to many people

Should someone in possession of Jeremy Clarkson’s bank details been able to withdraw 500 pounds? No. That it is possible demonstrates a failure of the mechanisms which assume that such information is secret.

Should someone have been able to steal Paris Hilton’s mobile phone pictures by knowing her dog’s name? I don’t think so, or rather I don’t believe that a pet’s name should ever have been offered as an authentication mechanism. Again, such information is no longer secret.

I see the web today as a Darwinian environment where business processes government regulation, and human expectation are adapting to a world where information is irrepressibly available, and I believe the problem is that many of our processes are founded upon assumptions of (non-) communication that date from the 1900s and earlier. Those assumptions in this new environment are now deeply in tension with human nature given the vastly improved ability to communicate, that is provided by the ‘net.

There simply are very few “lightweight” secrets any more. If you can envision some criminal process which hinges upon knowing someone’s “mother’s maiden name”, then go hang out on a geneaology website and you’ll rapidly find a dozen targets.

Yes! Privacy is good, privacy is desirable, and privacy needs to be protected. Especially: privacy should never be ripped away from the individual by government or business for tawdry reasons such as advertising.

But another aspect of privacy is also elective and at the whim of those same individuals who are gradually learning that: “what is said on the Internet, stays on the Internet forever“.

There is considerable risk to data that goes beyond your physical control:

Secondhand hard-disks purchased on Ebay, lost laptops and memory sticks, online services which vanish for physical or legal reasons, in the worst case wiping you off the net and taking the all your data with them whilst and you have no backup… the risks of pushing your data beyond your physical control is not new — 25 years ago it was still quite common to ship tapes of data offsite for processing, a predecessor of what we now call “cloud computing”.

The difference today is in the scale and speed with which data can be moved and the variety of curious places and (as Boris discovered) the strange bedfellows that your data may share.

To impose regulation upon social networking sites would be to try legislate that people: “keep secrets”, “understand the consequences of what they are doing”, and not be “foolish” when posting at a website that is out of their control. That would be fruitless – and such regulation, parochial. And I don’t believe that the “industry” will bring about a solution to these challenges because quite a lot of industry is predicated upon being an intermediary.

In conclusion: All of this has nothing to do with the technology of security.

Instead it is:

• About raising individual awareness,
• About expunging business and government processes that make assumptions about “privacy of data” which are no longer valid because they confuse the “private” with the “personal”
• And it’s about government not inhibiting the adoption of technologies which arise not from industry, but from the internet _community_, and which enhance the privacy of the individual at the cost to government of also enhancing the privacy of the citizen