Privacy vs. Security Do We Have to Choose?

Sol Bermann University Privacy Officer, U-M Michigan Digital Summit 2016

Privacy. The quality or state of being apart from company or observation: freedom from unauthorized intrusion Security. The state of being protected or safe from harm: things done to make people or places safe

Defined

End at the Beginning

Watch you vote?

May I...

See everything you purchased?

May I...

See the websites you visit?

May I...

Know your comings & goings?

May I...

Know who you associate with?

May I...

? ? ?

Is any of that OK?

When? By whom? Under what conditions?

? ? ?

? ? ?

1977. The real danger is the gradual erosion of individual liberties through automation, integration, and interconnection of many small, separate record-keeping systems, each of which alone may seem innocuous, even benevolent, and wholly justifiable. (U. S. Privacy Study Commission)

Sound Familiar

We care about privacy

Privacy Is In The News

History of Privacy

ThenIsNowNowIsThenIsNowNowIsThenIsNowNowIsThenIsNowNowIsThen

Cameras Cellphone cameras, Google Glass, drones

News (periodic): print, radio, TV News (pervasive): social media

Phones Cellphones, tablets

You & your home Google Street View, geo-location (satellite, cars, mobile devices), data-mining, profiling

Disconnected devices Connected devices: Internet of things, wi-fi, wearables, smart phones, thermostats, appliances, cars

Advertising: print, radio, TV Advertising: marketing & behavioral profiling, data collection and resale

Phone book, census, credit agencies

Big Data (used beyond purpose for collection, re-identifying aggregate data, profiling)

Government surveillance: telephone wiretaps, tails

Government surveillance: NSA Internet tapping, location tracking, facial recognition, pervasive data collection, profiling

? ? ?

What is Privacy?

1890. Recent inventions ... call attention to the next step which must be taken for the protection of the person, and for securing to the individual ... the right to be let alone. (Samuel Warren & Louis D. Brandeis, 1890)

What is Privacy?

1967. Privacy is the right of individuals to control, edit, manage, and delete information about themselves, and to decide when, how, and to what extent information is communicated to others. (Alan Westin)

What is Privacy?

1977. Building and maintaining an enduring, intimate relationship is a process of privacy regulation. (Irwin Altman)

What is Privacy?

1999. You have zero privacy anyway. Get over it. (Scott McNealy)

What is Privacy?

2010. People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people—and that social norm [privacy] is just something that has evolved over time. (Mark Zuckerberg)

What is Privacy?

But I have nothing to hide

Why Privacy Matters

VS

1948. There was of course no way of knowing whether you were being watched at any given moment. How often, or on what system...they could plug in your wire whenever they wanted (George Orwell)

We act differently even when we think we are

being observed

What lack of privacy leads to

2015. A desire for Privacy is innate. Surveillance makes us feel like prey, just as it makes the surveillors act like predators. (Bruce Schneier)

Privacy/Surveillance Relationship

Privacy & Surveillance State

Germany

Hitler’s Gestapo

USSR Stalin’s (et al) KGB

East Germany Honecker’s Stasi

Portugal Salazar’s PVDE/PIDE

Spain Franco’s Secret Police

Argentina Junta’s “Dirty War”

Chile Pinochet’s DINA

You have two roles

What this means for you

1. Privacy – uphold liberty; follow laws/regs, best practices when collecting, processing, sharing personal information; respect citizens (golden rule)

2. Security - Protect personal information AND Protect health, safety, welfare of citizens

● Privacy (like free speech) never has been and cannot be an absolute

● Without security, there can be no privacy (applies to cyber security & national security)

One the one hand

In U.S. we have always come to regret when we traded privacy and other civil liberties in the name of “security” ● Japanese internment camps ● McCarthy trails ● FBI watchlists ● Nixon enemies list ● DHS/NSA surveillance programs

On the other hand

2008. The debate isn't security versus privacy. It's liberty versus control. (Bruce Schneier)

False Dichotomy

Surveillance

Is Not

Security

Bottom Line

Do your part

What this means for you

● Be transparent ● Be accountable ● Seek citizen input ● Embrace citizen oversight ● Empower citizens

AND ● Provide for data and citizen security

Remember, you serve the citizens

● Privacy is of value. Period

● Privacy (both as a value and in practice) continues to be stressed by data ubiquity & technology

● Tension between desire for personal privacy versus willingness to give up personal info in return for something of value (including security)

● Fear of “privacy fatigue” and privacy becoming an afterthought or a “luxury good”

Some Parting Thoughts

1985. Computerization is robbing individuals of the ability to monitor and control the ways information about them is used. As organizations...routinely exchange such information, individuals have no way of knowing if the information is inaccurate, obsolete, or otherwise inappropriate. The foundation is being laid for a dossier society, in which computers could be used to infer individuals’ life-styles, habits, whereabouts, and associations from data collected in ordinary consumer transactions. Uncertainty about whether data will remain secure against abuse by those maintaining or tapping it can have a “chilling effect,” causing people to alter their observable activities. (David Chaum)

More Parting Thoughts

● Not how it treats those that conform, but how it treats those that dissent

● Not how secure a society is, but how free it is

● Privacy (in some form and measure) is vital for a vibrant, free, and just society

What is the Measure of a Society