4 | | This privacy overview is part of a four part series originally developed as part of the 2015 Membership Meeting. |
| 4 | ''This privacy overview is part of a four part series originally developed as part of the 2015 Membership Meeting.'' |
| 5 | |
| 6 | |
| 7 | == What is Privacy? == |
| 8 | |
| 9 | You can find many definitions for the word ''privacy''. A dictionary |
| 10 | will say something like "The state of being private; the state of not |
| 11 | being seen by others." Judge Louis Brandeis called it "the right to |
| 12 | be left alone". Dan Geer called it "having the ability to |
| 13 | misrepresent oneself." The UK's CCTV program used the motto "If |
| 14 | you've got nothing to hide, you've got nothing to fear". I'm not very |
| 15 | fond of these last two: they imply that privacy's usefulness is |
| 16 | limited to people who wish to misrepresent themselves, or having |
| 17 | something to hide. That's simply not the case. |
| 18 | |
| 19 | I'd like to talk about privacy as it relates to communications -- how |
| 20 | we talk and interact with one another. In the physical, face to face |
| 21 | world, this is very easy to understand. If you can a friend are |
| 22 | having a loud roudy conversation on the bus, then the whole bus is |
| 23 | going to hear it. Both of you knew it, and probably didn't care too |
| 24 | much at the time. On the other hand, if you pull your friend aside |
| 25 | into a quiet corner of the room, you're not expecting anyone else to |
| 26 | hear what you're taking about. And if someone is creeping up and |
| 27 | trying to listen, one of you will probably notice. |
| 28 | |
| 29 | Communications in the digital world are very different. Even solo |
| 30 | interactions are very different. For example, people have very |
| 31 | personal relationships with their phones, with video streaming |
| 32 | services, and with internet search engines. Years ago, Netflix and |
| 33 | AOL released large collections of "anonymized" user searches; in both |
| 34 | cases, people were able to de-anonymize some of the data. Google |
| 35 | recently announced that it's been recording and retaining voice |
| 36 | queries. Even if companies don't release this kind of information to |
| 37 | the public, lots of people in the company have access to it. As do |
| 38 | the employees of other organizations they share data with, or sell |
| 39 | data to. Your personal relationship with your phone, or a third party |
| 40 | service probably involves a lot more people than you realize. |
| 41 | |
| 42 | == Risk Management == |
| 43 | |
| 44 | When we get into digital communications, privacy really turns into a |
| 45 | game of information security, and your ability to have some control |
| 46 | over how information about you is used. |
| 47 | |
| 48 | Information security falls under the broad heading of risk management. |
| 49 | Risk management is about as exciting as buying insurance (which itself |
| 50 | is a form of risk management). The basic idea is that we start with |
| 51 | something bad that might happen. Risk management is whatever you do |
| 52 | to prevent that bad thing from happening, or to make it less bad when |
| 53 | it eventually happens. I've already mentioned insurance. A couple of |
| 54 | other examples: |
| 55 | |
| 56 | * locking your door |
| 57 | * wearing a bicycle helment |
| 58 | * looking both ways when you cross the street |
| 59 | |
| 60 | This sort of thing happens on a continuum, and it involves a balancing |
| 61 | act. Having two locks on your front door is safer than having one, |
| 62 | and having fifteen locks on your door is safer than having two. But |
| 63 | who wants to deal with fifteen locks? It really comes down to what |
| 64 | you perceive as a risk, and how much inconvenience you're willing to |
| 65 | tolerate in order to mitigate it. That's security in a nutshell, and |
| 66 | it's different for everyone. |
| 67 | |
| 68 | In terms of communications privacy, what do you guys see as risks? |
| 69 | |
| 70 | == Resources == |
| 71 | |
| 72 | I expect that much of this discussion will be driven by folk's |
| 73 | perceived risks. However, here are some general resources. |
| 74 | |
| 75 | * EFF's surveillance Self-Defense guide. https://ssd.eff.org/ |
| 76 | * PRISM Break. https://prism-break.org/en/ |
| 77 | * Guardian Project. https://guardianproject.info/ |
| 78 | * Email Self-Defense. https://emailselfdefense.fsf.org/ |
| 79 | * A large collection of presentations from the Tor Project. https://media.torproject.org/outreach-material/presentations/ |
| 80 | * [https://gnupg.org/ GnuPG], [http://www.gpg4win.org/ GPG4Win], [https://gpgtools.org/ GPGTools] |
| 81 | |