|
Privacy Threats
- What Information is Protected?
- Privacy From Whom?
- Rivals
- Individual Goofing Off
- What is the risk where data is lost?
Technology that will protection you from one threat vector may not protected you from another. An email service that offers encrypted email may protect you against authoritarian regimes, but not as against the corporation, or as against the divorce lawyer.
Privacy Protections
- as against whom
- Firms
- Corporations
- Governments
- Criminals
- Rivals
- Individuals Goofing Off
- Discontinuity of protections
- Corporations versus Governments
- Laws
- Torts
- Public disclosure of private facts
- Expectation of privacy
- Disclosure is highly offensive
- Information is not of legit public concern \ Newsworthy
- Factors: Social value of info, depth of intrusion, is figure a public or private figure
- See Snyder v Felps
 (variables: context, form)
Information Collection Concerns
From N Doty, D Mulligan. E Wilde, Privacy Issues of the W3C Geolocation API, UC Berkeley School of Information Reports 2010-038, February 2010
-
"Appropriateness: Is the collection of location information appropriate given the context of the service or application?
-
"Minimization: Is the minimum necessary granularity of location information distributed or collected?
-
"User Control: How much ongoing control does the user have over location information? Is the user a passive receiver of notices or an active transmitter of policies? Are there defaults? Do they privilege privacy or information
ow?
-
"Notice: Can requesters transmit information about their identity and practices? What information is required to be provided to the user by the requesting entity? What rules can individuals establish, attach to their location information and transmit? Is there a standard language for such rules?
-
"Consent: Is the user in control of decisions to disclose location information? Is control provided on a
per use, per recipient or some other basis? Is it operationalized as an opt-in, opt-out or opt model?
-
"Secondary Use: Is user consent required for secondary use (a use beyond the one for which the information was supplied by the user)? Do mechanisms facilitate setting of limits or asking permission for secondary uses?
-
"Distribution: Is distribution of location information limited to the entity with whom the individual believes they are interacting or is information re-transmitted to others?
-
"Retention: Are timestamps for limiting retention attached to location information? How can policy statements about retention be made?
-
"Transparency and Feedback: Are
flows of information transparent to the individual? Does the specification facilitate individual access and related rights? Are there mechanisms to log location information
requests and is it easy for individuals to access such logs
-
"Aggregation: Does the standard facilitate aggregation of location information on specific users or users generally? Does the specification create persistent unique identifiers?
- Taxonomy [Eckersley EFF When Geeks Meet Wonks]
- What Data is protected (what you read, where you go, when you go, who you are, what is your religion, sexual orientation, who you talk to, what you buy)
- Privacy as against whom? (corporations, advertisers, governments, family, spouces, employers, law enforcement, lawyers, identity thieves, mafia, stalkers, data brokers)
- Purpose of Privacy ? (protection from authoritarian governments, social intolerance, crime, protection, individuals; what is risk where privacy is compromised)
- Data where (in storage, in the cloud, on your computer, in transmission)
- Tools
- Blocking Resistant Tools
- Proxies
- TOR
- Onion Routing. Bounces traffic through three different nodes of TOR before ultimate destination.
- Uses proxies so that man-in-the-middle cannot intercept communications and see destination of communications.
- Useful for dissidents in authoritarian regimes
- Should be used with HTTPS
- Problem: Slow and limited capacity.
- See Prof. Doug Sickers work on TOR limitations
- Freegate by Dynamic Internet Technology Inc. (funded by VOA)
- Feb. 2002 Started pilot project with USG [About DIT]
- May 2002 Project extended one year [About DIT]
- Ultrasurf
- Hotspot Shield
- Circumventor
- Encryption
- on Computer
- of Communications
- HTTPS (Web)
- Encryption of web access, protects against interception of webbrowsing (including web based email), username and password interception, theft of financial information, ID theft, account hijacking. Useful with Wifi access points.
- Email: Avoids interception in transmission (by authoritarian regime); however stored email subject to subpoena
- Problem: Not widely deployed, or not deployed correctly [Eckersley EFF When Geeks Meet Wonks]
- EFF
- VPN (transmissions)
-
Web Browser based
- Do Not Track
- "Do not track" is a response to behavioral advertising. Do Not Track would be "a persistent cookie on a consumer's browser, and conveying that setting to sites that the browser visits, to signal whether or not the consumer wants to be tracked or receive targeted advertisements"
- "Do not track" flag in your client browser signally to advtisers or website that you do not want to be tracked.
- Protects against tracking individuals web viewing activity
- Only works where websites participate
- Can also log into advertisers site (Google Ads) and set tracking preferences
- USG
- FTC
- For Release:12/01/2010 FTC Staff Issues Privacy Report, Offers Framework for Consumers, Businesses, and Policymakers Endorses "Do Not Track" to Facilitate Consumer Choice About Online Tracking
- Federal Trade Commission (Bureau of Consumer Protection) A Preliminary FTC Staff Report on Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers (December 1, 2010)
- Text of the FTC Staff Report, and Concurring Statements of Commissioner Kovacic and Commissioner Rosch
- FTC Privacy Report : Remarks of Chairman Jon Leibowitz as Prepared for Delivery
- Dept of Commerce Internet Policy Task Force ::
Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework
- Prepared Statement of the Federal Trade Commission on Do Not Track, Presented by David Vladeck, Director, Bureau of Consumer Protection, Before the Subcommittee on Commerce, Trade, and Consumer Protection of the Committee on the Energy and Commerce, United States House of Representatives (December 2, 2010) Text of the Commission Testimony :: For Release: 12/02/2010 FTC Testifies on Do Not Track Legislation
- Links
- Browsers and Add Ons
- Papers
- Congress
- Legislation
- HR 654 Do Not Track Me Online (Mr. Speier) 112th Cong. "Requires the Federal Trade Commission (FTC) to promulgate regulations to establish standards for the required use of an online opt-out mechanism to allow a consumer to prohibit the collection or use of any covered information and to require a covered entity to respect the choice of such consumer to opt-out of such collection or use..."
- December 2010 Hearing
- Dingell Examines the Feasibility of Do Not Track LegislationDecember 2, 2010 8:05 AM
- "Do-Not-Track" Legislation: Is Now the Right Time? Testimony of Daniel J. Weitzner Associate Administrator for Policy Analysis and Development National Telecommunications and Information Administration United States Department of Commerce Before the Subcommittee on Commerce, Trade and Consumer Protection Committee on Energy and Commerce United States House of Representatives December 2, 2010
- FTC Testifies on Do Not Track Legislation 12/02/2010
- The testimony states that while some in the industry have taken steps to improve consumer control of behavioral advertising, industry efforts have largely fallen short. Given the limitations of existing mechanisms, "the Commission supports a more uniform and comprehensive consumer choice mechanism for online behavioral advertising," sometimes referred to as "Do Not Track."
The most practical way to do that "would likely involve placing a setting similar to a persistent cookie on a consumer's browser, and conveying that setting to sites that the browser visits, to signal whether or not the consumer wants to be tracked or receive targeted advertisements," according to the testimony.
The testimony states that such a mechanism could be accomplished through legislation or potentially through robust, enforceable self-regulation. "If Congress chooses to enact legislation, the Commission urges Congress to consider several issues," including:
- It should not undermine the benefits online behavioral advertising provides consumers, including funding content and services;
- Unlike the FTC's Do Not Call Registry for telemarketers, it should not require a registry of unique identifiers; rather, the Commission recommends a browser-based mechanism;
- It should consider an option that lets consumers choose to opt out completely or to choose certain types of advertising they wish to receive or data they are willing to have collected about them;
- The mechanism should be simple, and easy to find and use;
- The FTC should be given Administrative Procedures Act rulemaking and the ability to fine violators to "provide a strong incentive for companies to comply with any legal requirements, helping to deter future violations."
- Dec 2, 2010: Rep. Markey Opening Statement at hearing on Do Not Track legislation
- Dec 2, 2010: Markey to Introduce Legislation to Protect Children's Online Privacy
- NoScript ,
- AdBlock plus (reportedly the number one downloaded add on for firefox)
- TACO ,
- PrivacyChoice
- P3P
Notes
- See also Filters
- Authentication
- Best Practices, Industry
- Cloud
- Compliance
- Compliance with Various Jurisdictions
- International
- Local
- Interoperability / Fragmentation of Regimes
- Administrative Costs
- Inconsistent regulation
- Barrier to entry of corporations
- Cost / Benefit
- Data retention
- Data Security & Breach
- Firm Reputation re Security / Management / Breach
- Data Breach
- Security Requirements
- Notification Requirements
- When Must Be Given; Breach of What Type of Information
What Information Much be Provided
- Enforcement
- of Privacy Policies
- of Privacy Regulation
- Health / Medicine Information
- Identities
- Opt Out / Opt In
- Jim Puzzanghera, Opt-in Rule Sought for Web Tracking, L.A. TIMES, July 18, 2008
- Privacy by Design
|
