Utmost attention will be paid to secure personal privacy

Densely typed in, nearly 2,000 words over four pages, the policy statement of The University of Washington’s Electronic Information Privacy Policy on Personally Identifiable Information lays out in clear terms what PII is at the University and who can provide exceptions to the rules. The document requires familiarity with technical information and communication systems and at least some knowledge of the University -- how it is structured and administered.

The document regulates the ideas behind the University’s goals in relationship to Personally Identifiable Information (PII), to be “in full compliance with all related federal and state statutes and regulations, and demonstrate a rigorous commitment to core values of maximizing trust, integrity, and respect for privacy.” It is a statement of clear commitment which using the methods outlined in this case study can be accomplished through a collaborative, enterprise wide community commitment to the ideal, so that the insurance costs do not escalate beyond the UW’s ability to pay, and to maintain a sense of respect, responsibility, and dedication to humanity.

There can be no doubt that the tone of this document is intended to protect people, enumerating who “they” are in some detail. The document outlines the exceptions for control of information, by detailing which executives may take responsibility for PII.

In contrast to the stated commitment and ideal, the reality is more difficult to practice because “60% to 80% of consumers' PCs are infected with spyware”, as Kirk Bailey, UW’s Chief Information Security Officer told MSIM2008 interviewers, “But much, if not all of any individual’s Personally Identifiable Information (PII) is already available through other online sources. In fact if an organization looses control of someone’s PII, it would be very difficult to prove who the source really was.”

The truth is most if not all PII is already publicly available. This was demonstrated by Kirk Bailey’s study reported in the New York Times and Seattle Post Intelligencer, in which his valid birth certificate was obtained with little difficulty, and leveraged to gain control of bank accounts. By cross referencing a number of sources, such as databases, and search behaviors other information may be inferred.

There are several motivating factors underlying the reasons to protect Personally Identifiable Information, but the primaries are reputation and risk management. Reputation and cost are inextricably linked, because it is the law to remediate each case as applied to individual people.

Organizations and individuals have been successfully sued for millions of dollars in privacy claims. Common practice is to settle out of court in class action and group lawsuits, to avoid further degradation to the organization, reputation, tarnishing of their brand, and disturbing influences on the business in terms of compliance and audits. The expense really never ends; the costs are ongoing in the form of insurance.

The definition and legal application of privacy standards such as HIPAA are being tested in practice, due to recent enactment. Company executives have lost their jobs and organizations their reputations because they could not show they complied with best practices in relationship to securing PII data on systems, or worse yet, intentionally misused their customers PII by selling it to a third party without permission.

Loosing control of PII is expensive to remediate. By statute in Washington State, when a persons PII has been compromised they must be informed. At the University of Washington it is estimated last year it cost $187.00 per personal contact. The University’s reputation, as well as its brand is at stake, due to the lost of PII. And it is no fun for the people who have to make those calls. In order to assume responsibility and restore some faith that the organization’s intentions are good the senior staff speak with truly irate individuals.

At the current time security breaches and PII loss appears inevitable; as the University’s CISO Kirk Bailey takes a four fold method to reduce risk, and obtains insurance against such losses. Enterprise-wide, voluntary, even eager, compliance with regulations and statues is a best practice in terms of lost prevention. This is a major factor in the methods he applies.

Regarding how companies abuse privacy Kirk Bailey detailed in his Hackers PBS interview, he said unscrupulous companies do this with “The placement of "cookies" or the requesting of information when you log onto the site. Forms that are filled out and then that information is rolled up into databases, or tracking your activities on their Web sites to create a profile of what your interests might be, then using those conjectures and that real data and wrapping it within a profile and selling it that information. We know those things take place. I resent those kinds of things. I find that unacceptable. It's not necessary. . . .”

-Kirk Bailey, PBS interview, 2001 http://www.pbs.org/wgbh/pages/frontline/shows/hackers/interviews/bailey.html


Shukovsky, P. “’Good Guys’ show just how easy it is to steal ID” Seattle Post Intelligencer. March 5, 2005 (retrieved from the web March 19, 2005). http://seattlepi.nwsource.com/local/214663_googlehack05.html

What is Privacy? It's Relative to Your Intention and Motivating Factors

Biological | Privacy
Safety and Security
One point of view may be called the biological view of privacy, it concerns safety, and security, and people generally consider privacy from this personal point of view. Even animals recognize the need for biological privacy. This may be tied to reproduction, as well as physical security.
Earning A Living
A view of medical data may also fit into this category because such information may be personally detrimental to individuals. For example if it is known that a person has a disease they may find it difficult to find or keep a job based on prejudices.

Motivational and Relational | Privacy
Unwanted Sales Attempts
Another is motivation and relational, so for example when companies document privacy statements, they are communicating to customers and staff their policies which protect from unwanted sales attempts, through such things as opt-in or out ‘contact me’ selections when providing their PII. Also from the business point of view, selling collections of PII through as databases then used for sales attempts is another kind of opt-in or out of choice businesses give to customers, and require their employees to respect their customers choices.
Stealing & Identity Theft | Privacy
In this view of PII, information such as credit card numbers are the target that thieves are most interested in. Why this is most important is because it can be reasoned that far more money is made in online transactions through illegitimate means, through evil doers conning the unwary, then by legal ecommerce according to Kirk Bailey.

Wanton Destruction | Information Private or Public
The idea here is to access or destroy information for egoistic reasons, such as fun, the thrill of overcoming security and so forth. Whether or not it is PII may unimportant to these culprits but exposing PII always is to those individuals who suffer the lost of their PII.

______

Although the United States constitution does not call out a “Right to Privacy” it can be inferred in the broadest sense by the people’s Declaration of Independence and their

“unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness”

Furthermore the US Constitution establishes the reasons the government will serve the people to

“establish justice, insure domestic tranquility, provide for the common defense, promote the general welfare, and secure the blessings of liberty to ourselves and our posterity”

Among these “Life, Liberty and the pursuit of Happiness”, “insure domestic tranquility, provide common defense, promote the general welfare, and secure the blessings of liberty” are drawn upon to provide the basis for laws regarding privacy in the United States.

Hidden Services Tor, Onion Routing

The Onion Routing program is made up of projects which -
1. Research
2. Analyze
3. Design
4. Build
anonymous communications systems.

See http://www.onion-router.net/
The focus is on practical systems for low-latency Internet-based connections that
1. resist traffic analysis,
2. eavesdropping,
3. other attacks both by outsiders (e.g. Internet routers),
4. insiders (Onion Routing servers themselves).

"Onion Routing prevents the transport medium from knowing who is communicating with whom -- the network knows only that communication is taking place. In addition, the content of the communication is hidden from eavesdroppers up to the point where the traffic leaves the OR network."

Tor: Generation 2 Onion Routing
Visual representation of running Tor Servers

Web proxy Privoxy

RFID leaks Privacy Information through DNS, Alice Cryptology

Highly recommended - Karsten Nohl (PhD candidate at the University of Virginia, Computer Science), RFID Privacy, Old Threats and New Attacks. Hope 2006. Alice cryptography is the example here, and every minute is valuable - how RFID are related to databases, and how to detect location information through cashes in Domain Server requests. Scalability to reality in terms of billions of tags, and the tree of secrets.

Faraday cages are mentioned -
"A Faraday cage or Faraday shield is an enclosure formed by conducting material, or by a mesh of such material. Such an enclosure blocks out external static electrical fields.

RFID passport and credit card shielding sleeves are small, portable Faraday cages."
http://en.wikipedia.org/wiki/Faraday_cage

As is ONS -
Object Naming Service (ONS)
"mechanism that leverages Domain Name System (DNS) to discover information about a product and related services from the Electronic Product Code (EPC). It is a component of the EPCglobal Network.

It is published by the EPCglobal board. Version 1.0 of the specification was ratified by the board in October, 2005."
http://en.wikipedia.org/wiki/Object_Naming_Service

Definitions from Wikipedia.


Karsten Nohl, PhD candidate at the University of Virginia, Computer Science

International Privacy Insurance Club

Not sure where this video was filmed - poster located in Germany. Milan's Banca Intesa signs appear in this video. These guerrilla cats are taking the matter of privacy into their own hands, with interesting tools of their trade, using a map and acrobatics to systematically detect and disable video surveillance cameras.

No intention to support this kind of activity should be implied through this posting.

Invasion of Privacy for a Disabled Person in Canada

Mentioned in this news presentation is a unit of the local Canadian govt has a "Privacy Commissioner". Stephen Pate wisely wants the old inappropriately collected data removed from government computers but that is probably more difficult than can be imagined.

One suggestion:
"What floor are we on now?" as a question to gain support for a disability could be answered - "We are not on a floor, you are a person writing an inappropriate question sometime in the past."

Privacy & Law vs Google Govt Fishing Expeditions

Globalization101.org interviewed David Vise, Author of "The Google Story" on this topic: "Which do you think is the bigger cost, individual privacy or the chance to catch a criminal?"

They actually disabled embedded content so you actually have to click the link - sorry - http://www.youtube.com/watch?v=whanGlvZ5lc to watch their brief video.

Photographer's Ethics in a Free Society, Why is this Case Important?

Here is a case of an artist, a photographer named Philip-Lorca diCorcia, using someones image without permission, and profiting by that, even though the subject of the photo asked the photographer to cease using the photo because it runs counter to his religious tradition. See case information: http://www.bigredandshiny.com/cgi-bin/frameset.pl?section=news&issue=issue40&article=STREET_PHOTOGRAPHY_AND_25151059 (Pardon the sticky site!)

Is this really what we meant by a free society, to not respect each other's wants and needs? How is the photographer informed by the law but not by belief? Where do people get the idea they have a right to take another person's image?

From a Boston based art/music community site:
http://www.bigredandshiny.com/cgi-bin/frameset.pl?issue=issue40

"New York State Supreme Court dismissed a case contesting the ethics of street photography and whether it violates the rights of those individuals photographed"

[the person photographed without his permission and against his will] "Nussenzweig, an Orthodox Jew, claimed that the photographer using his image violated his First Amendment right to practice his religion on the grounds that his image constituted an engraven image that was exhibited and consumed commercially. However, Justice Judith J. Gische said that Nussenzweig's claim to privacy was not valid, finding that diCorcia created the photograph for artistic purposes."

He may have done it for artistic purposes but he certainly did it for profit: "The photographer said multiple prints of Nussenzweig's picture sold for about $20,000 each. The picture also was published in "Heads," a book that sold several thousand copies, diCorcia said. (boingboing.net/2005_07_01_archive.html)

Law.com claimed that the photographer sold 10 copies of the image for 20K-30K each - no starving artist there. "As commerce, the picture would be subject to the restrictions set forth in New York's right-to-privacy laws; as art, it would not." (http://www.law.com/jsp/law/sfb/lawArticleSFB.jsp?id=1139565912319 )

In this case the photographer may have justified this as an act of free expression, but what if it was a photo of him? or his parents? What if he was doing something embarrassing? Does this justify the artist/photographer and any American's right to make money off another person's image without their permission? How far could this be extended? Could Nike or Levis or McDonalds run images of people on TV, say making fun of them without their permission?

While dismissing the case, Gische, the judge did say this: "Clearly, plaintiff finds the use of the photograph bearing his likeness deeply and spiritually offensive," she concluded. "The sincerity of his beliefs is not questioned by defendants or this court. While sensitive to plaintiff's distress, it is not redressable in the courts of civil law. In this regard, the courts have uniformly upheld Constitutional First Amendment protections, even in the face of a deeply offensive use of someone's likeness." ( http://www.law.com/jsp/law/sfb/lawArticleSFB.jsp?id=1139565912319 )

What if Nussenzweig had just said - I don't want others to make a profit off my image. One, stop producing images of me, or two pay me whatever you make, because I did not give you permission. But he didn't - he just said 'no'. Isn't that good enough?

Here's Nussenzweig's attorney quoted on the subject:
"We claim that to take someone's picture without their consent is bad enough," said Jay Goldberg, Nussenzweig's lawyer. "But to then hang the picture in galleries, put it in books and sell it around the city without telling the person or obtaining permission is unfair and outrageous."

Wouldn't it have been more ethical for diCorcia to just respect Nussenzweig's request? What if diCorcia decided to sell the photograph of Nussenzweig for an advertisment such as a billboard or use in a film? Why does it being art or in a public place mean that a person's image is not their own? How more deeply offensive can it be and still be justified as art or good practice -- can it still be art worth all this money and hold no concern for the living person?

Are there other examples of this, where something of yours is not yours because it is art or in a public in a free society? What about medical footage taken in a state hospital of a woman having a baby? Could that be run on television without her permission? Or does she have a reasonable expectation of privacy?

In this case I asked Jeff Stein - a student in the University of Washington's Informatic program, in the Info344 class, and he told me that he feels our culture prefers to honor the needs and values of commerce over the needs of personal privacy. He said this is especially true in public spaces.

Personally if he were asked not to use a picture of a person he had photographed he would honor the request. I would too. What is artistic about not honoring people. Isn't the lack of regard for their privacy doing violence to them by ignoring their request?

How is it that people will resort to the law in such an instance and not use their own belief system to inform them of what is respectful or reasonable?

As the BigRedandShiny.com article concludes:
"From this, therefore, we can conclude that artistic rights under the First Amendment trump freedom of religion, also protected under the First Amendment - at least when considering privacy laws within the civil courts of New York. "

What I find a sad twist of fact is when querying 'diCorcia', the photographer's name, in a local warm and friendly public search engine you will receive an image of Nussenzweig, probably many of them, as I did.

Why is this case important? It's important because our sense of ethical judgment tells us it isn't right, while the law says it isn't wrong.

Freedom of speech is closely tied to freedom of thought which trumps freedom of religion.