Chapter 9 Privacy

In this chapter:

• Privacy as an aspect of security; confidentiality
• Authentication effects on privacy
• Privacy and the Internet

9.0 Introduction

Privacy issues have always existed, but with computers and their ability to process, store, and transmit huge amounts of data very quickly, and how potentially easy it is for humans to access this data, it is an important concept in computer security.

Privacy is a human right, and how an individual feels about their own or others’ privacy depends on their culture, historical roots, and personal experience.

• Laws and ethics dictates what privacy we are entitled to, and how organisations should treat our personal data (Chapter 12)
• Economics determines how much privacy an organisation can afford to give (Chapter 13)

The ‘right to privacy’ depends on three factors:

• the situation
• the ownership and storage of data
• legal rights and responsibilities

Again referring to the CIA triad (Confidentiality, Integrity, and Availability), and realising how these can conflict, for example the more secure a system is, the less available it can be, privacy and security can also conflict with each other.

While reading this chapter keep this question in mind: “Assuming a right to privacy exists, what are its implications in computing and IT?” Society decides what privacy laws should exist, and cyber security experts need to incorporate these laws into our computer systems.

This chapter examines:

• the meaning of information privacy
• identification and authentication
• privacy on the internet, including email
• privacy within emerging technologies

9.1 Privacy Concepts

Aspects of Information Privacy

There are three facets to information privacy, and these correlate to the three elements of access control:

• sensitive data (object)
• affected parties (subjects)
• controlled disclosure (access rights)

Let’s take a look at each of these:

Controlled Disclosure

Privacy is controlling who knows what about you: your telephone number, address, medical conditions, what TV programmes you watch, etc. If someone asks for any of these, you can address the situation personally and decide if you wish to disclose the information. You have control of the disclosure.

When you give your data to a human or a computer system, you no longer have control. The human can pass on the information, or the computer system can share the data. It is a question of trust – do you trust the entity? Even if you do, you cannot be sure that it is being shared with others, intentionally or not.

What is privacy? Privacy is the right to control who knows certain things about you.

pp577-579

Sensitive Data

What is sensitive data? This can be subjective: some people are happy to share particular items of information, others are not. If we learn something sensitive about someone, we respect that person’s privacy by not sharing that information.

Types of sensitive data:

• Identity: name, identifying information, the ownership of private data and ability to control its disclosure
• Finances: credit rating and status, bank details, outstanding loans, payment records, tax information
• Legal: criminal records, marriage history, civil suits
• Health: medical conditions, drug use, DNA, genetic predisposition to illnesses
• Opinions, preferences, and membership: voting records, expressed opinions, membership in advocacy organizations, religion, political party, sexual preference, reading habits, web browsing, favourite pastimes, close friends
• Biometrics: physical characteristics, polygraph results, fingerprints
• Documentary evidence: surface mail, diaries, poems, correspondence, recorded thoughts
• Privileged communications: with professionals such as lawyers, accountants, doctors, counsellors, and clergy
• Academic and employment information: school records, employment ratings
• Location data: general travel plans, current location, travel patterns
• Digital footprint: email, telephone calls, spam, instant messages, tweets, and other forms of electronic interaction, social networking history

What data is considered private depends upon who you are, you may be a celebrity who enjoys getting accosted in public, a film star who hates being recognised on the street, a baker who likes being complimented on their work, or part of a group or culture where discussing sensitive topics is acceptable, for example an AA meeting, or a nudist beach.

Privacy expectations depend on the context:

• affected parties (who is involved)
• emotional preference (do they want to talk about this sensitive data)
• social norms (is it socially acceptable to talk about it)

What one person considers private is that person’s decision: There is no universal standard of what is private.

pp579-580

Affected Parties

“Subject” and “Owner” define respectively, the person or entity the data pertains to, and who holds and controls this data.

Privacy applies to individuals, but also to groups, companies, organisations, and governments. All of these have data that needs to be kept confidential, or controlled e.g.:

• Companies have products plans, key customers, profit margins, new tech.
• Organisations (charities, schools, hospitals) have students, patients, and donors.
• Governments and the media control data that could have an impact on society, such as political or military information.

Privacy is part of confidentiality: privacy can protect information, but also prevent availability, e.g. not publishing your phone number stops people from calling you, or not disclosing your shopping activity means you don’t get a discount.

Privacy and confidentiality relate in that confidentiality is a means of protecting what one person considers private.

pp579-581

Summary

Privacy is controlled disclosure by the subject

• Following disclosure, control is no longer held by the subject
• Sensitive data is subjective
• Everyone has private information
• Privacy can be an obstacle to obtaining goals

Computer-Related Privacy Problems

Before computers, we had archives and libraries where it was possible to look up data. Phone books were delivered to our door. You could find out information about an individual or organisation by using your research skills, but it could be a time-consuming process.

Computers have created a fast and easy way to access data, and with it, the risk of disclosure has become a real threat. People are concerned about their privacy: we un-list our phone numbers, use VPNs, refuse cookies, use fake email addresses. There are eight factors of privacy as described by Rezgui:

Information collection: Data are collected only with knowledge and explicit consent.

• Information usage: Data are used only for certain specified purposes.
• Information retention: Data are retained for only a set period of time.
• Information disclosure: Data are disclosed to only an authorized set of people.
• Information security: Appropriate mechanisms are used to ensure the protection of the data.
• Access control: All modes of access to all forms of collected data are controlled.
• Monitoring: Logs are maintained showing all accesses to data.
• Policy changes: Less restrictive policies are never applied after-the-fact to already obtained data.

Computer Specific Privacy Issues:

Data Collection

It is possible to collect and store huge amounts of data. Every day advances in computer technology result in mass storage becoming easier and cheaper. We have access to devices that can store:

• Gigabytes – 10⁹ or 1 billion bytes
• Terabytes – 10¹² – 1 trillion bytes
• Petabytes – 10¹⁵ – 1 quadrillion bytes
• Exabytes – 10¹⁸ – 1 quintillion bytes

Scientists state that the human brain has the storage capacity of between 1TB and 1PB.

Organisations store massive amounts of data, for example:

• Google had 17 data centers in 2014, accounting for 0.01 percent of the world’s total energy usage.
• Facebook servers process approximately 2.4 billion pieces of content and 750 terabytes of data every day, and its users access around 7 petabytes of photo storage every month.
• Amazon’s servers have more than 17 million monthly visitors who access 410 terabytes of data from its platform. “Around 30 million of Amazon users stream around 40 petabytes of videos per month.”
• Microsoft has over a billion users and over 100,000 servers.

The fact that we can store so much data in so little space, and with little expense, means we can simply hoard data: never throwing it away. This means personal data can never be destroyed, and therefore can be accessed by those with the means to do so.

Availability of massive, inexpensive storage encourages (or does not discourage) collecting and saving data.

pp581-582

Notice and Consent

All these bytes are collected from public sources or data transfers users are aware of. Other data are collected secretly, for example telephone companies collect data from phone calls, ISP track internet activity, which users are not necessarily aware of. When browsing the internet, websites will notify you of what data is collected about your visit, and ask for consent. However many of these notices are not read by users, or the purposes of data collected are obfuscated.

Notice and consent are important principles within privacy, however we do not think about what data is being collected or how it will be used. Facial recognition, for example, captured on camera in public places has become a privacy issue. Although good for public safety, it can also be used for malicious purposes, and ethical questions about human freedom are raised.

Notice of collection and consent to allow collection of data are foundations of privacy.

pp583-943

Control and Ownership of Data

Once you have allowed an organisation to collect your data, this is then stored. For how long, and who then owns that data, and how that data is distributed, depends on the law. You may regret an angry outburst and be able to get it back before it reaches the public domain, or delete it once posted. But many people may have seen and collected this data, and you then have little control in how this is then used. Search engines hold cached data, and social media can make information ‘viral’ so it is copied millions of times.

Although GDPR has a ‘right to be forgotten’ policy, or the ‘right to erasure‘ it can be difficult to enforce. A notable event is the Streisand Effect, where somebody wants something removed from the internet, but by its very desire to be hidden, becomes even more appealing. This is where the ‘security through obscurity’ practice, where no-one knows about something and therefore cannot search for it, could be argued to be a solution.

Humans are social animals and enjoy sharing information with others – again, this question of trust is a crucial factor. But other human factors such as ignorance, naivety, gullibility, and maliciousness can all affect information disclosure.

9.2 Privacy Principles and Policies

Privacy within computer and telephony systems became an issue in the 1970s, and Ware’s Fair Information Practices, a federal set of privacy principles, was introduced. These were published in 1973 and describes the rights of individuals and how data should be treated:

Fair Information Practices

• Collection limitation. Data should be obtained lawfully and fairly.
• Data quality. Data should be relevant to their purposes, accurate, complete, and up to date.
• Purpose specification. The purposes for which data will be used should be identified and the data destroyed if no longer necessary to serve that purpose.
• Use limitation. Use for purposes other than those specified is authorized only with consent of the data subject or by authority of law.
• Security safeguards. Procedures to guard against loss, corruption, destruction, or misuse of data should be established.
• Openness. It should be possible to acquire information about the collection, storage, and use of personal data systems.
• Individual participation. The data subjects normally have a right to access and to challenge data relating to them.
• Accountability. A data controller should be designated and accountable for complying with the measures to effect the principles.

Some problems foreseen by Ware, such as using universal identifiers such as social security numbers and linking data across files, can result in a loss of control over personal data.

Ware worked with Turn to address protecting data, as they were aware that large collections of data would be seen as a valuable asset by attackers. They came up with four methods of data storage protection:

• Reduce exposure by limiting the amount of data maintained, asking for only what is necessary and using random samples instead of complete populations.
• Reduce data sensitivity by interchanging data items or adding subtle errors to the data (and warning recipients that the data have been altered).
• Anonymize the data by removing or modifying identifying data items.
• Encrypt the data.

US Privacy Laws

Ware and his committee expected these principles to extend to all data collection, however, it was only within the US Government that this was adopted, resulting in the 1974 Privacy Law, a broad law that covers all data collected and maintained by the Government. Other laws were needed, however, for other organisations:

• Fair Credit Reporting Act for consumer credit
• HIPAA (Health Insurance Portability and Accountability Act) for healthcare
• GLBA (Gramm-Leach-Bliley Act) for financial service organisations
• COPPA (Children’s Online Privacy Protection Act) for children’s web access
• Federal Educational Rights and Privacy Act for student records

In addition to these laws, individual states can regulate their own privacy regulations. They can vary widely, meaning it can be difficult to stay abreast of the correct laws.

Privacy laws in the United States vary by municipality and state; few national laws exist.

pp589-591

Laws can overlap and potentially conflict with each other, and there can be gaps that are not covered at all. In this case, existing laws have to be reinterpreted, or new laws passed. With the rapid development of new technology this can cause problems.

Controls on US Government Websites

The Federal Trade Commission has jurisdiction over websites that collect sensitive data. For government websites, the FTC determined that, to comply with the Privacy Act, the sites need to address the following privacy factors:

• Notice. Data collectors must disclose their information practices before collecting personal information from consumers.
• Choice. Consumers must be given a choice as to whether and how personal information collected from them may be used.
• Access. Consumers should be able to view and contest the accuracy and completeness of data collected about them.
• Security. Data collectors must take reasonable steps to assure that information collected from consumers is accurate and secure from unauthorized use.
• Enforcement. A reliable mechanism must be in place to impose sanctions for noncompliance with these fair information practices.

Privacy Policies must also be available that advise users:

• the information that is to be collected
• the reason the information is being collected
• the intended use by the agency of the information
• the entities with whom the information will be shared
• the notice or opportunities for consent that would be provided to individuals regarding what information is collected and how that information is shared
• the way in which the information will be secured
• the rights of the individual under the Privacy Act and other laws relevant to the protection of the privacy of an individual.

Keep in mind the above only apply to data collected on governmental websites – data collected on paper are handled by a different method.

Controls on Commercial Websites

US government websites have tight rules on data collection and how it is stored and shared. Commercial websites do not have an equivalent to the e-Government Act, but users are protected by certain laws.

No Deceptive Practices

Companies that engage in deceptive practices can be prosecuted by the FTC. So web policy violations are illegal: if a company has a Data Protection Policy but do not follow it, this amounts to false advertising.

However, should a company be bought out by another, the data the second company gains from the first is not necessarily protected by the policies of the first. Data Protection is not transferred, and this is not illegal. A company can state that they share data with third parties, but there is no guarantee that these third parties will protect your data in the same way that the company states. Additionally, a website that has no statement regarding sharing data can do what it likes.

Examples of Deceptive Practices

CartManager International – the shopping cart software used rented the personal information (including name, address, telephone number, and purchase history) of nearly one million consumers it obtained through its software to third parties for marketing purposes without disclosing this information to its users.

Jet Blue – the airline supplied passenger information to a DoD contractor to study the data for potential terrorist identification.

Some sites provide a very clear privacy statement, meaning they have to abide by these rules, or no privacy statement at all, meaning they can mislead users because no promises have been made.

Helen Nissenbaum believes there is a transparency paradox with privacy statements – meaning a company can outline in detail exactly what they do with a user’s data, however the reader needs to understand this. She also feels that there is actually no ‘freedom of choice’ when it comes to choosing our privacy controls: we may not want to sign up to Facebook because it reveals too much about us, or consent to data collection whilst online shopping preventing us from collecting rewards. The freedom of choice we have depends on how much we understand of how our data is collected and used.

Non-US Privacy Principles

Different countries have different approaches to privacy:

European Privacy Directive

The European Privacy Directive provides strong protection for privacy rights, binding on governments, businesses, and other organizations.

pp595-596

This directive requires that data about individuals is:

• processed fairly and lawfully.
• collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes (unless appropriate safeguards protect privacy).
• adequate, relevant, and not excessive in relation to the purposes for which they are collected or further processed.
• accurate and, where necessary, kept up to date. Indeed, where data are found to be inaccurate or incomplete, every reasonable step must be taken to ensure that the data are erased or rectified, with respect to the purposes for which they were collected or for which they are further processed.
• kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed.

Also, individuals have the right to access, modify and request erasure of any data held about them.

Three more principles are:

• Special protection for sensitive data. There should be greater restrictions on data collection and processing that involves “sensitive data.” Under the E.U. data protection directive, information is sensitive if it involves “racial or ethnic origin, political opinions, religious beliefs, philosophical or ethical persuasion . . . [or] health or sexual life.”

• Data transfer. This principle explicitly restricts authorized users of personal information from transferring that information to third parties without the permission of the data subject.
• Independent oversight. Entities that process personal data should not only be accountable but should also be subject to independent oversight. In the case of the government, this principle requires oversight by an office or department that is separate and independent from the unit engaged in processing the data. Under the data protection directive, the independent overseer must have the authority to audit data processing systems, investigate complaints brought by individuals, and enforce sanctions for noncompliance.

Privacy in Other Countries

• China’s Personal Information Protection Law (PIPL)
• Australia’s Privacy Act 1988
• Brazil’s General Data Protection Law: Also known as Lei Geral de Proteção de Dados (LPGD). 
• India’s Information Technology Act 2000 and SPDI Rules
• Switzerland’s Federal Act on Data Protection (FADP)
• Japan’s Act on the Protection of Personal Information (APPI): This law regulates personal information and applies to foreign entities that handle personal information of Japanese data subjects. 

Conflicting Laws

The EU and US have opposing views over data sharing, as the US does not have such stringent laws as the EU. These privacy laws have affects on trade and diplomatic relations. The clash of privacy laws are addressed by ‘Safe Harbor’ practices, which can be read about here, however this was replaced by the Privacy Shield: https://en.wikipedia.org/wiki/International_Safe_Harbor_Privacy_Principles

Individual Actions to Protect Privacy

We have looked at how governments and organisations collect, store and share data. Now we look at ways individuals can impose their own privacy rules, by using the following:

Anonymity – browsing the internet in a public place without disclosing logins, device IDs, etc

Multiple Identities: Linked Or Not – using your maiden name for one purpose, and your married name for another

Pseudonymity – creating a fake email address to sign up for a newsletter, or only known by a number, for example in Swiss banks where limited employees know who account holders are.

Governments and Privacy

Governments collect and store data on citizens, residents, and visitors.

They also play a role in facilitating and regulating commerce while also overseeing personal activities such as healthcare, employment, education, and banking: this results in them being both users of private data and being responsible for its privacy.

Authentication

The government is responsible for the DVLA, which issues authenticating documents such as a Driver’s License. They do this by looking at your personal authentication documents such as your passport or birth certificate, which are both also separate organisations, the HM Passport Office and the General Register Office.

In such a huge enterprise, there is huge potential for misuse of data and privacy violations.

The two sections below, Data Access Risks and the Steps to Protect Against Privacy Loss, were both published in a report by the Technology and Privacy Advisory Committee in 2004.

Data Access Risks

The sort of risks that can occur are listed below:

• data error: ranges from transcription errors to incorrect analysis
• inaccurate linking: two or more data items are correct but are incorrectly linked by a presumed common element
• difference of form and content: precision, accuracy, format, and semantic errors
• purposely wrong: collected from a source that intentionally provides incorrect data, such as a forged identity card or a false address given to mislead
• false accusation: an incorrect or out-of-date conclusion that the government has no data to verify or reject, for example, delinquency in paying state taxes
• mission creep: data acquired for one purpose that leads to a broader use because the data will support that mission
• poorly protected: data of questionable integrity because of the way they have been managed and handled

Steps to Protect Against Privacy Loss

• Data minimization. Obtain the least data necessary for the task. For example, if the goal is to study the spread of a disease, only the condition, date, and vague location (city or county) may suffice; the name or contact information of the patient may be unnecessary.
• Data anonymization. Where possible, replace identifying information with untraceable codes (such as a record number). But make sure those codes cannot be linked to another database that reveals sensitive data.
• Auditing. Record who has accessed data and when, both to help identify responsible parties in the event of a breach and to document the extent of damage.
• Security and controlled access. Adequately protect and control access to sensitive data.
• Training. Ensure that people accessing data understand what to protect and how to do so.
• Quality. Take into account the purpose for which data were collected, how they were stored, their age, and similar factors to determine the usefulness of the data.
• Restricted usage. As distinct from controlling access, review all proposed uses of the data to determine if those uses are consistent with the purpose for which the data were collected and the manner in which they were handled (validated, stored, controlled).
• Data left in place. If possible, leave data with the original owner or collector. This step helps guard against possible misuses of the data from expanded mission just because the data are available.
• Policy. Establish a clear policy for data privacy. Discourage violation of privacy policies.

Identity Theft

9.3 Authentication and Privacy

9.4 Data Mining

9.5 Privacy on the Web

9.6 Email Security

9.7 Privacy Impacts of Emerging Technologies

9.8 Where the field is headed

9.9 Conclusion