"Privacy is an economic problem and often is associated with an economic tradeoff."
On May 7, 2008, Douglas G. King, Assistant Professor of Systems and Computer Engineering at Carleton University, delivered a presentation entitled "Privacy and Security in a Connected World".
The TIM Lecture Series provides a forum to promote the transfer of knowledge from university research to technology company executives and entrepreneurs as well as research and development (R&D) personnel. This conference report presents the key messages and insights from the two sections discussed during Professor King's presentation.
Definitions
This lecture introduced the domains of privacy and security in the context of a global market, with an emphasis on the privacy and freedom of information legislation applicable to organizations based in Canada. It also promoted discussion around the questions "In a connected world, is privacy still an issue?" and "Is it a problem if organizations share an individual's personal information or transaction history without the knowledge of the individual?".
Several key messages emerged from the definitions introduced during the first half of the lecture. Regarding the difference between privacy and security, it was noted that:
- personal privacy is often traded off for national and personal security
- the balance between privacy and security is mediated by user profiles
- it is difficult to find an optimal balance between privacy and security since as the number of profiles increases, privacy is enhanced, while security is often enhanced by reducing the number of profiles
- corporations find it increasingly difficult to maintain their legal obligations regarding privacy and security
An important point is that security is multi-faceted in that it is much more than information technology (IT). IT security relies heavily on physical security and personnel security mechanisms, creating layers of safeguards. An emerging trend is being seen in security design. In the candy analogy for security architecture, there is a movement away from hard shell with soft center to the more clustered crunchy center approach.
Global vs. Canadian Context
The second half of the lecture discussed how Canadian business is affected by the Patriot and Sarbanes-Oxley Acts. The complexity and cost of adhering to these acts is often unworkable by small companies. Moreover, many small companies are still not compliant with Personal Information Protection and Electronic Documents Act (PIPEDA). On the flip side, a long list of unsolved privacy and security problems provides many commercialization opportunities. He then described the reasons why replacing existing Ontario health cards with smart cards failed as an example of how privacy trumps technology when people refuse to adopt. It was also noted that increased surveillance does not provide increased security.
Many questions were raised in the ensuing discussion. When asked if the tipping point from privacy to security was due to increased connectivity or an increased perception of threat in a post-911 world, Professor King responded that fear drives the process, but connectivity enables the technology and increased connectivity increases the fear of global threats. Other questions included:
Q. Is this the beginning of the end where we are subject to multinational global surveillance?
A. Global agreements won't happen, so there is no threat of a hard shell approach. However, clusters are quite likely to occur within geopolitical boundaries, or across domains with common interests such as OPEC.
Q. If we're at the tipping point, what is/was the right balance?
A. There is no aggregate balance. In theory, there is a natural oscillation among contributing factors. Indeed, there are other contributing factors to both security and privacy, so it is not the case of a closed system or zero-sum game. There is a natural linkage through feedback between security and privacy that will result in oscillations due to feedback. It is possible for both privacy and security to be increased through this natural feedback. Increasing connectivity in both IT and global perspectives is one of the strong pressures toward reducing our personal privacy and increasing our collective security.
Q. Is it a question of balance or is it possible to increase both privacy and security?
A. Most mechanisms increase privacy for both good and bad purposes, but there are examples of side effects such as the common good provided by gun amnesties, needle exchanges, and anonymous Internet access.
Q. What about OpenID?
A. This is one of many initiatives over the years which works well for existing communities but which doesn't build trust with who you will communicate. A trust relationship is required. OpenID and similar initiatives like PGP provide only the raw mechanisms for authentication and authorization, but rely on an external process to form a hierarchy or web of trust and guarantee trustworthiness.
Q. At least NSA's tactics are supported by the Patriot Act. What about the Communications Security Establishment (CSE)? Does anyone really know what the CSE is doing?
A. The CSE is working within the Canadian legal context, and is careful to make sure it abides by the rules of evidence within Canada. It is important in legal proceedings to make sure that the trail of evidence begins with information obtained through legal means.
Recommended Resources
Access to Information and Privacy