Tag Archives: privacy

The Security / Privacy Battle

SpyVsSpyEvery time there is some traumatic terrorism event like what just happened in Paris there is a renewed call by governments for better surveillance and security measures. And every time that happens, the advocates of privacy sound a loud warning. What I find most interesting about this back and forth between the two sides is that it’s not events or even public policies that are driving the battle between security and privacy, but technology.

Just during the last decade there has been a number of technologies that have assaulted our privacy – encryption, big data, cloud computing, and advertising spyware. And we are fast approaching new threats from drones and from Internet of Things sensors everywhere.

The real battle between security and privacy happens when we introduce new innovations that can invade our privacy followed by countermeasures against those new technologies. There are plenty of politicians on both sides of the privacy issue who think that creating new laws is the way to protect privacy. But there are no laws that are going to flexible enough to keep up with the new threats we are constantly seeing in the real world.

Consider the traditional privacy laws. There have been wire-tapping laws on the books for decades which are now completely obsolete. The FBI convinced the FCC a few decades ago to create a set of laws called CALEA that gives the FBI the right to subpoena ISPs and get the records of suspected law breakers. ISPs and telcos spend a lot of money to stay compliant with these rules and yet I can’t think of one of my clients that has actually gotten a CALEA request from the FBI. ISPs do often get requests from local law enforcement asking for calling records under older wire-tapping laws, but not a peep out of the CALEA folks.

And this is because those laws were obsolete before the ink was dry on them. The CALEA rules were written not long after we had migrated from dial-up to DSL and there was no such thing as the dark web and disposable cell phones and all of the other ways that serious criminals use to avoid law enforcement.

What typically happens with a new technology is that it gives one side – the police or the bad guys – a temporary advantage. But there is always a technological counterpunch as somebody on the other side figures out how to defeat and neutralize each new technological development.

Edward Snowden showed us that law enforcement sometimes is so desperate for an edge that they collect data illegally in violation of the basic rights granted to US citizens by the fourth amendment. But even that is only a temporary edge. There are now numerous groups developing strategies to counteract widespread government surveillance.

There have been numerous attempts to pass surveillance and security laws starting with the Patriot Act. But industry experts say that most of the laws that try to give the government more power are ineffective, again because technology moves a lot faster than legislative bodies.

So what we see is a cat and mouse game. The NSA spies on us and so companies like Apple develop encryption that makes it hard or impossible for the NSA to gather anything useful. And there are more and more web services that either automatically encrypt or which offer that as an option.

It seems that the privacy advocates are winning the long term fight, and this is because there are ways around almost any tool the government or big business can use to spy on people. I’ve read several articles recently that talk about how even in China people are finding ways to bypass the strict security of the Great Firewall of China. But the fight is a long way from over because there are always going to be tools that come out that can be used to spy on people and there will then be ways to defeat those measures. We are likely to see this battle for decades to come.

Some Regulatory Shorts

FCC_New_LogoAs to be expected our regulators stay busy regulating. Not all of their decisions have widespread impact, but it’s always worth keeping an eye on what’s going on.

WiFi Blocking: The FCC continues to come down on hard on those in the hospitality industry that would stop people from using their own hot spots in or near hotels or other gathering places. You might recall, last year the FCC fined Marriott for blocking access to guests using their cellphones for WiFi. Marriott is one of those chains that charges extra for WiFi and so they were operating jammers that interfered with the ability of a smart phone to act as a hotspot.

The FCC continued with that theme and recently fined M.C. Dean $718,000 for blocking WiFi at the Baltimore Convention Center. They also fined Hilton Worldwide $25,000 for “apparent obstruction of an investigation” in the case. In August the FCC fined Smart City Holdings $750,000 for using technology at 28 convention centers that blocked cellphone and wireless routers from acting as hotspots.

As somebody who travels and who generally finds hotel WiFi to be inadequate, this is a welcome move. But it’s even more so for groups that rent space in a convention center. Some of those locations charge 6 digits for use of a convention center’s WiFi system, and the FCC is telling the hospitality industry that it is never okay to block WiFi.

Do Not Track Requests: The FCC voted earlier this month to not require web sites to honor Do Not Track requests. The group Consumer Watchdog had petitioned the FCC asking them to force companies to honor such requests. Today web sites can voluntarily honor privacy requests, but only a handful of large web sites do so. The group had hoped that since the FCC had elected to regulate privacy practices for ISPs as part of the net neutrality rules that they might carry this forward to the web.

But the FCC declined to make such a ruling. They said that they are not in the business of regulating ‘edge providers’, meaning the companies that offer web content. I keep an eye on privacy and use web sites that don’t track people whenever I can like the Duck Duck Go search engine. But I am leery about the FCC getting into the business of regulating the behavior of web service providers. When you look at some of the consequences of such actions it’s not necessarily good for anybody. Even in England, which we always assume is a lot like us, the government has proscribed a large list of web content that is off limits unless people opt into them. I personally am glad the FCC doesn’t want to cross that line. I think back to all of the wasted effort they spent on the ‘seven dirty words’ on TV and radio and don’t think we need a repeat of that.

The FCC and Privacy. In what seems like an extreme order, the FCC just fined Cox Communications $595,000 for a security breach that exposed the records of 61 customers. That’s almost $10,000 per customer.

This is the first such privacy ruling by the FCC since this was always under the purview of the Federal Trade Commission until the FCC asserted primary responsibility for regulating ISPs as common carriers. I find the order to be puzzling. The breach was apparently due to a hacker. Cox self-reported the breach and said that they had processes in place that found the breach quickly and that limited it from happening to a larger number of customers. To me that sounds like what companies are supposed to do and I’m not sure that any company these days can be completed immune from hackers. I know we won’t know the details of exactly what Cox did wrong, but it doesn’t feel like this is a case where the punishment fits the crime.

One only has compare this to the way that the very massive data breaches have been handled for companies like Target, J.P. Morgan Chase and a number of other banks, and even from several branches of the federal government. None of them got significant fines and the general thinking is that the market itself provides a lot of punishment in lost business and in the cost of dealing with the data breach. The size of the FCC fine seems out of line, and because of that every ISP ought to be reviewing the way you store and protect customer data. You can’t afford not to, and perhaps that is the message the FCC was making.

 

US and Europe at Odds over Privacy

Scales-Of-Justice-12987500-300x300A few weeks ago I wrote about the various battles currently raging that are going to determine the nature of the future Internet. None of these battles are larger than the battle between spying and surveillance, and citizens and countries that want to protect their citizens from being spied upon.

Recently, we’ve seen this battle manifest in several ways. First, countries like Russia and Thailand are headed down a path to create their own fire-walled Internet. Like the Chinese Great Firewall, these networks aim to retain control of all data originating within a country.

But even where the solution is not this dramatic we see the same battle. For instance, Facebook is currently embroiled in this fight in Europe. Facebook might have been singled out in this fight because they already have a bad reputation with European regulators. That reputation is probably deserved since Facebook makes most of their money from their use of customer data.

But this fight is different. The Advocate-General of the European Court of Justice (their equivalent of the Supreme Court) just ruled against Facebook in a ruling that could affect every US Internet company doing business in Europe. The ruling has to do with the ‘safe harbor’ arrangement that has been used as the basis for transferring European customer data back to US servers. The safe harbor rules come from trade rules negotiated between the US and the European Union in 2003. These rules explicitly allow what Facebook (and almost everybody else) is doing with customer data.

The Advocate-General has ruled that the EU was incorrect in negotiating the safe harbor rules. He says that they contradict some of the fundamental laws of the EU including the Charter of Fundamental Rights, the equivalent to our Constitution. He says the safe harbor rules violate the basic rights of citizens to privacy. He explicitly says that this is due to NSA spying, and that by letting Facebook and others take European data out of the country they are making it available to the NSA.

This ruling is still not cast in concrete since the Court of Justice still has to accept or reject the recommendations from the Advocate-General. However, they accept these recommendations most of the time. If this is upheld it is going to create a huge dilemma for the US. Either the NSA will have to back off from looking at data from the US companies, or else US companies won’t be able to bring that data out of Europe.

For companies like Facebook this could be fatal. There are some commercial web services that could be hosted in Europe to operate for Europeans. But social media like Facebook operate by sharing their data with everybody. It would be extremely odd on Facebook if an American couldn’t friend somebody from Europe or perhaps be unable to post pictures of their vacation while they were still in Europe. And this might put a real hitch in American companies like Google and Amazon doing business in Europe.

Such a final ruling would send US and EU negotiators back to the table, but in new negotiations safe harbor rules would no longer be an option. This ruling could bring about a fundamental change in the worldwide web. And this comes at a time when Facebook, of all companies, is talking about bringing the rest of the human race onto the web. But perhaps, as a consequence of NSA and surveillance by other companies, each country or region might end up with a local web, and the worldwide web will be a thing of the past.

A New ‘Do Not Track’ Policy

EFFThe Electronic Frontier Foundation (EFF) released a new version of ‘Do Not Track’ which is supposed to provide stronger protection for Internet users. This is something that consumer advocates have been pushing for a long time, so the question is: what does this new standard provide for the average Internet user?

To confuse matters a bit, the EFF is not the only group working on this issue. The W3C group that controls the standards for most Internet protocols is also working on its own version of Do Not Track. But regardless of which of these efforts becomes the new standard there are serious questions about how effective this might be in the marketplace.

Neither of these groups can impose Do Not Track rules on Internet companies, and so compliance with any new standard is voluntary and one has to wonder who is going to implement it. There is a current Do Not Track standard that very few in the industry are following. For instance, the search engine I normally use, DuckDuckGo, follows the current standard and doesn’t track what people search for on the web. You can count on two hands the other companies that currently publicly agree not to track their users.

This is another one of the big tug-of-wars going on in the industry. There are a lot of people who don’t like the idea of web companies tracking their every move and then selling that data to others. A lot of people find targeted ads creepy and feel like the big web companies are spying on them.

And to a large degree they are. Companies like Google and Facebook and many others make a lot of money from advertising and from selling data about their customers to others. These companies feel that if you come to their site that you have waived privacy for what you do on their platform. Big data is perhaps the biggest money maker on the web, and having flocks of people opt out of being tracked would significantly reduce revenues for a lot of web companies.

Here are a few of the major points of the new policy. Honoring a DNT request means:

  • Not collecting information from the user and not placing tracking cookies except with specific permission;
  • Not retaining details of the interaction with the user except in those few cases where data retention is required by law;
  • Information needed to complete a transaction, such as address or credit card number are only retained until the transaction is complete;
  • Users can be given the option to have web sites remember their data. This might be convenient for places where somebody shops regularly;
  • While these rules aren’t binding, existing law says that if a company says they will not track you they must live up to that commitment.

It will be interesting to see if this new round of Do Not Track gets any more industry buy-in than the last version. There certainly is a significant portion of Internet users who would opt out of being tracked if that was possible. However, there is a good chance that a lot of the industry will only give lip service to any voluntary guidelines. They might not send specific ads to somebody who says they don’t want to be tracked but would likely otherwise track them like everybody else.

It would require a change of law to make this mandatory. There certainly are a number of consumer privacy laws that have been enacted, such as the laws that protect medical records. It probably requires an action by Congress to make these protections mandatory. I find it unlikely that big companies like Facebook and Google and many others are going to voluntarily offer this to users. Offering it costs money and the loss of adverting and data revenues would cause a big hit to the bottom line of these companies. They are already seeing big hits from ad blocking revenues and this could be even a bigger hit.

To some degree consumers who really care about their privacy have options. They can use web sites today that promise to not track them. But almost all ecommerce is tracked and today there are not many places you can go on the web that aren’t tracked. Certainly almost all social media sites are tracked. I know I get anywhere from 50 to 200 tracking cookies on my computer each day from fairly light browsing, so there are a lot of companies out there trying to find out more about us.

The Promise of Hyper-Local Ads

Wi-FiApple Watch is now being promoted as a platform to deliver hyper-local ads. These are ads that are provided to you locally at a given store or other location – essentially instant specials that are provided at the point of shopping or purchase. The advertiser’s dream has always been to use hyper-local ads to get you to pause to look at things you might have otherwise walked past, or even to lure you into a nearby store you might have otherwise gone past.

This is an idea that has been around for many years; advertisers are chomping at the bit to make this work. The problem has always been finding a method of transmitting the ads to people in a way that can be widely accessed and used by enough shoppers to make it worthwhile for the advertisers.

For a long time retailers have been working on ways to make this work using a smartphone. But there are issues with that. The primary issue is that a shopper needs to download an app for each store they shop at in order to participate. This works fine in large department store or a grocery store, but it’s unimaginable to make this work in a busy mall or shopping district with hundreds of stores.

There are also privacy issues. Currently the easiest way to contact strangers would be to send them a text message, but it’s against FCC rules to send unsolicited text messages to people with whom a business doesn’t have a relationship. Plus texts are quite limited in content and looks and don’t have the pizazz that advertisers want.

A lot of stores have customer loyalty programs today that are a tiny start towards a hyper-local ad system. For instance, my wife likes Target and she uses their shopping app. When shopping she can scan any item with her smart phone and the app will tell her more about the product and also offer coupons if there are any. But this is not hyper-local advertising and my wife describes this more like a scavenger hunt where it takes a lot of effort to find the best specials in the store.

There is also the technology platform issue. Apple has assumed that an eventual winner for hyper-local shopping is going to be beacons; they have built the ability to communicate with beacons into all of their devices using the iOS7. Beacons are small devices that will communicate with shoppers using low-power Bluetooth technology. This means that the communications will be very short-range and a person needs to be pretty close to a beacon to get a notice from it.

There are retailers now testing beacon technology. Target, for example, just installed beacons into 50 of their larger metropolitan stores. Even in this first run Target is worried about overwhelming shoppers. They are making a shopper confirm three times that they want the beacon messages and they are then limiting these messages to two times per given store visit. Of course, power shoppers like my wife are probably going to demand many more pings!

With beacons the retailer can provide coupons to a shopper as they shop. And with loyalty shoppers they can provide the coupons that they guess will be most effective based upon that shopper’s past purchasing history. When fully implemented this will be one of the first truly hyper-local ad experiences.

The precautions that Target is taking highlight the risks of hyper-local ads. If they become too overwhelming or annoying then most customers will likely turn them off. And off course, reluctant shopper like me are never going to use this, and so the system is not going to work with everybody in the store. And there are still going to be technical issues. If a person has turned off their Bluetooth then this isn’t going to work.

One of the biggest concerns expressed by a survey of Target shoppers is that they don’t want the store to use the technology to track them when they are in the store. Target says they will not do this, but one has to suspect that they are going to have a hard time not mining that data when it’s lying right in front of them. The more any given store knows about the overall habits of their customers will help them increase sales. But even scarier, the more they know about you personally, the more they can coax you to spend.

Selling Our Personal Data

SpyVsSpyRecently, the CEO of Apple, Tim Cook, has been making speeches in multiple forums that contrasts Apple’s privacy practices to those of other large consumer-based companies like Google, Facebook, and Yahoo. Cook says that his company is selling superior products and that they are not in the business of gathering or selling information about their customers.

Certainly he can’t say that Apple doesn’t use customer information, because they do. I have a Macbook and there are tons of ways that Apple uses my data to make my experience better. If I travel, the Mac will display the right time and local weather, for example. And various Apple software products will get to know me and make customized suggestions for me over time. But Cook’s point is that Apple doesn’t sell that data to others.

Of course, the companies that Cook is comparing himself to do not sell electronics like Apple but rather software. Probably the closest analog to Apple is Samsung and they can’t make the same claim as Apple. Late last year it was discovered that Samsung smart TVs were capable of listening to customer conversations all of the time. It’s not clear that Samsung gathers data directly from its smart phones, but they have chosen Android and one can imagine that part of that arrangement is to let Google gather data from Samsung smartphones.

Companies like Facebook and Google have a hard time not using your data, because that is really the only way they can generate value. It’s wonderful to have millions of loyal users on your platform, but both companies make most of their money from advertising. Certainly Google’s search engine advertising doesn’t require any data from users and that revenue is driven from the companies who want their products to be at the top of the list in a search. But Google and Facebook also sells web advertising, and the name of that game is to know the user in order to direct the most relevant ads to each customer.

I think if using our information stopped with advertising that most people would be fundamentally comfortable with having these companies invade their privacy. I know I find it eerie when I do a Google search and for the next three days I see ads that are related to for something I searched for. But I can personally live with that, because most of the time Google is wasting their time on me and I wasn’t looking to shop. I find it funny that I will look up the latest information about smart cars and then get flooded with car ads (because I exclusively drive Ford trucks and I buy one every twenty years, whether I need a new one or not).

The real rub is that these companies do a lot more than build advertising profiles on us. They know all sorts of other personal data about us and they associate that data with our name. While I am not bothered by getting car ads for vehicles I am never going to buy, I frequently hear about people getting bombarded with ads or even mailings and phone calls about far more personal topics like rehab centers or the latest diabetes treatments. That is going over the line in my opinion.

The invasion of our privacy seems to be going even further. Facebook, for example, is the world leader in facial recognition technology and they are building a huge database of every time you show up in somebody’s picture. They not only know about you, but they are learning where you go and who you associate with. That is a bit unnerving.

But to me the real scary thing is that these companies then sell this data to others. And there is no telling how that data is used. Even should the large companies have some sense of morality and responsibility (and many believe they do not), the companies that buy this data can do anything with it they please. It’s very easy these days to buy a data dump about other people, and that kind of information can be a powerful tool in the hands of an ex-spouse, an employer, or a scammer.

The problem that we all face is that it’s too easy to use the services that watch us. Google has a spectacular set of software products. And for my generation there are a ton of friends and relatives on Facebook. If you don’t want to be spied on you have to make a very conscious effort to wall yourself off from these sorts of data-gathering web activities, and that is hard to do. And no matter what you do online, your ISP or the government might be gathering all of this data anyway.

These large companies sometimes hide behind the fact that they mostly sell ‘metadata’ which is data that has been scrubbed to hide the identify of individuals. But numerous articles point out that with data mining it’s only necessary to know a few facts about you in order to pull out facts about you from metadata files.

We may come to a day when there is massive pushback against these companies that are collecting, using, and selling our personal data. It will probably take a string of tragedies and disasters for this to become a worry for the average person. And if that happens, then either the large companies will stop spying on us or somebody who promises not to will take their place. But it is extremely profitable today for the big companies to spy on people, and until there is more pain than profit from using our data, one has to imagine that this is going to continue.

How We Deal with Surveillance

SpyVsSpyThe fact that governments spy on us has been in the news a lot in the last two years since Edward Snowden revealed the extent of the US spying. It’s not just the US government; similar revelations have come out even in countries like Canada.

The folks at the Pew Research Center asked Americans how the knowledge that they are being watched has changed their behavior. Not surprisingly, a pretty large majority of people have made no changes. But the survey found that some people have changed their behavior, and here are some of the key findings in this survey:

  • 87% of people said that they had heard about the government surveillance. Only 31% said they had heard a lot about it and 56% said they had heard a little about it.
  • 34% of those who were aware of the surveillance had made at least one change to shield or hide their information from the government.
    • 17% changed their privacy settings on social media
    • 15% have used social media less often
    • 15% have begun avoiding apps that want access to their personal data
    • 14% say they are speaking to friends in person rather than communicating online or using the Internet
    • 13% uninstalled apps
    • 13% have edited themselves so as not to use what they consider to be sensitive terms online
  • Those who have made changes tend to be younger than 50 and also to be in the category of those who heard a lot about the surveillance, or who thought that the surveillance was not in the public’s interest.
  • Many people just cut back on using certain applications or have modified the way they use them. 18% did this with email, 17% with search engines, 15% with social media sites, 15% with cellphones, 13% with mobile apps, 13% with text messages, and 9% with landline phones.
  • 25% of people have started using more complex passwords.
  • Most people either do not know about or have not considered using tools that make it harder to track them. The percentages of people in these categories for various anti-surveillance tools include: 68% for search engines that don’t track you, 59% for email encryption software, 74% for browser plug-ins like DoNotTrackMe or Privacy Badger, 74% for proxy servers, and 70% for anonymity software like Tor.

The survey also asked how people feel about government surveillance and the results were mixed. 40% of Americans found it acceptable to monitor other Americans, 54% to monitor citizens of other countries, 60% to monitor leaders of both the US and of other countries, and 82% for monitoring ‘terrorists’.

Of those who are aware of the surveillance, 61% said that they are not confident that surveillance is serving the public interest. Republicans and those leaning Republican were more likely than Democrats to say they are losing confidence in surveillance.

In an interesting divide of opinion, 49% thought that courts were doing a good job of balancing the needs of intelligence against the rights to privacy while 49% thought they were not.

And finally, when asked how people felt about the government looking at their own personal data, 38% were concerned about emails, 39% were concerned about search engine results, 37% were concerned about cellphone usage, 31% were concerned about social media, and 29% were concerned about mobile apps.

I know I personally have cut way back on my viewing of cat videos. After all, I don’t want the government knowing I am a crazy old cat man (which unfortunately might be the case!).

How Much Would You Pay for Privacy?

Keep OutAT&T has started offering gigabit data in Austin to compete with Google fiber and Grande Communications. AT&T has matched Google’s price of $70 per month for a gigabit of bandwidth, but there is a second option—for $29 more per month they will guarantee not to spy on you and record your web browsing.

That claim actually came as a surprise to me, both for the price and for the claim of privacy. If I thought I could really get better privacy I might consider paying $5 more per month, or maybe $10 at the most. But $29? That’s $348 extra dollars per year for AT&T to not spy on you.

I sit and wonder how they came up with that number. That certainly can’t be a ‘make-whole’ number to compensate them for the amount they make for selling your data to others. They certainly get some value from selling advertising rights for the web sites you visit. But from what I know of the industry, it’s hard to think that they could be getting much more than maybe $1 – $2 per customer per month from that. And it’s also hard to believe that if you sign up for this that you still aren’t going to get ads that AT&T makes some money on. Perhaps the ads would be a little less targeted at you, but they are not going to send you to web pages with all blank ad slots.

Perhaps they get a little more by peddling data about you to the companies that are building profiles on everybody. But I also have a hard time seeing a whole lot of value from this for them today. So how did they come up with the $29 monthly fee? It’s almost like they are expecting nobody to buy it and perhaps it is just a marketing ploy to remind people that Google gathers a lot of data about you.

But even after getting over the shock of the price, which seems aimed at attracting nobody, I must ask how effective their claim might be about not recording what you do on the web. The problem is that they are not the only ones watching you, and they have no way to keep others from gathering data on you no matter how much they charge.

If you use the Google search engine then Google is watching you. If you use Bing for search then Microsoft is watching you. And your browsers watch you as well. If you use Chrome, for example, then Google knows every web site you visit. Same thing with Microsoft Explorer and most of the rest of the browsers. There are search engines and browsers that say that they don’t watch you, so if you are the kind of person willing to pay $29 a month to get AT&T to not record you, then you are probably going to also use the alternatives.

And there are lots of other sites that track you and build profiles of who you are. Even if AT&T doesn’t record what you do, if you use any social media sites or lot of other free software services on the web, those companies are learning as much as they can about you.

And then there are tracking cookies. I don’t know about everybody else, but because I read a lot of articles on tech and telecom each day I seem to get about 50 tracking cookies a day on my computer. AT&T’s plan is not going to help you with these, and unless you scrub your computer often you are going to be tracked to some extent.

Even if you do all of those things and pay AT&T,  use alternate search engines and browsers, don’t use social media and scrub your cookies often, you still are going to be tracked. It seems that the NSA is more or less recording everything that passes through major Internet hubs – every email, web search, browsing session.

Finally, even if you pay AT&T to not track you, if a law enforcement agency subpoenas them to track you, they will comply and track you anyway. That’s the law and they have always freely complied with that law.

So I sit here wondering: what do you really get if AT&T doesn’t record your web usage? And honestly, I think you get very little. They are certainly one of the parties on the web who can track you, and as your ISP they see everything. But so do a whole lot of other parties on the web. If you are going to use the web you are going to be tracked and profiled no matter what you do.

As I described in a blog of just a few weeks ago, it’s possible today to extract information about you from big databases using only a few data points. The example that researchers used was how easy it was to identify your credit card purchases out of huge metadata files using only a few seemingly unrelated data points for reference. The fact is, now that companies are using big data techniques to look through web transactions, it’s getting easier and easier to track you and I can see only minor benefits to cutting your ISP out of that process.

So I sit and laugh at anybody willing to shell out $29 per month to AT&T for privacy, because it’s largely a sham. One has to even wonder if they have the ability to not track you, and for that money they might instead just ignore your data when working with big data. I must say, that the AT&T offer is one of the oddest things I have ever seen in our industry. I would love it if one of my readers could show me the value in paying $29 each month to AT&T.

A Path to the Infosphere

Futurama_Comic_S1Eric Schmidt of Google recently made headlines when he said: “The Internet will disappear.” By that he meant that it will become so seamless that it will surround us everywhere. Obviously a lot of things have to happen before we can all move to the ubiquitous infosphere. For instance, as I just covered in another blog, we will need small nonintrusive wearables. Gone will be the fitness trackers and smartwatches and even the cell phones. We’ll instead have to have some small device that is always with us and that can communicate with us both audibly and visually. This could be an earbud or even implanted chip along with some device that can cast images into our retinas, something far less clunky than Google glass.

But aside from better devices, the biggest change is going to have to be in the way the web functions. Gone would be today’s interface with the web through browsers where we interface with one program or one website at a time. The way we work on computers today is too linear and while we may have many programs running, each of them is separate, and we dip into them one at a time.

The wireless world has already shown us a partial path to the future by virtue of having moved to a world of apps rather than URL websites. But apps still suffer from the same problem of being used one at a time, and there is very little linking between apps today. There are apps today that want to dip into other apps to grab existing data, but I normally get the impression that this is more for the benefit of the app company than it is for the user. I constantly run across apps that ask if they can have access to my contacts list on Facebook or LinkedIn and I always say no. Unless it’s some sort of a communications app, these companies are just fishing for more leads to try to sell their product. We don’t need more advertising linking, but functional linking.

There is an attempt in the app world to establish better links between apps. For instance, Google’s App Indexing and Facebook’s App Links are the start of an effort to create what the industry is calling deep linking, which are ways for apps to usefully share data for the benefit of the user. There are a number of other software companies working in this area.

Today, content providers build custom cross-linking libraries to fulfill this function. The cross-linking process makes it possible to move seamlessly from one app to another. But such links are custom-made and are very specific to a small set of apps. The links share data fields so that a customer using one app can be sent to a second app without logging in again and without having to provide basic data about who they are.

But what’s really needed in the long run, if we are going to get to a seamless infosphere, is a software system that automatically allows a user to shift from one app to another without ever having to log in. The whole idea of logging in has to go away. We need apps that can authenticate who we are and that don’t have to ask us basic questions about who we are. So another thing that is needed for a seamless infosphere is some sort of foolproof authentication. Apps need to be able to trust that we are who we say we are.

But the flip side of that is that as users we need to know that apps won’t spy on us and suck out every bit of information about us. When apps can talk to each other without our permission, we need to have some sort of privacy matrix established that defines what we are willing to share and not share. And the apps must follow the rules that each of us establishes. So another thing needed for us to feel safe in the infosphere is some sort of trustworthy privacy rules that all programs we interface with will follow.

One of the early dangers I see from the linking process is that it could become very proprietary. If Google, Facebook, or Apple develops a suite of linked apps that work well together but that don’t link to outside apps, then we will have taken a step backwards and will have undone the intent of the recent net neutrality ruling. That ruling ensures that large ISPs don’t restrict entry of new competitors into the web market. But that ruling does not protect against the large content providers getting so large and ubiquitous that they kill off competitors by locking them out of linked systems. So eventually we are going to need net neutrality rules for content providers.

So we are almost there for a ubiquitous web. All we need are a total migration to apps, better wearable devices, foolproof authentication, better privacy screens to protect our data, rules that allow any app to safely link with others, and net neutrality rules that don’t let any content provider control the infosphere. Come on Silicon Valley. We’re waiting.

Pew Research Privacy Studies

SpyVsSpyPew Research recently took two separate looks at the issue of privacy. First, they conducted a survey to see how the general public in the US feels about on-line privacy. They also polled 2,511 “technology builders, researchers, managers, policymakers, marketers, analysts and those who have been insightful respondents in previous studies.”

Some of the more interesting results of the survey are as follows:

  • 91% of adults agreed that consumers have lost control of how personal information is gathered and used on the Internet.
  • 88% agree that it would be very difficult to remove inaccurate information about themselves online.
  • 80% who use social media are concerned that businesses are accessing what they share.
  • 64% thought the government should do more to monitor on-line advertisers.
  • 61% disagreed with the statement, “I appreciate that online services are more efficient because of the increased access they have to my personal data”.
  • But to show how mixed feelings are about online advertising, 55% agreed with the statement, “I am willing to share some information about myself with companies in order to use online services for free”. There must be people who agreed with this who also disagreed with the previous question.

There were also questions about government spying on Americans:

  • 95% were aware that the NSA is collecting telephone records and online records on everyone.
  • 80% were concerned that the government is monitoring phone calls and monitoring the Internet.
  • Only 36% agreed with the statement, “It is a good thing for society if people believe that someone is keeping an eye on the things they do online”.

People were asked which method of communications they felt most secure using. Following are the percentages of people that felt either somewhat secure or very secure: landlines – 67%; cellphones – 52%; email – 40%; text messages – 39%; IM or chat – 29%; and social media – 16%. These findings correlated well with knowledge of the NSA surveillance – the more somebody knew about the NSA the less secure they felt using communications.

Only 62% of people have ever used a search engine to look up their own name to see what is known about them on the Internet. 47% of people assume that people they meet will look them up. Only 6% of people have set an automatic alert to notify them when their name appears on the web.

People are cautious about posting controversial comments on the internet. 59% have posted using a screen name that people associate with them. 55% have posted using their real name, and 42% have posted anonymously.

24% say that their employer has rules or guidelines about how they are allowed to present themselves online. 11% say that their job requires them to promote themselves through social media or other online tools.

In the poll of the industry experts, only 55% believe that there will be a “secure, popularly accepted and trusted privacy-rights infrastructure by 2025”. The experts almost universally agree that we are living in a period of ubiquitous surveillance.

Many of the experts believe that it is not possible to create an effective privacy rights system. They believe that both government and industry have very little incentive to reverse the already invasive status quo and that they have much to gain from continued monitoring of information.

It’s obvious in looking at these results that people are aware of how ubiquitous surveillance is and that what they say on the Internet is seen by others. Most people are concerned about how the government or businesses view and use their information, and of the consequences of what they post with their employer. Of course, this still leaves me wondering how to explain drunk selfies!