Privacy Enhancing Technologies
Hopefully over the next few years, software developers, technology companies and the IT industry as a whole will start to take privacy more seriously. We have grown up in the online world with a very naive view of what will happen to our data online. As laid out in the previous post Gov2.0 and Facebook 'Like' Buttons it can be frightening to see how your privacy is abused at a commercial level.
Software and systems need to start being designed with privacy in mind. I attended an interesting meeting the other week which had a talk from Claudia Diaz who is an Assistant Professor from COSIC looking at Privacy Enhancing Technologies (slide here). She talked about ‘Soft Privacy’ where we have to ‘trust’ the holder of our data to protect our privacy, and ‘Hard Privacy’ where we should be providing as little data as possible and use Privacy Enhancing Technologies to protect that data.
This concept is not new, we have been using ‘Privacy Enhancing Technologies’ for hundreds of years. For example in the UK when you come to vote, if there is anything written on the ballot paper (ie a signature) it is invalid, and the vote is made behind a screen. Why? Because if I am trying to rig an election and I am paying £100 per vote, or threatening people with violence, I would like to check which people voted for me. The ‘laws and regulations’ give citizens protection by outlawing vote rigging (soft privacy). But by not allowing any identifying marks on the ballot paper or sight of me completing the ballot paper itself I am protecting peoples privacy (Hard Privacy) even if the legal protection is compromised.
As it was put across in the talk – ‘I can trust you because I do not have to’. If I had to sign the ballot paper I would have to have trust that someone did not abuse the system and inform people of how I voted – which could have recriminations for me. By not signing the paper and not having to show anyone how I voted, I can trust the system because I do not have to – they cannot inform people of how I voted.
When we design IT systems we need to ensure the same protections are in place. Don't assume that it is only in scenarios such as voting where we need to protect privacy - Insurers use social networking sites to identify risky clients. And don't assume that you cannot get the technology either – www.microsoft.com/U-Prove