privacy - Adriana Lukas on Diigo

10 Dec 09

Are Facebook bosses trying to trick us?

not surprised. facebook at its best

09 Dec 09

SendSocial | Send anything, anywhere without an address

an interesting service and although it's an intermediary it does offer something useful. Alas, only individual to individual. it doesn't seem to protect me against vendors who are the ones harvesting my data and potentially selling it, exposing it or abusing it via marketing...

sendsocial.com - Preview

address privacy delivery intermediary mydata

26 Nov 09

IBM staffer posts pics on Facebook, loses benefits | Technically Incorrect - CNET News

most odd. using photos from holidays judging how someone is? there is a whole industry of biographies of famous people who appear to have perfect life but underneath the appearances it's depression. so insurer now knows better than a doctor diagnosing the patient. scary

news.cnet.com/8301-17852_3-10404633-71.html - Preview

insurance health depression facebook privacy

15 Oct 09

The pocket spy: Will your smartphone rat you out? - tech - 14 October 2009 - New Scientist

not good

www.newscientist.com/...ur-smartphone-rat-you-out.html - Preview

spy security mobile data forensic surveillance privacy

23 Sep 09

Moserware: A Stick Figure Guide to the Advanced Encryption Standard (AES)

this is very very cool. worth going to the end even if you think not interested in crypto - one of the most important pieces of technology/know-how to make communication on the internet/web private and secure. seems cartoons are a good way to get people keep reading. :)

www.moserware.com/...-figure-guide-to-advanced.html - Preview

encryption cryptography AES security communications privacy cartoon

25 Aug 09

The Conservative Party | News | Speeches | Pauline Nevilles-Jones: Is information about me really mine?

fairly encouraging. though I'd still like to state out of my personal data.

www.conservatives.com/...tion_about_me_really_mine.aspx - Preview

privacy state ownership data individual government policy

In practice therefore the right to privacy cannot any longer be defined simply as the right of the individual to be let alone. We all want too much from the state for this to be a helpful guideline by itself. What technology has not however changed, it seems to me, is the fundamental point that the individual is the rightful owner of personal information and that the state is merely possessor and should behave as a responsible custodian.
Today, privacy must mean a clear statement on the part of those who have custody of personal information of their purpose in retaining it and of their commitment to its proper management.
6 more annotations...
- There should be a stated purpose for all data collection and that individuals should be aware that the information about them is being collected;
  
  Information that is collected should not be disclosed to others unless authorised by law or by the consent of the individual in question;
  
  Data records should be accurate and kept up to date;
  
  There should be mechanisms for individuals to review data that is held about them, which may include periodic reporting;
  
  Data should be deleted when it is no longer necessary for the stated purpose; and that
  
  Transferring data to locations where these data protection standards cannot be met not be allowed.
- Thus, crucially, the requirement that the individual be automatically informed when his data is processed is not met nor is the right of access to it. The individual may request access in writing but must go to the courts to get enforcement if the request is refused. I would like to know how the individual can even be aware that data is being collected if there is no obligation on the collector to inform. It follows that the ability to ensure that it is correct and up to date - another provision of the Directive, is substantially curtailed by the state of ignorance in which the owner of the information is kept and the obstacles put in the way of access to it. The state, it seems to me, is behaving as if it owned our information- not you and me.
- The range of bodies allowed to access data or to undertake surveillance has been extended over time and now includes all 474 local councils in England, every NHS trust and fire service, 139 prisons, the Environment Agency and the Royal Mail. Among others. Which is how we find it being used in relation to dustbins, dog fouling, traffic offences and so on. Yet, under the Data Protection Act, you and I, owners of the information, have our right of access to it restricted.
- When up and running it is proposed that a central national data base will contain 50 (yes, 50) separate items of information on all individuals. The government has sought to give assurances about privacy protection, safeguards and limits while opening the door wide to the Home Secretary to extend by simple Order the scope and remit of the ID cards scheme. Mission creep again. The Information Commissioner has expressed alarm that the ID cards are 'beginning to represent a very significant sea change in the relationship between the state and every individual in this country.'
- Even without the UK's lamentable record in getting big IT projects up and running efficiently and securely, a view of this kind, which is widely shared in the IT community, should give the government pause.
- the individual is the rightful owner of personal information and the state is merely possessor and should behave as a responsible custodian. We need to roll back the advance of Big Brother and restore this fundamental right of our citizens. Restoring privacy today must mean a clear statement on the part of those who have custody of personal information of their purpose in retaining it and of their commitment to its proper management.

Information Security: Why Cybercriminals Are Smiling - Knowledge@Wharton

knowledge.wharton.upenn.edu/article.cfm - Preview

information security privacy identity cybercrime online financial

otherwise sophisticated business entities regularly fail to secure key information assets and that many companies are struggling with incorporating information security practices into their operations.
there seems to be a process-based failure under way. It's in companies' interests, internally and externally, to secure their information assets. Internally, when a company experiences a data breach, it is potentially compromising trade-secret protection on key intangible assets. Externally, it is going to get bad publicity and trust will diminish among customers, business partners and even its own employees. So securing information assets is a win/win.
18 more annotations...
- Information security [has been] generally viewed as the province of IT departments, and at one point that may have made sense. But at this point, IT security needs to have a process approach, [coming] from the top layers of a company and a culture of security [should be] filtered through the company's lower layers.
  - no shit sherlock. there is no such thing as 'security', there is data integrity, privacy and levels of exposure tolerance. Security is just an umbrella name for all these, and separating it from the core business means losing it. - on 2009-08-24
  Add Sticky Note
- When a company possesses sensitive information, each subsequent sharing of that information creates another dependency, another point of risk. A compromise anywhere in the chain of possession ... is the equivalent of a compromise along every point. So the banks in the TJX case were not pleased, the customers who had data compromised were not pleased and TJX had regulatory action [launched] against it because of that breach.
  - good point about the sharing of information creating a dependency, a point of risk. which in other words is 'weakest link' type of argument. - on 2009-08-24
  Add Sticky Note
- Twenty years ago, there weren't databases full of such rich consumer information as we have today. The ease of sharing information through the Internet generates targets for information criminals. At this point, the identity-theft economy is on par with or surpassing the [illegal] drug economy.
- In many countries where cyber criminals live, the acts that they're engaging in aren't illegal, and their governments are not going to extradite these individuals.... On top of that is the lack of a reciprocal regime for recognizing judgments in other countries, which predates the Internet.... We just never resolved the convention on jurisdiction and judgments to allow us to have our judgments in our courts efficiently enforced in other countries.
- Matwyshyn: Very much so. First, as you mentioned ... individuals voluntarily disclose a significant amount of information. But if you ask them, they'll say they're very concerned about their privacy. When [such] contradictory behavior [is combined] with difficulty in using privacy settings on websites, [people] sometimes don't realize how much information is readily available to the public.
- But there is a bit of a contradiction between users' behavior and users' stated preferences on privacy.
- A corollary concern for information security, as a result of social networks such as Facebook, is that platforms on those networks enable developers to generate interesting, fun, new applications for users to interact. There's really no information security vetting of those applications by the central platform provider, Facebook in this case. The applications request information on a users' entire portfolio of friends and then all of those people have data that is possessed by the application provider. What the application provider is using that data for and the extent of secure storage that [it] uses are unknown [to users] and Facebook or another social networking site is not going to [publicize] it. It's not in their interest to do so because they'd rather not be associated with that relationship. They just want to provide the platform. But most users don't realize or don't analyze the extent of information sharing that happens through, for example, the applications....
- So unlike [with] television, where you're reacting passively to stereotypes and roles and so forth, the Internet is a very active medium and it will likely have, if we get to research this more, the same ... [if perhaps not more] impact on children ... than parents themselves.
- the act requires verifiable parental consent for any data collection and storage from a child under the age of 13. As Diana mentioned, many children, particularly at age 13, are far more technologically adept than their parents. And what is verifiable parental consent? Originally [legislators] wanted faxed transmissions to demonstrate a parent's approval. But they created an email exception. Well, as any smart 13 year old will tell you, you can forge your parent's email about as easily as you can forge a note that you were just at the doctors to get out of study hall. Consequently the ability to verify the identity of the person giving consent is something that has been circumvented by children who [are determined] to get access to a Web service or website.
- We've distributed the information to a great extent, yet we still expect it to have the same level of confidentiality that [it once had]. [Just the] knowledge of a credit card number and its expiration date allows a criminal [for all intents and purposes to] print money at the expense of that [credit card holder]. We are essentially doing something that's not entirely consistent with the nature of the information.
- [All] security breaches are ultimately caused by a failure in a process or implementation of a security policy. But the damage [from financial information breaches] does have a unique, unusual root cause [in] that financial information cannot at once both be distributed to thousands of entities and be so valuable that mere knowledge or access to it is enough to cause monetary losses. We can't have it both ways.
  
  It's not so much that the breaches are surprising. It's that when a breach occurs, the fact that there is no damage control and containment are impossible is a function of how we ... use financial information.
- Knowledge@Wharton: So financial information is unique in the sense that it is both confidential and widely disseminated?
  
  Paya: Exactly, that's the paradox.
- Best practice is to make sure that your secrets have short shelf lives and can be frequently renewed. That's not something generally followed with consumer data. Credit cards have multi-year expiration periods and Social Security numbers are indefinite [since] you have one for life.
- The lesson from the offline world is ... acknowledging the fact that the longer a secret exists, the greater the probability of a breach of confidentiality. So try to limit that window of time. That's a lesson that hasn't quite carried over to the consumer financial data, because much of [it] has a very long shelf life.
- The biggest mistake ... is not having a clear handle on where the information lives. The design of large systems calls for a lot of redundancy. Data is copied, duplicated, backed up, sometimes sent to different partners, data warehouses, shipped off site in case some catastrophic event destroys your data center. So data has a tendency to replicate itself. And one of the big challenges is when companies lose track of where the information is. It's very hard to point to a particular computer or a particular rack and say, "This is where all the credit cards live." .... The problem is that the more spread out they are, the more points of failure you have to worry about.... The first challenge [arises by] not having an inventory of what you're collecting, even if you know where you collect it, not knowing where exactly you put it.
- PricewaterhouseCoopers, which did a survey of chief information officers, chief security officers, high-ranking ... decision makers.... One of the startling [findings] is that a large number, approximately 30%, of the respondents could not provide information about where all of their information assets were stored and this is self-reported.
- We're talking about at the state level, resources will be coordinated to protect families and where people work, now that the genie is out of the bottle.
  - oh dear, please, let not the state be involved! - on 2009-08-25
  Add Sticky Note
- At the tactical level, my advice in terms of risk management is doing more with less. The less data you have, the less your risk is. If you don't need the data, don't collect it. If you don't need it anymore, erase it, delete it, shred it. Make sure that fewer systems have access to the data, and fewer people have access to the data. The more you can design a system so that you can do more with the same amount of data, the better you'll manage your risks.

Ad Network Fetchback Blunts Concerns About Web Privacy - Advertising Age - Digital

people may not react to the cause of privacy abuse (i.e. data being collected) but they certainly react to the result (i.e. identity theft, creepiness of behaviour targetting or 'personalised' ads). transparency about who collects data and why will go some way in addressing this gap

adage.com/...article - Preview

advertising online privacy

17 Aug 09

Data Fusion: The Ups and Downs of All-Encompassing Digital Profiles: Scientific American

good article about data-fusion, sound conclusion.

www.scientificamerican.com/article.cfm - Preview

privacy database government data-fusion digital terrorism patterns analyticis

they argue that the bad guys would have an easier time evading fusion programs if they knew how they work. But enough information is publicly available to indicate that data fusion poses more than just ethical and legal problems; it also raises technical issues.
Much of the information in databases was originally collected for purely statistical purposes and may not be accurate enough to make automated judgments with potentially punitive outcomes.
2 more annotations...
- These systems scanned millions of records and flagged thousands of potential “hits.” But most turned out to be false positives. For example, one program for finding welfare cheats matched the employment records of the Department of Health and Human Services against the welfare rolls of the counties surrounding Washington, D.C. It generated roughly 1,000 hits, but further investigation showed that three quarters of the people identified were innocent. The benefits did not justify the costs of collecting data, training personnel and chasing down the false positives.
  - my point precisely! - on 2009-08-17
  Add Sticky Note
- ut the remaining third were a jackpot of personal information: e-mail messages, memoranda, financial records. One drive had previously been part of an automatic teller machine and recorded thousands of credit-card numbers. Another had been used by a supermarket to submit credit-card payments to its bank. Neither drive had been properly wiped before being resold on the open market.
  - blimey! - on 2009-08-17
  Add Sticky Note

24 Jul 09

15 Top Privacy Policies, Analyzed - ReadWriteEnterprise

www.readwriteweb.com/...op-privacy-policies-analyz.php - Preview

marketRIOT readwriteweb policy privacy customer data webservices

Regardless of any similarities or differences within policies, one thing is absolutely clear: tons of data is being collected about you, though some of it may already be incidental enough to be private (such as the popularity of search terms).
Yes, that's right. In some policies, there is data collected through sites and services but not covered within the legal terms of any binding privacy policy. An example of this is the way third party advertisers will handle your data. In other words, any data collected by outside advertisers on a particular site isn't protected.
1 more annotations...
- It may not be much of a surprise from a business perspective, since giving up even anonymous data would be a huge loss to companies built around manipulating and presenting information. But crystal clear understandings of just how your data will be made anonymous is key.

23 Jul 09

Lesson From Tor Hack: Anonymity and Privacy Aren't the Same

excellent exposition of Tor, what it does and what it doesn't and why anonymity and encryption go hand in hand.

www.schneier.com/essay-182.html - Preview

anonymity tor security internet politics privacy hackers

Tor is a free tool that allows people to use the internet anonymously. Basically, by joining Tor you join a network of computers around the world that pass internet traffic randomly amongst each other before sending it out to wherever it is going. Imagine a tight huddle of people passing letters around. Once in a while a letter leaves the huddle, sent off to some destination. If you can't see what's going on inside the huddle, you can't tell who sent what letter based on watching letters leave the huddle.
The communications between Tor nodes are encrypted in a layered protocol -- hence the onion analogy -- but the traffic that leaves the Tor network is in the clear. It has to be.
2 more annotations...
- Presumably, most of these organizations are using Tor to hide their network traffic from their host countries' spies. But because anyone can join the Tor network, Tor users necessarily pass their traffic to organizations they might not trust: various intelligence agencies, hacker groups, criminal organizations and so on.
- One of the tools developed by Dark Web is a technique called Writeprint, which automatically extracts thousands of multilingual, structural, and semantic features to determine who is creating "anonymous" content online. Writeprint can look at a posting on an online bulletin board, for example, and compare it with writings found elsewhere on the Internet. By analyzing these certain features, it can determine with more than 95 percent accuracy if the author has produced other content in the past.

19 Jul 09

apophenia: Twitter is for friends; Facebook is everybody

makes sense, people will want more privacy and facebook doesn't provide that despite their complex privacy settings.

www.zephoria.org/...twitter_is_for.html - Preview

twitter trends facebook privacy teenagers

16 Jun 09

autonomo.us · on privacy, quality, and autonomy

excellent point, worthwhile argument. however, I think privacy is a behaviour and a policy at the level of the individual and until we are in charge of our data and its integrity, privacy will be hard to protect and implement

autonomo.us/...n-privacy-quality-and-autonomy - Preview

privacy software open autonomy opensource

Privacy is (to me) remarkably similar to software quality. Defining privacy is hard- like pornography, we know it when we see it, but usually can’t explain it. Valuing privacy properly is also hard- can you articulate when you are willing to compromise it, and for what reasons? And valuing and defining privacy consistently is nearly impossible

The Hidden Cost of Privacy - Forbes.com

the problem is that privacy is an externality for those who 'manage' it for us. until we are in charge of our own data, privacy will remain a problem.

www.forbes.com/...ch-hidden-cost-of-privacy.html - Preview

Privacy externality online data intermediary

05 Jun 09

Targeted online advertising casts the shadow of privacy concerns

www.mad.co.uk/...hadow-of-privacy-concerns.html - Preview

advertising privacy online behaviour data

04 Jun 09

Google Is Top Tracker of Surfers in Study - Bits Blog - NYTimes.com

well, at least this is non-news. anotehr of the google BAAAD articles. Not saying there isn't reason for concern sometimes, but this ain't it.

bits.blogs.nytimes.com/...op-tracker-of-surfers-in-study - Preview

privacy google stupid data online tracking

17 May 09

Digital Domain - Just Browsing? A Web Store May Follow You Out the Door - NYTimes.com

www.nytimes.com/...17digi.html - Preview

shopping online marketing privacy data metrics

Abandonment Tracker Pro addresses a longstanding fear of lost business represented by the supposedly grave problem of “shopping cart abandonment.” “Up to 70 percent of shopping carts, registrations, quotes and online forms are abandoned before they’re complete,”
here were many reasons that customers might not complete a purchase. And the rate of cart abandonment rose substantially from 2005 to 2008, he said, a reflection of intensified comparative shopping that visitors carry on with many sites simultaneously.
- i often go as far as checkout in order to find information that's not easily available i.e. delivery cost and timing etc. so the statistic about shopping cart abandonment is not only about lack of marketing or pull but simply about not having the right information displayed or accessible. another example of trouble with interpreting metrics - on 2009-05-17
Add Sticky Note

16 May 09

REI ATM / Loomis / Seattle Police Incident: The Cliff Notes « I Am Shane Becker

amazing, gruesome and hopefully not over. We live in interesting times when incidents like these can get public attention beyond the imagination of those abusing power they have.

iamshane.com/...olice-incident-the-cliff-notes - Preview

police privacy photo ATM individual attention public

09 May 09

Bruce Schneier and Marcus Ranum Face-Off: Should We Have an Expectation of Online Privacy? - Information Security Magazine

Marcus: privacy offline has always been exclusive why should it be different online
Bruce: lack of control over your data is a legal problem

searchsecurity.techtarget.com/...96894,sid14_gci1354832,00.html - Preview

privacy data government online ownership control

I'm pretty sure that, if I joined the tinfoil hat brigade, I'd be able to quickly assemble a communications system that was so secure it'd be practically unusable.
People who are using public data networks to do naughty, terroristic, or counter-revolutionary things have simply got to protect themselves. To a government or business, privacy looks indistinguishable from sedition or crime.

Privacy has always been something special, enjoyed by those who are wealthy and powerful enough to afford guards, walls and lawmakers. It speaks well of techno-geek society that we tried--and tried hard--to democratize the data networks and protect their users, but the end-game was inevitable. From one side, you're either a member of the tinfoil hat brigade or an activist Cypherpunk. Seen from the other side, you're a pre-selected terrorism suspect or a blob of marketing data waiting to be analyzed and sold.
3 more annotations...
- Which are you?
  - definitely the former! privacy may be exclusive or hard to come by but well worth pursuing - on 2009-05-09
  Add Sticky Note
- This loss of control over our data has other effects, too. Our protections against police abuse have been severely watered down. The courts have ruled that the police can search your data without a warrant, as long as others hold that data. If the police want to read the e-mail on your computer, they need a warrant; but they don't need one to read it from the backup tapes at your ISP.
- We should be able to control our own data, regardless of where it is stored. We should be able to make decisions about the security and privacy of that data, and have legal recourse should companies fail to honor those decisions.

07 May 09

10 Privacy Settings Every Facebook User Should Know

excellent howto about facebook 'privacy'. amazing how complicated the settings can get, innit?

www.allfacebook.com/...facebook-privacy - Preview

facebook privacy security socialmedia Settings

Adriana Lukas's Library tagged privacy → View Popular

Are Facebook bosses trying to trick us?

SendSocial | Send anything, anywhere without an address

IBM staffer posts pics on Facebook, loses benefits | Technically Incorrect - CNET News

The pocket spy: Will your smartphone rat you out? - tech - 14 October 2009 - New Scientist

Moserware: A Stick Figure Guide to the Advanced Encryption Standard (AES)

The Conservative Party | News | Speeches | Pauline Nevilles-Jones: Is information about me really mine?

Information Security: Why Cybercriminals Are Smiling - Knowledge@Wharton

Ad Network Fetchback Blunts Concerns About Web Privacy - Advertising Age - Digital

Data Fusion: The Ups and Downs of All-Encompassing Digital Profiles: Scientific American

15 Top Privacy Policies, Analyzed - ReadWriteEnterprise

Lesson From Tor Hack: Anonymity and Privacy Aren't the Same

apophenia: Twitter is for friends; Facebook is everybody

autonomo.us · on privacy, quality, and autonomy

The Hidden Cost of Privacy - Forbes.com

Targeted online advertising casts the shadow of privacy concerns

Google Is Top Tracker of Surfers in Study - Bits Blog - NYTimes.com

Digital Domain - Just Browsing? A Web Store May Follow You Out the Door - NYTimes.com

REI ATM / Loomis / Seattle Police Incident: The Cliff Notes « I Am Shane Becker

Bruce Schneier and Marcus Ranum Face-Off: Should We Have an Expectation of Online Privacy? - Information Security Magazine

10 Privacy Settings Every Facebook User Should Know

Selected Tags

Related Tags

Sponsored Links

Top Contributors

Groups interested in privacy

Ad4dcss/Digital Citizenship

IB ITGS

WPPS NEWS

Internet Privacy Guide

Information Literacy