Data Protection in Europe: Discourse at CPDP

Feb 12 2014

Recently I found myself at the Computers Privacy and Data Protection (CPDP) conference in Brussels. As someone coming from an NGO known for its capacity building and practical education efforts, and with a background in Internet policy in the states, the conference proved useful in order to better understand the current discourse around privacy and data protection in the EU. Below are my main impressions of this motley gathering of high-ranking academics, advocates, and industry reps.

1. Several company representatives expressed worry over the loss of trust from their user base in recent months. Yet while companies want to engender trust, these reps gave no indication that they plan to open up their coats to show how their services are actually protecting user data. Meanwhile, the FOSS community is trying to move beyond this kind of “just trust us” model, by which company policies and reputation often take the place of accountability processes and independent verification.

The Lavabit scandal from last summer is a prime example of the brokenness of this model: Founder Ladar Levison made bold claims around his email service’s security and privacy protecting properties to people frightened by the NSA news-cycle, presenting himself as an ethical service provider-as-badly-needed hero figure. But Lavabit was never audited externally to verify his claims. After it was shut down, Levison and reps from another reputation-riding service — Silent Circle — announced their new Dark Mail Alliance. This caused some ire in the security community, which challenged the lack of transparency among both service providers, pointed out known flaws in the Lavabit server encryption scheme, and ultimately stamped it with the verdict that until it proves otherwise,  this new effort can be seen primarily as a marketing gambit. More than ever, the greater Free and Open Source Software community feels its essential to move beyond commercial claims of trustworthiness and promises of good-will, but many companies do not. The FOSS community had a minimal presence at CPDP.

2. A big point of discussion was the need to reframe the concept of a “right to be forgotten.” Invisibility rights aren’t new, and the way people forget is not the way computers forget. For example, suing someone will not cause them to forget what they saw about you on Facebook. There is no tool available for eternal sunshine of the spotless mind, and if there were, we might be worse off. My takeaway: we must ask more deeply what it would mean for the network to forget things.

3.  I’ve often heard Information and Privacy Commissioner of Ontario Ann Kavoukian’s framework for Privacy by Design used interchangeably with “ security by design” or “privacy by default”  to describe a way of building and layering technologies and policies to ensure privacy and data protection at a fundamental level in tools and services. Post-CPDP, my impression is that circa 2014, a belief in Privacy by Design is often touted by companies to engender trust in their policies, while sidestepping the bigger questions around data collection. 2-decades in development, this conception of Privacy by Design appears to have been co-opted to justify data collection schemes with no framework for minimization of data collection or surveillance . Your ultimate faith in Privacy by Design might depend on how fully you believe in the power of corporate accountability in the first place. I’d like to see case studies on the implementation of this framework. Can you point me to some?

3.a By the way, did you know that Privacy-Protective Surveillance is a bonafide concept? Seeking to get beyond zero-sum societal debates around more vs. less surveillance, Kavoukian proposes that societies can justify the need for more surveillance as long as governance structures incorporate a set of principles into the design of systems in order to prevent the misuse of the data contained in them. This argument appears to echo some of the discourse around the principles of the EU data protection scheme. It goes something like this: we’re going to keep up this trend of collecting more and more of your data, but we promise to protect it in a way that engenders trust, so that we can enjoy your political good will. At the CPDP panel on Privacy by Design, one service provider framed his enhanced verification technique for biometric smart cards as an innovative form of “Privacy-Protective Surveillance,” which in turn fit comfortably into the Privacy by Design model, according to one of Kavoukian’s deputies present at CPDP. The deputy later explained her viewpoint that in an age in which certain populations depend upon verifiable biometric identification in order to claim many forms of government benefits, it bodes in everyone’s favor to build these mechanisms more securely than ever. Hard to argue with if you stay within the positive-sum surveillance framework described.

4. A lot of policy makers and academics agree that “we should educate the user!” As someone working for an NGO concerned very much with privacy education and outreach, I was a bit heartened to hear a plethora of exasperated calls for more user education around privacy and digital security. However, the call always seemed to come at the end of the talk, to signify the exhaustion of all other levers and instruments of data protection, or the conversation revolved around certification schemes, which one audience member called “the equivalent of requiring a drivers license to use the internet.” Privacy outreach and education are crucial, but the need for more of it should be seen as the start of a conversation. The how of privacy education and outreach is the real problem space.

Conclusions:

The rifts between the conversations around privacy which I witnessed at CPDP and the ones going on in the FOSS world seem quite big. That’s fine, but actors standing orthogonally opposed in our seemingly unified privacy community could reap enormous benefits from sharing the same space more often. I’m glad I went to CPDP: it underlined to me that advocates and allies of the FOSS community must work harder on the framing of their arguments. If a policy maker thinks it’s advisable to frame the newest, most advanced form of invasive biometrics as a privacy protecting element of ever-broadening surveillance schemes, then it seems we need to define the progress we’re pushing for more precisely. Virtually no one at the conference asked why the policy makers present aren’t pushing for less surveillance or less data collection, i.e “data minimization.” For me this was the elephant in the room.

Do you think it’s adequate for the predominant discourse to revolve around building “just trust us”-style accountability into ever-growing collection schemes? If not, then we will need to expand our thinking around what’s acceptable in our data-permeated society at large, and work to establish social norms around what we see as acceptable practices.

No responses yet

Paranoia & Empowerment; Wishes for 2014

Feb 05 2014

2013: Everything has changed. The world as we know it; gone. Friends quit their jobs, speak drunkenly of chucking Thinkpads out windows and running for the hills, of living in a forest colony and of learning to love the world in higher resolution — without screens. But wait. Nothing has changed. The goal of the work is the same — to push for rights, to show people how to understand risk, to hack protection into structures that lack it.

In 2013 I fought a creeping powerlessness. It hit me in waves. Each time it mounted, I observed with fascination the small tweaks I made to my habits to manage anxiety over things I couldn’t control. Each time I hid from a camera or turned off my phone, I performed a ritual to attempt to reclaim a feeling of personal autonomy, while realizing these actions are a drop in the bucket.

In 2013, I felt the “chilling effects” on free speech I’d always associated with my family’s Soviet experience, and I reclaimed an identity shaped by constant situational awareness. I’d grown up with stories about my family’s use of coded messages to communicate the details of their 1970′s emigration from the USSR to the United States as political refugees. The neighbors listened through the walls. The line was tapped. “Did you mend the purple dress?” meant “did you pack the asylum documents?” In America, my family found a safe haven, and I grew up idealistic.

Though I write a lot, and often, for my job and for myself, for several months after June 6th ,2013, the desire to publish anything — from blog posts to essays to tweets — simply evaporated. Through the summer, I experienced a fear of expressing views publicly, in my name, so stultifying that the mere idea of appending my thoughts with certain proper nouns or 3-letter acronyms seemed impossible; that typing those characters into a text editor and pushing them onto the network would be equivalent to waving and calling out “here I am!” and waiting to be enveloped by the dragnet. One day mid-summer, my mom said to me, “well, now you know what it was like for us. Russians never trusted the wire. Now Americans don’t either.”

But a couple of seasons have come and gone, and I want to write again.

In 2014, I’ll take precautions: there are certain things I’ll never disclose on the Internet. I’ll be responsible in the handling of information given to me by others. I’ll meet people where they are and do my best to show how it’s possible to secure our communications. I’ll do my best to help shape a path of empowerment. But I’ll keep in mind how hard all of this is, because I’ve been paranoid and back too many times to count.

Ah yes, and in 2014, I’m also going to remember to step out more from behind the screen and enjoy the world in higher resolution.

No responses yet

Shaping the Narrative: A Note of Clarification

Apr 29 2013

tl;dr: lets keep emphasizing the beauty of collaboration for the greater good.

In November 2012, an unexpected event occurred in NYC. A hurricane rolled in and upended the lives of many for weeks on end. Help came eventually, but many were left to take care of  themselves, especially in the first week. Among the infrastructure that took a beating was the extensive wired and wireless networks around New York. Some neighborhoods lost all forms of Internet and mobile connectivity. Red Hook was one of these neighborhoods.

Among the serious problems facing residents was a lack of heat, water, and electricity from the night before the storm all the way through Thanksgiving. Not having electricity prevented residents from communicating with the outside world, further inconveniencing them, and in some cases, endangering lives.  In the case of Red Hook, one of the mitigating structures had been in place months before, and that is what made it effective in what is now framed as a win amidst a serious humanitarian disaster. This structure was a small set of Wifi nodes put in place through the cooperation of Red Hook Initiative and the Open Technology Institute at the New America Foundation.

When the storm hit, a combination of factors allowed for these nodes to provide connectivity to residents: first, Red Hook Initiative sits at the edge of the neighborhood, near the BQE; relatively far away from the bay, and thus the most serious flooding in the neighborhood. Perhaps for this reason, the electricity stayed up and left its Internet service intact. Second, the Wifi nodes themselves were already in place on the roof, and they stayed up through the storm. The Wifi routers were able to provide connectivity through RHI’s functional electricity and Internet uplink.

About 10 days after Sandy landfall, FEMA and its collaborators became aware of RHI Wifi and offered help to augment the already existing network, by facilitating access to a faster satellite uplink, opening up discussions with city officials, and coordinating the added help of a few volunteers.  This decision was predicated on the idea that it’s better to build off of pre-existing efforts. Without the efforts of RHI, OTI, and collaborators months before the storm, there would have been no groundwork from which to build subsequent humanitarian response efforts.

I wrote an article already about some of the events that transpired, but I wanted to write this blog post as a note of clarification following months of introspection about what it means to shape a narrative. It turns out that this piece of infrastructure and the efforts around it have become a bit of an emblematic episode in discussions around coordination between state and non-state actors, and centralized and de-centralized structures. My article described only a small slice of events that took place over the course of three days.

A piece describing the “long-tail” would have read differently and would have put even more of an emphasis on the fact that things “worked” because the groundwork was laid in advance. In the months since, organizations at various international, state and non-state levels  have used this episode to demonstrate the value of decentralized infrastructure and new forms of humanitarian aid collaborations, and to push for more capacity in their efforts. This is a wonderful thing to see, but I hope that those using this episode as an example take the time to point out that the seeds were planted long ago, and that non-state actors were at least as much responsible for the positive results we have seen.

tl;dr: lets keep emphasizing the beauty of collaboration for the greater good.

No responses yet