Finally got to publish some results...more coming:
A collection of discussions, links, stories, news and whatever else I find interesting in the fields of computing, information, science, privacy, semantics, mathematics and so on...
Showing posts with label Privacy. Show all posts
Showing posts with label Privacy. Show all posts
Sunday, 23 April 2017
Sunday, 5 March 2017
Should the privacy profession adopt a code of ethics?
“What started to grow was the notion of a privacy officer or privacy manager as someone who could run a program that could pull together the technical and the legal piece, and I think everyone in the profession at the time thought that was a really good thing,” Kosa said. “But as the discipline grew, as the domain evolved, a lot more people got interested in it, but a lot of those people got interested not for the same reasons the people who grew the field were interested in it.”
In other words, it turned into a compliance-based exercise.
That shift didn’t sit well with her. What irked her was her sense that the field was losing its strong base of privacy advocates, replaced by professionals who were saying to companies, “I can knock out a privacy impact assessment for you for $50,000, no problem.”
Tuesday, 13 December 2016
ePrivacy Directive
It seems that the proposal for the new ePrivacy Directive has been leaked - not quite sure I'd put it in the same league as the Panama Papers but good to see an early draft of the most important piece of potential privacy legislation since the GDPR
Here's the link to the PDF: http://www.politico.eu/wp-content/uploads/2016/12/POLITICO-e-privacy-directive-review-draft-december.pdf
It is highly unlikely that this will be retracted or hidden...something called the Streisand Effect.
As this concerns networks and OTT service providers this is potentially far more interesting that the GDPR in its scope. And, before someone goes off on a Daily Mail style anti-EU rant ( "EU bureaucrat demand that companies protect user data is evil" kind of thing ), this brings greater clarity and consistency to companies and EU citizens regarding how companies can use, profit from, market, sell etc, their data - good stuff!
Here's the link to the PDF: http://www.politico.eu/wp-content/uploads/2016/12/POLITICO-e-privacy-directive-review-draft-december.pdf
It is highly unlikely that this will be retracted or hidden...something called the Streisand Effect.
As this concerns networks and OTT service providers this is potentially far more interesting that the GDPR in its scope. And, before someone goes off on a Daily Mail style anti-EU rant ( "EU bureaucrat demand that companies protect user data is evil" kind of thing ), this brings greater clarity and consistency to companies and EU citizens regarding how companies can use, profit from, market, sell etc, their data - good stuff!
Monday, 21 November 2016
Seminar: Software as a Medical Device
Seminar: Software as a Medical Device:
Safety and security.
January 5, 9-11 am
Seminar room: Merkuur
Connected Health cluster presents a practical seminar to help health IT developers and startups plan and manage smoothly their products to comply with needed standards and rules.
9:00 What is a software as a medical device and what is required to get regulatory compliant products on the market - overview of medical device software safety, regulations in EU and US, standards and FDA guidance - Dr. Marion Lepmets, Co-Founder & CEO of SoftComply – 30 min presentation + 15 min Q&A
9:45 Privacy Engineering and Health Data: IT and IoT - Dr. Ian Oliver, Security Specialist at Bell Labs – 30 min presentation + 15 min Q&A
10:30 Discussion and 1-2-1 Q&A
Please register by January 3 the latest: services@tehnopol.ee
Free for Science Park Tehnopol network and service clients and Connected Health cluster members. 30€ + vat for others.
Tuesday, 15 November 2016
Privacy Engineering for Today - DIMECC Presentation
Here is my presentation from the DIMECC 9th Annual Seminary on Business innovation in Finland.
Wednesday, 2 November 2016
CrIM'16 Keynote on Safety Critical Ideas in Privacy
Here are the slides and a longer presentation as a paper will be available soon:
Friday, 23 September 2016
Privacy Metrics
Along with a colleage - Dr. Yoan Miche - we presented a paper outlining ideas regarding using mutual information as a metric for establishing some form of 'legal compliance' for data sets. The work is far from complete and the mathematics is getting horrendous!
The paper entitled "On the Development of A Metric for Quality of Information Content over Anonymised Data-Sets" was presented at the excellent Quatic 2016 conference held in Lisbon, Sept 6-9, 2016.
We were also extremely fortunate in that a presented in our session didn't turn up and we were graciously given the full hour not just to present the paper but give a much fuller background and details of future work and the state of our current results.
Here are the slides:
Abstract:
Citation:
Ian Oliver and Yoan Miche (2016) On the Development of A Metric for Quality of
Information Content over Anonymised Data-Sets. Quatic 2016, Lisbon, Portugal, Sept 6-9, 2016.
The paper entitled "On the Development of A Metric for Quality of Information Content over Anonymised Data-Sets" was presented at the excellent Quatic 2016 conference held in Lisbon, Sept 6-9, 2016.
We were also extremely fortunate in that a presented in our session didn't turn up and we were graciously given the full hour not just to present the paper but give a much fuller background and details of future work and the state of our current results.
Here are the slides:
On The Development of A Metric for Quality of Information Content over Anonymised Data Sets from Ian Oliver
Abstract:
We propose a framework for measuring the impact of data anonymisation and obfuscation in information theoretic and data mining terms. Privacy functions often hamper machine learning but obscuring the classification functions. We propose to
use Mutual Information over non-Euclidean spaces as a means of measuring the distortion induced by privacy function and following the same principle, we also propose to use Machine Learning techniques in order to quantify the impact of said obfuscation in terms of further data mining goals.
Citation:
Ian Oliver and Yoan Miche (2016) On the Development of A Metric for Quality of
Information Content over Anonymised Data-Sets. Quatic 2016, Lisbon, Portugal, Sept 6-9, 2016.
Monday, 19 September 2016
Requirements Engineering and Privacy
A lot of travelling this month to conferences and speaking about privacy engineering (as usual). I just spent a week in Beijing at RE'16 (Requirements Engineering 2016) where I both presented a paper on privacy requirements and participated in a panel session on digitalisation and telecommunications - more on that later.
Anyway, here are the slides from the privacy paper:
And here is the abstract:
Ian Oliver (2016) Experiences in the Development and Usage of a Privacy Requirements Framework. Requirements Engineering 2016 (RE'16), Beijing, China, September 12-17, 2016
Anyway, here are the slides from the privacy paper:
And here is the abstract:
"Any reasonable implementation of privacy requirements can not be made through legal compliance alone. The belief that a software system can be developed without privacy being an integral concept, or that a privacy policy is sufficient as requirements or compliance check is at best dangerous for the users, customers and business involved. While requirements frameworks exist, the specialisation of these into the privacy domain have not been made in such a manner that they unify both the legal and engineering domains. In order to achieve this one must develop ontological structures to aid communication between these domains, provide a commonly acceptable semantics and a framework by which requirements expressed at different levels of abstractness can be linked together and support refinement. An effect of this is to almost completely remove the terms ‘personal data’ and ‘PII’ from common usage and force a deeper understanding of the data and information being processed. Once such a structure is in place - even if just partially or sparsely populated - provides a formal framework by which not only requirements can be obtained, their application (or not) be justified and a proper risk analysis made. This has further advantages in that privacy requirements and their potential implementations can be explored through the software development process and support ideas such as agile methods and ‘DevOps’ rather than being an ‘add-on’ exercise - a privacy impact assessment - poorly executed at inappropriate times."
Ian Oliver (2016) Experiences in the Development and Usage of a Privacy Requirements Framework. Requirements Engineering 2016 (RE'16), Beijing, China, September 12-17, 2016
Friday, 5 August 2016
Privacy Engineering Procedures and Ebola
A seemingly unlikely combination: privacy engineering and ebola, though I guess there are similarities by which viruses spread with how personal data spreads around a company - another time and another study I think.
OK, so what the zark do these things have in common - the answer is via a convoluted path and actually is more related to how we react to an incident: privacy or medical (and we're back to safety-critical systems again).
Bit of background first: I've been reading about Marburg and Ebola recently - both are fascinating (and frightening) themselves, but what is more interesting from a procedural point of view is how they were discovered, researched and ultimately how we as a species react to them.
Now the procedural stuff, the CDC have a response plan for Ebola entitled: Identify, Isolate and Inform: Emergency Department Evaluation and Management for Patients Under Investigation for Ebola Virus Disease.
Worth reading just to understand how the CDC explain how to plan your due diligence - something we're exceptionally bad at in privacy ... we just scream PIA and COMPLIANCE !
The point here is that if privacy engineering is to emerge as a discipline we need to address our culture in how we react to incidents and even react in general. Learning from a discipline that already has to face critical incidents is a good start.
OK, so what the zark do these things have in common - the answer is via a convoluted path and actually is more related to how we react to an incident: privacy or medical (and we're back to safety-critical systems again).
Bit of background first: I've been reading about Marburg and Ebola recently - both are fascinating (and frightening) themselves, but what is more interesting from a procedural point of view is how they were discovered, researched and ultimately how we as a species react to them.
 |
| Ebola (via Wikipedia and CDC) |
Worth reading just to understand how the CDC explain how to plan your due diligence - something we're exceptionally bad at in privacy ... we just scream PIA and COMPLIANCE !
The point here is that if privacy engineering is to emerge as a discipline we need to address our culture in how we react to incidents and even react in general. Learning from a discipline that already has to face critical incidents is a good start.
Thursday, 28 July 2016
S-Group and Customer Data Collection
Have't written here for a while, but as luck would have it here's a privacy story from Finland.
The supermarket chain S-Group are updating their customer loyalty scheme to make it more relevant for their customers, ie: direct advertising. The basic idea is that they'll make fine grained data collection from the various shops and services in the S-Group. Such data include the specific purchases as well as, of course, time stamps, locations, identity etc.
While various consumer organisations are incensed by this obvious infringement of people's privacy, the danger is really elsewhere.
For a start we have the classic massive data collection from which we can make all kinds of inferences - ostensibly the what, where, when and intriguingly why of consumer purchases. Down this road we see the also classic direct advertising mistakes - you bought milk last week so you'll buy milk this week ... seriously if a supermarket can't work this out without "BigData" then they have problems.
There's also the issue that inferences can have other unforseen effects:
How Target Figured Out A Teen Girl Was Pregnant Before Her Father Did
Kashmir Hill, Forbes
Feb 16, 2012
That's really going to go down well with the Finnish regulators...
The part that really worry me is where S-Market states that it will keep the data for future usages. As I wrote in Privacy Engineering, any time you see a future use of data this should start alarm bells ringing. It means that you have no clear use case, no clear set of users of that data and are in effect over-collecting data on a whim. Collecting and keeping data for future use is a very high risk activity.
Nothing is mentioned in their literature about security, location of data etc - though I guess the standard "industry standard" answer (Tesco anyone?) will be used. Hint: I worked on those industry standards...they set out some of the base, good practices only.
I constructed a data flow model of as much as I understand about the system at the moment. It isn't much but over each of those flows is going your personal data. The dashed lines represent return data flows, the dashed circles represent "unknown" participants. Question: does this data get sold to 3rd parties?
In defence of S-Group they have announced this to all customers of their bonus scheme - though the language is a little flowery in places (did you know that their bonus scheme has won a prize?!).
Details can be found here and here, and you can obtain your data that is held in their customer registry, though I assume not the inferences made from that data. You can see this data from your S-Kanava account; also in writing though only once per year without charge. You can opt-out whenever you want (though the opt-out is not retroactive as far as I can see) by calling +358 (0)10 76 5858 (calls cost 0.088eur/min - why not free if you were serious about privacy?)
As this scheme is not in operation yet obviously I can't comment on what data I will be able to see and control. I might for myself let it run for a month and then see what data I can get out of the system. I assume I will get the time, location and itemised list of products from every transaction I make; hopefully also the mechanism how I paid the particular cashier (at least till number) and so on.
Another final point is that all bonus money collected by customers is paid to an account in S-Pankki, but that's another story about compliance and interpreting the law.
The supermarket chain S-Group are updating their customer loyalty scheme to make it more relevant for their customers, ie: direct advertising. The basic idea is that they'll make fine grained data collection from the various shops and services in the S-Group. Such data include the specific purchases as well as, of course, time stamps, locations, identity etc.
While various consumer organisations are incensed by this obvious infringement of people's privacy, the danger is really elsewhere.
For a start we have the classic massive data collection from which we can make all kinds of inferences - ostensibly the what, where, when and intriguingly why of consumer purchases. Down this road we see the also classic direct advertising mistakes - you bought milk last week so you'll buy milk this week ... seriously if a supermarket can't work this out without "BigData" then they have problems.
There's also the issue that inferences can have other unforseen effects:
How Target Figured Out A Teen Girl Was Pregnant Before Her Father Did
Kashmir Hill, Forbes
Feb 16, 2012
"Every time you go shopping, you share intimate details about your consumption patterns with retailers. And many of those retailers are studying those details to figure out what you like, what you need, and which coupons are most likely to make you happy. Target, for example, has figured out how to data-mine its way into your womb, to figure out whether you have a baby on the way long before you need to start buying diapers."
That's really going to go down well with the Finnish regulators...
The part that really worry me is where S-Market states that it will keep the data for future usages. As I wrote in Privacy Engineering, any time you see a future use of data this should start alarm bells ringing. It means that you have no clear use case, no clear set of users of that data and are in effect over-collecting data on a whim. Collecting and keeping data for future use is a very high risk activity.
Nothing is mentioned in their literature about security, location of data etc - though I guess the standard "industry standard" answer (Tesco anyone?) will be used. Hint: I worked on those industry standards...they set out some of the base, good practices only.
I constructed a data flow model of as much as I understand about the system at the moment. It isn't much but over each of those flows is going your personal data. The dashed lines represent return data flows, the dashed circles represent "unknown" participants. Question: does this data get sold to 3rd parties?
 |
| Inferred DFD |
In defence of S-Group they have announced this to all customers of their bonus scheme - though the language is a little flowery in places (did you know that their bonus scheme has won a prize?!).
Details can be found here and here, and you can obtain your data that is held in their customer registry, though I assume not the inferences made from that data. You can see this data from your S-Kanava account; also in writing though only once per year without charge. You can opt-out whenever you want (though the opt-out is not retroactive as far as I can see) by calling +358 (0)10 76 5858 (calls cost 0.088eur/min - why not free if you were serious about privacy?)
As this scheme is not in operation yet obviously I can't comment on what data I will be able to see and control. I might for myself let it run for a month and then see what data I can get out of the system. I assume I will get the time, location and itemised list of products from every transaction I make; hopefully also the mechanism how I paid the particular cashier (at least till number) and so on.
Another final point is that all bonus money collected by customers is paid to an account in S-Pankki, but that's another story about compliance and interpreting the law.
Wednesday, 8 June 2016
2nd IW5GS - Programme
The 2nd International Workshop on 5G Security
IW5GS2016
Xi'an, China
June 19, 2016
http://www.mobimedia.org/2016/show/program-final
IW5GS-01: (June 19, 2016, Sunday, 10: 30 – 12:30, Room B)
Session Chair: Valtteri Niemi (Email: valtteri.niemi@helsinki.fi)
Keynote 1: 5G Security for IoT
Speaker: Dr. Zhiyuan Hu, Nokia Shanghai Bell (zhiyuan.hu@alcatel-sbell.com.cn)
Keynote 2: 5G Security: Forward Thinking
Speaker: Bo Zhang, Huawei (liufei19@huawei.com)
IW5GS-02: (June 19, 2016, Sunday, 14: 00 – 16:30, Room B)
Session Chair: Siddharth Prakash Rao (Siddharth.rao@aalto.fi); Ian Oliver (ian.oliver@nokia.com)
Paper 1: Protecting IMSI and User Privacy in 5G Networks
Karl Norrman, Elena Dubrova, Mats Näslund
Paper 2: Privacy of the Long-Term Identities in Cellular Networks
Philip Ginzboorg, Valtteri Niemi
Paper 3: Error-Correcting Message Authentication for 5G
Elena Dubrova, Mats Näslund, Göran Selander, Karl Norrman
Paper 4: Privacy in LTE networks
Siddharth Prakash Rao, Bhanu Teja Kotte, Silke Holtmanns
Paper 5: A Survey on Software-Defined Networking Security
Shanshan Bian, Peng Zhang, Zheng Yan
Paper 6: Designing Hybrid Cloud Computing Framework using OpenStack for Supporting Multimedia with Security and Privacy
Isaac Cushman, Lei Chen, Danda B. Rawat, and Nhien-An Le-Khac
Sunday, 22 May 2016
Preparing your children for total surveillance
I noticed these in a book shop today:
What they do is project a "soothing picture" onto the wall or ceiling at night - ostensibly to help your child sleep. What struck me was the similarly in their design to a surveillance camera, so I guess there's no better time that early childhood to start preparing your child to be oblivious to such devices in everyday life.
Remember, total surveillance is for your safety and security...
Go figure...
What they do is project a "soothing picture" onto the wall or ceiling at night - ostensibly to help your child sleep. What struck me was the similarly in their design to a surveillance camera, so I guess there's no better time that early childhood to start preparing your child to be oblivious to such devices in everyday life.
Remember, total surveillance is for your safety and security...
Go figure...
Tuesday, 3 May 2016
Agile is dead
This is an excellent post, though some might consider it a rant, about how Agile wasn't really nor became what Agile should it should have...
Agile is Dead
But here's the best quote:
To me, given the problems that Privacy by Design has caused with privacy officers believing in some mythical "compliance" without any consideration of the software engineering or cultural aspects of developing information systems, this sums it up quite nicely!
Agile is Dead
"Are you an IT consultant or contractor? Agile Software Development work is dead. If you practice that, you are a doorstop. If you manage that way, you are a boat-anchor. The wave has ended, it is over, and if you went for the head-fake and bought certifications, you wasted some money. Soon recruiters will be putting your resume in the circular storage container. I have been warning you for some time, and the day is here. Hah, you should have listened. Move along."
But here's the best quote:
The moral of this part of the story is that if you produce some compact politicised ideology (manifesto) consisting of principles and rules there will be unintended consequences. Success creates a religion or cult, and defeat is being ignored. No such doctrine is perfect. Thinking you will change the world with a manifesto is naive, and if you succeed you may not have improved the world.
To me, given the problems that Privacy by Design has caused with privacy officers believing in some mythical "compliance" without any consideration of the software engineering or cultural aspects of developing information systems, this sums it up quite nicely!
Sunday, 10 April 2016
Information wants to be free...?
I both like and dislike the quote "information wants to be free", mainly because it opens up a very nice philosophical discussion on what 'free' means but also because - and this is part I hate - it is some damned meaningless without any grounding in any form of semantics; and we've seen this before!
For the first part, this statement treats information in an anthropomorphic manner. Is it really information itself that has the need to be free? Let's assume that it does, though in a very fairy tale like way, it seems to me.
So let's then look at the word 'free', which I assume does not mean 'free' as in 'without cost' in the sense that someone has to pay for it. Though this is a curious idea in that information is somehow prostituting itself and despite all attempts someone (the information's pimp perhaps?) insists on controlling things. I guess this is the idea that information is going through some pre-1960's sexual revolution...
Let's stick with the word 'freedom' and its naive or common-sense meaning. What does it mean to be free? We can turn further to the the UN Declaration of Human Rights and the EU Charter of Fundamental Rights for further clarification, though here I'm sure we go into more of a legal-political debate more than anything. Evidently freedom means either the right to do or be something or the right to be protected from something.
So the question is, if information want to be free:
Under the first question, the freedom to be 'free' as in 'without cost' certainly falls. What about the freedom to be private, or the freedom not to be abused - as in excessive privacy violations? Do we further need a notion of agency - does information have an owner or provenance?
Without answering those - I don't think I can give a definitive answer anyway - here's another thought. Given that matter = energy, isn't the use of the term information quite literally another way of saying 'humans' (or 'men' as in the Declaration of Independence). In which case the question 'information wants to be free' is just an expression of man's desire to define what freedom is - ostensibly in terms of freedom to do/be and freedom from.
And here comes the practical part, which freedoms to do/be or from do we allow or deny in order to be "free"?
For the first part, this statement treats information in an anthropomorphic manner. Is it really information itself that has the need to be free? Let's assume that it does, though in a very fairy tale like way, it seems to me.
So let's then look at the word 'free', which I assume does not mean 'free' as in 'without cost' in the sense that someone has to pay for it. Though this is a curious idea in that information is somehow prostituting itself and despite all attempts someone (the information's pimp perhaps?) insists on controlling things. I guess this is the idea that information is going through some pre-1960's sexual revolution...
Rather I think the word 'free' refers to 'freedom' albeit in a Western sense of the word. Think of the use of the concept freedom as used in the US Declaration of Independence.
"We hold these truths to be self-evident, that all information is created equal, that it is endowed by its Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness"...or should that be Existence, Communication and Semantics perhaps....?
Let's stick with the word 'freedom' and its naive or common-sense meaning. What does it mean to be free? We can turn further to the the UN Declaration of Human Rights and the EU Charter of Fundamental Rights for further clarification, though here I'm sure we go into more of a legal-political debate more than anything. Evidently freedom means either the right to do or be something or the right to be protected from something.
So the question is, if information want to be free:
- What does information want the freedom to do/be?
- What does information want the freedom from?
Under the first question, the freedom to be 'free' as in 'without cost' certainly falls. What about the freedom to be private, or the freedom not to be abused - as in excessive privacy violations? Do we further need a notion of agency - does information have an owner or provenance?
Without answering those - I don't think I can give a definitive answer anyway - here's another thought. Given that matter = energy, isn't the use of the term information quite literally another way of saying 'humans' (or 'men' as in the Declaration of Independence). In which case the question 'information wants to be free' is just an expression of man's desire to define what freedom is - ostensibly in terms of freedom to do/be and freedom from.
And here comes the practical part, which freedoms to do/be or from do we allow or deny in order to be "free"?
Thursday, 7 April 2016
Privacy Lectures @ University of Iowa
I'm giving two lectures at the University of Iowa on the 21st and 22nd of April as part of the Iowa Informatics Showcase Symposium.
The two lectures are:
The Iowa Informatics Showcase Symposium will focus on new directions in informatics research and involve talks from external and internal scholars. It will also include an informatics fair with a poster session, and booths highlighting research centers, core facilities, centers and institutes. Saturday Workshops will be conducted as part of the symposium with topics including software basics, GIS, mapping and visualization, statistical packages, and others.
The two lectures are:
- The Fundamentals of Privacy Engineering ( April 21 )
- From Where Comes Privacy ( April 22 )
The Iowa Informatics Showcase Symposium will focus on new directions in informatics research and involve talks from external and internal scholars. It will also include an informatics fair with a poster session, and booths highlighting research centers, core facilities, centers and institutes. Saturday Workshops will be conducted as part of the symposium with topics including software basics, GIS, mapping and visualization, statistical packages, and others.
Thursday, 24 March 2016
Brussels - something to think about
The Independent is running a story today:
Brussels attacks: Security officials accused of missing a string of opportunities to stop suicide bombers
Accomplices still on the run after day of conflicting reports and confusion
The following paragraphs are deeply troubling given the emphasis on "banning" encryption and the need for total surveillance:
The trouble is that now politicians are in the "do something" mode of operation, where doing anything, regardless of effectiveness, is far better than actually thinking and doing the right thing.
I had the pleasure of speaking with some security experts in counter-terrorism a while back. They effectively said that politicians want more security just to be seen to be doing something - this is why we've ended up with airport security that concentrates on bottles of water but not on mitigating the real risks - queues, delays, bottlenecks. The question of profiling, as seen in Israeli aviation security is too much for the politicians to risk their careers on so everyone will suffer under increasingly intrusive and increasingly ineffective security.
Finally this quote by Simon Jenkins of The Guardian:
Brussels attacks: Security officials accused of missing a string of opportunities to stop suicide bombers
Accomplices still on the run after day of conflicting reports and confusion
The following paragraphs are deeply troubling given the emphasis on "banning" encryption and the need for total surveillance:
The French Prime Minister, Manuel Valls, who laid a wreath at the underground station close to the European Commission headquarters where more than 20 people died, said that EU nations had to invest “massively” in their security systems.
The most direct criticism came from Turkey, which has previously criticised France for what it said was a failure to heed a prior warning about one of the suicide attackers involved in last year’s attack in Paris in which 130 people were killed.
Turkish officials have previously said that French authorities were warned twice by Turkey about one of the assailants in the attacks on Paris in November. A senior government source told The Independent: “We had warned France before the Paris attacks, now this. It’s ridiculous.”
The two brothers had been known to police in Belgium for years, and operated in some of the marginalised communities in the capital that had avoided close attention from the intelligence agencies despite problems of jihadist recruitment and terrorist links.
The Belgian federal prosecutor, Frederic van Leeuw, told reporters that the two brothers, Brussels-born Belgian citizens, had “extensive” criminal records but they were not related to terrorism.So, ultimately the failure was both of communication between intelligence and police agencies *and* a failure to listen. Worse is that the terrorists involved were already known (last paragraph above). If the signals of possible trouble were not seen in the above then the problem certainly does not lie with extensive data collection. In fact the perpetrators actually gained privacy by effectively hiding in plain sight.
The trouble is that now politicians are in the "do something" mode of operation, where doing anything, regardless of effectiveness, is far better than actually thinking and doing the right thing.
I had the pleasure of speaking with some security experts in counter-terrorism a while back. They effectively said that politicians want more security just to be seen to be doing something - this is why we've ended up with airport security that concentrates on bottles of water but not on mitigating the real risks - queues, delays, bottlenecks. The question of profiling, as seen in Israeli aviation security is too much for the politicians to risk their careers on so everyone will suffer under increasingly intrusive and increasingly ineffective security.
Finally this quote by Simon Jenkins of The Guardian:
Those who live under freedom know it demands a price, which is a degree of risk. We pay the state to protect us – but calmly, without constant boasting or fearmongering. We know that, in reality, life in Britain has never been safer. That it suits some people to pretend otherwise does not alter the fact.
In his admiral manual, Terrorism: How to Respond, the Belfast academic Richard English defines the threat to democracy as not the “limited danger” of death and destruction. It is the danger “of provoking ill-judged, extravagant and counterproductive state responses”.
Wednesday, 23 March 2016
NSA, BigData and Privacy
We all know that BigData is good and that more data is better. In fact if you could collect everything then you could potentially stop all crimes, stop terrorism, save the World, freedom, puppies...literally do anything and everything!
Except, as most organisations should have realised (ordinary businesses take note!!) that having huge amounts of data doesn't really help you if you have no idea of what you have, what it means and how to actually extract the data you want.
Its worse when you have so much that even running the queries that might extract the right piece of data becomes so complex that you may as well just give up.
Pity the NSA then:
http://www.zdnet.com/article/nsa-whistleblower-overwhelmed-with-data-ineffective/
NSA is so overwhelmed with data, it's no longer effective, says whistleblower
So, we have a paradox in the sense that the more data we get the better we can hide...
Its funny but about 2 years ago there was an idea called the "Slow Data Movement" whose aim was to save the World from BigData madness but concentrating on what you actually need...
In fact we've even heard the argument that mass surveillance is no where as effective as "good old fashioned police work".
In fact, it even seems that the recent attacks in Belgium relied upon unencrypted communications ... which should have been easily spotable, unless of course you've got politicians obsessed with the evils of encryption and too much data to even see the weak signals of ordinary, unencrypted data.
Scary...
Except, as most organisations should have realised (ordinary businesses take note!!) that having huge amounts of data doesn't really help you if you have no idea of what you have, what it means and how to actually extract the data you want.
Its worse when you have so much that even running the queries that might extract the right piece of data becomes so complex that you may as well just give up.
Pity the NSA then:
http://www.zdnet.com/article/nsa-whistleblower-overwhelmed-with-data-ineffective/
NSA is so overwhelmed with data, it's no longer effective, says whistleblower
One of the agency's first whistleblowers says the NSA is taking in too much data for it to handle, which can have disastrous -- if not deadly -- consequences.
Its funny but about 2 years ago there was an idea called the "Slow Data Movement" whose aim was to save the World from BigData madness but concentrating on what you actually need...
In fact we've even heard the argument that mass surveillance is no where as effective as "good old fashioned police work".
In fact, it even seems that the recent attacks in Belgium relied upon unencrypted communications ... which should have been easily spotable, unless of course you've got politicians obsessed with the evils of encryption and too much data to even see the weak signals of ordinary, unencrypted data.
Scary...
Friday, 18 March 2016
Short abstract on privacy processes
Any reasonable implementation of privacy requirements can not be made through legal compliance alone. The belief that a software system can be developed without privacy being an integral engineering concept and that a privacy policy is sufficient as requirements or compliance check is at best dangerous for the users, customers and business involved.
While requirements frameworks exist, the specialisation of these into the privacy domain have not been made in such a manner that they unify both the legal and engineering domains. In order to achieve this one must develop terminological or ontological structures to aid communication between these domains, provide a commonly acceptable semantics and a framework by which requirements expressed at different levels of abstractness can be linked together to provide refinement of these in some form. One interesting effect of this is to almost completely remove the terms ‘personal data’ and ‘PII’ from common usage and to force a deeper understanding of the data and information being processed.
Once such a structure is in place and even just partially or sparsely populated this provides a formal framework by which not only requirements can be obtained, their application (or not) be justified and a proper risk analysis made. This has further advantages in that privacy requirements and their potential implementations can be explored through the software development process supporting ideas such as agile methods and ‘DevOps’ rather than being an ‘add-on’ exercise - a privacy impact assessment - inappropriately executed at inappropriate times.
While requirements frameworks exist, the specialisation of these into the privacy domain have not been made in such a manner that they unify both the legal and engineering domains. In order to achieve this one must develop terminological or ontological structures to aid communication between these domains, provide a commonly acceptable semantics and a framework by which requirements expressed at different levels of abstractness can be linked together to provide refinement of these in some form. One interesting effect of this is to almost completely remove the terms ‘personal data’ and ‘PII’ from common usage and to force a deeper understanding of the data and information being processed.
Once such a structure is in place and even just partially or sparsely populated this provides a formal framework by which not only requirements can be obtained, their application (or not) be justified and a proper risk analysis made. This has further advantages in that privacy requirements and their potential implementations can be explored through the software development process supporting ideas such as agile methods and ‘DevOps’ rather than being an ‘add-on’ exercise - a privacy impact assessment - inappropriately executed at inappropriate times.
Thursday, 4 February 2016
Millionaires in Finalnd
I love low-quality targeted advertising...its sort of like watching a bad Sci-Fi B-movie from the 1950s without the mental effort...take this for example
Well I'd certainly like to be rich, but to be honest there aren't too many millionaires here and certainly not many being made by watching some video - and no, I didn't click on the advert....maybe this is why I'm not a millionaire...or maybe I am, but I'm not telling you how*
Now it does get better:
Apart from the slightly suspicious encoding error, it should be an 'ö' and I guess the currency conversion is going to be a bit of pain, yes I too wonder how that housewife makes that sort of money...I wonder where she lives to be honest because at that rate I'm guessing she might be moving from Söderkulla to somewhere nice, such as the Cayman Islands.
A bit of a rough calculation for 1 year:
365 x $1420 - 5% currency exchange fees and 60% top rate of Finnish tax and your potential $550k becomes just under $200k, and most likely an entry in the yearly, public list of top tax payers. If she's not there then I think the above advert just gave a great tip-off to the Finnish Tax Authorities :-)
But it gets better!
Forget that $1420 per day, just use a crazy loophole and another "habit" (I wonder what?) and you could be making a fantastic $6679 PER DAY!!! That's nearly $2.5 million per year or a still respectable $1.4 million after tax, and maybe a visit from the tax authorities again.
Now the cynic in me might think that these are targeted adverts based on my IP address and are possibly not true, and that clicking on suck an advert is a great way to receive some nasty virus...which may or may not be similar to the nasty viruses one could get earning such money through some "habits" ....
Isn't the Internet wonderful...and to think we could have had a base on the Moon by now....
But, this isn't all, anyone interested in semantics will question that $ means...nowhere is it stated US Dollar...so in the best case $2.5 million dollars could mean 2.5 million Zimbabwean dollars, with a total worth of approx $6900 where $ = USD in this case....so our housewife from earlier might be earning as much as 3 Euros per day ... phew!
Well I'd certainly like to be rich, but to be honest there aren't too many millionaires here and certainly not many being made by watching some video - and no, I didn't click on the advert....maybe this is why I'm not a millionaire...or maybe I am, but I'm not telling you how*
Now it does get better:
A bit of a rough calculation for 1 year:
365 x $1420 - 5% currency exchange fees and 60% top rate of Finnish tax and your potential $550k becomes just under $200k, and most likely an entry in the yearly, public list of top tax payers. If she's not there then I think the above advert just gave a great tip-off to the Finnish Tax Authorities :-)
But it gets better!
Forget that $1420 per day, just use a crazy loophole and another "habit" (I wonder what?) and you could be making a fantastic $6679 PER DAY!!! That's nearly $2.5 million per year or a still respectable $1.4 million after tax, and maybe a visit from the tax authorities again.
Now the cynic in me might think that these are targeted adverts based on my IP address and are possibly not true, and that clicking on suck an advert is a great way to receive some nasty virus...which may or may not be similar to the nasty viruses one could get earning such money through some "habits" ....
Isn't the Internet wonderful...and to think we could have had a base on the Moon by now....
But, this isn't all, anyone interested in semantics will question that $ means...nowhere is it stated US Dollar...so in the best case $2.5 million dollars could mean 2.5 million Zimbabwean dollars, with a total worth of approx $6900 where $ = USD in this case....so our housewife from earlier might be earning as much as 3 Euros per day ... phew!
Wednesday, 20 January 2016
DSummit, Stockholm, May 2016
One for the CEOs, CIOs and CxOs of the world. This year DSummit is in Stockholm on 26th-27th May and has an impressive array of speakers and a strong focus on #privacy engineering!
"Disruptology is the art and science behind disruption. We study disruption and its impact on business and society. With a network of change makers, technology moguls and innovation evangelists we assist companies of all sizes with guidance, advisory and resources to become true disruptors. As an non profit academic institution and research foundation, Disruptology is a pioneer of new and disruptive business models, such as the F2W free-to-win model. With a vast network of industry professionals on call, we are able to inject new ways of thinking, working and playing into the DNA of companies throughout the world."
Tickets can be bought here: https://www.tickettailor.com/checkout/view-event/id/38963/chk/1862/ref/ian-oliver
And further details of the event here: http://www.dsummit.net/
Subscribe to:
Posts (Atom)