Who's watching now?

With recent news topics covering the “standoff” between the FBI’s ask for access to `the San Bernadino Killers’ phone and Apple seeking to stand up and protect the privacy of its customers with concerns this could quickly become a default ask for all devices, ironically, I am getting a sense of déjà vu from almost 15 years ago when operators were facing the same debate.

15 years ago, governments and their security agencies were asking telecom operators to share their voice and data information for people deemed a security risk or to investigate a person’s activities prior to an event that happened - criminal or otherwise. At that point, the world was up in arms as to what this would mean for personal security or for that matter privacy as  governments were able to track what people were doing and where they were going.

However, over the years this has become a norm and, although not always accepted, a balance has been established where the operators report to the public on how many times they are asked to share information by the relevant government agency. What is interesting here is that this data is quickly becoming irrelevant as we move to digital and start to reduce our use of mobile platforms like traditional voice and SMS. With these traditional platforms, operators have had visibility of the activities of individual’s voice and messaging communications, whilst in our digital world all communications are increasingly moving to IP or Internet based services. This makes it incredibly difficult for operators to keep track, if they can keep track of the information at all.

I recognize that it is not only telecom operators being asked for end user information, but also the over-the- top players like Google, Apple and Facebook among others, and that they report on these regularly to the public. However, we need to recognize that there is increasingly ony one common source when it comes to telecom services, over-the-top services and other applications and that is simply our mobile phone. A little like our wallets used to be with our ID, credit card information, loyalty cards, receipts etc, with all of this now digital it is the mobile phone, which will increasingly become the centre of security discussions.

It is therefore not surprising that in recent surveys when people are asked what they would be most worried to lose the “mobile phone” is becoming increasingly prevalent[1], versus a decade ago when it was their wallet. The simple reason for this being we store more of our lives in our phones and online that anywhere else these days. Government agencies can approach credit card companies or operators and even online providers to ask for data about an individual, but the one area they are still trying to gain access to remains the phone. The documents, photos, message exchanges all have a common source instead of trying to debate access rights with all of the individual platforms.

I raise this because at some point the “national security” card will get played by government agencies and businesses could end up being forced to comply, similarly with what telecom operators have been through already. I would like to suggest to these handset manufacturers and over-the-top providers to start collaborating together about how they can protect the majority and isolate any handset access to be limited to individual cases. Perhaps there is a unique code that is created based on mutual compliance between the vendor and a government agency for an individual handset, that is to say avoiding sharing access to all phones through a generic override code or similar, which governments could then gain access to whenever they should so choose. In combination with this, then provide visibility to the public as to how many devices the government agency requested access to and how many devices they were given access to. Now this is just a suggestion and the important point here is for the digital community to think through a proactive approach of how they want to engage government agencies rather than being forced to comply with some all-encompassing banner of national security.

Our world continues to change and we need to remember that our lives, which were once paper-based, followed by analog and mobile, are now quite simply digital. Combine this with many governments that continue to fear what they don’t understand, the result is raising concerns on information that they believe exists, but are unable to see or control. In a digital world, where the data we create and store is growing exponentially every day, of course it is impossible to track absolutely everything. However, perception can quickly become reality, as governments and their associated agencies will continue to want to gain further visibility of our digital lives. So, we either act proactively and educate through defining an engagement model which protects the majority of people and addresses data sharing when only absolutely critical for the protection of society, or digital businesses will rapidly become the victims after a few cases under the banner of “National Security” become common place.

I appreciate this is a fine balance and many people will be unhappy with the idea of giving up privacy of our personal items, some will say this must be defended at all costs, but there are precedents already and I fear simply defending will result in a outcome none of us are happy with. I for one would rather know there is an understanding between digital providers and governments as to how this will be managed in the future before it becomes a case of turning on my phone or tablet and asking myself the question “Who’s watching me now?”

---

[1] http://blog.zixcorp.com/2014/09/survey-says-individuals-would-rather-lose-wallet-than-mobile-device/

Are we ready for Government 3.0?

I always enjoy writing about what I am seeing in our increasingly technology influenced world. I am sure you would agree that some of the things are exciting and have improved our way of life while others a little less so. This blog explores a subject that urgently needs to be examined and I believe, action needs to be taken, before there becomes a gaping hole in the way we live our lives.  I know dramatic, but read on.

As our world becomes more “technologically digital”, the role of government needs to evolve. Of course some of you will say governments are already on that journey, you only have to look at their efforts to have twitter accounts or even a Facebook page (yes they exist and some are quite scary!) to see they are at least trying!  OK fine, I’ll give you that, they are evolving.  But let’s call this “Government 2.0” and define it as: “governments providing online services, as well as access to, information”. What they really need though, is to evolve to the next stage, in the digital world and begin to understand (and hopefully take action) there will be laws that need to be either written or rewritten to support this evolution. Easier said than done, right?

Think for a moment about how quickly we see new innovation compared to what it was 10 or 20 years ago.  Today the rate of technological change means that governments are struggling to keep up. Ultimately this has led to, or will eventually lead to, governments establishing new ministries (state departments) focused on technology. Now, I am not talking about evolving a telecom regulator, I am referring to the need for dedicated ministries (not a shared government portfolio) focused on protecting businesses, people and even government from digital conflicts or disasters. This requires a rethink of existing laws, policies, education and state run programs. Admittedly, some governments have started down this path, but think about the Secretary of State, or the Secretary for National Security, I believe it is time to introduce the Secretary of Technology as a core government department to address the broader role Technology is playing in our daily lives today.

Here’s a thought for you - at the rate of change, to our digital world, we are led by world leaders, Supreme Court judges and others who have not been born during the digital age – not a bad thing but does place them at a disadvantage.  Also bear in mind that governments have attempted to influence the digital world on their terms by either blocking out online information, ignoring it, or feebly attempting to engage through casual posts, etc. only to become very upset that someone has the audacity to respond to something they have posted negatively, as if their view is beyond repute (?). Now I want you to consider a Google vs. Apple court case going to the Supreme Court in the US for resolution. How do you think this will play out?

Trust me when I say that my aim here is NOT politics.  I have no political stance other than to have you, as my reader, appreciate that we do need to evolve our thinking. In fact, I think we need Governments to evolve to a 3.0 operating environment similar in a way that we now see the web moving into a Web 3.0 iteration. Consider for a moment the briefings that government panels have on natural resource availability, the environment, national security, etc.  Shouldn’t there be one for technology updates? Our technological world is evolving in months now not years, and soon I expect that will be weeks. Consider thumb print technology identification, commercial air drones, self driving cars, etc. all of which are already and will quickly become common place. Do our air and road laws need to change? Does Personal security need to be driven more by governments or global organizations to ensure standards for personal devices?

Don’t get me wrong, governments are attempting at different levels to stay ahead of this but, as an example, do you think blocking an IP address to protect citizens from inappropriate content is enough? Should people have the choice to have content removed if they don’t like it? Or chase down that disruptive influence? Think about recent government interventions when they have simply “disconnected” the web…really?  We all know astute web users who can find alternative ways to stay in touch with the outside world, through satellite, mobile phone, remote vpn’s, etc.

Now, it is not all doom and gloom. I have been impressed (scary but true) with the Californian state government empowering individuals to request their social media presence be deleted when they reach 18; or in Europe where the European Union has legalized the right to request that search results be removed by those who perceive their privacy has been or will be breached. Lastly the growing debate around Data Sovereignty is seeing some exciting discussions led by governments as to hat policies and laws are now required. Of course these are great steps, but are we just painting over the cracks. There is a bigger issue forming and that is the need for awareness and education. This is going to be critical if we are all going to live in this digital world. Would we need the Californian law if our children and even us, as adults for that matter, were taught the power of the net and the responsibilities for self that go with it?

We need to educate the public and create the appropriate laws for things like:  stalking someone through the web.  Does this have the same legal implications as it does in the real world?  In both cases it certainly has the same damaging emotional toll on the victim.  How about defamation? This is something we are familiar with in print media, but it is more so now on the web than ever before – especially in Social media circles. What if children and adults understood that all acts online were actually treated in the same way as if they were in the real world? (Imagine having to ask permission from your friends each time you wanted to share something of theirs on the web … look out Facebook!)

I do hope this has given you some food for thought and I hope that there are some government types or thought leader types out there who will contribute to this discussion.  I would love to hear about a government who has formed a Technology Ministry or department that is able to consider the rapid evolution of technology, the increasing role it has in our daily lives and the need to protect and educate everyone on what is and isn’t appropriate. Of course some will say the web is an open place and should be self regulated, however we must always bear in mind not everyone has the same level of technology understanding and education.  To ensure the web is a part of everyone’s life, we need to be able to provide people with the same level of safety and self awareness they have come to know in the real world.  I strongly believe governments and other such institutions need to evolve hence it is not a question of if but more how long we will have to wait for Government 3.0.

The reality of privacy

Recently I had the exciting opportunity to meet Retired General Hayden, the former head of the National Security Agency (NSA) and the Central Intelligence Agency (CIA). He was discussing some of the trends he is seeing, as well as, the global developments that are taking place with regards to security. There were a lot of questions from the audience regarding privacy and espionage; whether state/governments or corporations were responsible; in addition to a discussion around understanding the evolution towards cyber security. Ultimately, an interesting discussion, however I left the event asking myself one simple question – “Who is now responsible for our privacy?”

 In the good ole’ days, before the time of the Internet and social media and “cloud services”, we were confident that our governments could and were protecting our privacy, whether that was our home address, phone number, or banking details. All of this information was under strict government policies to ensure a countries citizens were protected.  Of course, in many of these instances, we had to opt in, i.e. to remove our phone number from the directory or to ensure our address didn’t appear in the phone book.  But, it was definitely a simpler time and one in which we felt secure in the geographic boundaries that our country protected.

 Fast forward back to today and oh how the world has changed. Our home phone and home address have become the least of our concerns as our online identities are increasingly coming under threat. The knowledge that is available on each of us today is like nothing we have ever seen - your credit card details, your email address, your social media contacts and even what you store in the cloud.  All of this information is now worth much more than our home phone number ever was.

 It is interesting then that the responsibility of our Privacy is moving away from our respective governments and into the hands of local and global corporations.  When we contemplate what that means for each of us we may feel a shiver of fear or doubt, I know I did. Consider for a moment your purchases online or simple sharing of your hobby’s or interests with your friends in social media gatherings… Where does that data go?  Who sees it? Do you use a tablet or smart phone - guess where you’re phone numbers and any personal data is backed up? Certainly your local government has no involvement in the storage and safe keeping of this data.   So, at what point did we start relying on corporations – or in many cases “Over The Top” providers – to ensure our privacy and protect our identities? What do you think happens to that data?  Where does it go?  Who can see it?  What can they do with it?  What will they do with it?  I could go on, but I think you get the point.

 I am not sure about you, but I don’t recall being provided a location as to where all of this information was going, or being assured it was even remaining in my country of origin…  We need to remind ourselves that these are businesses, not governments.  There has been no signing of a memorandum between our governments and these businesses to officially hand over responsibility and accountability for the maintaining of our privacy.  Therefore, there is no assurance that any of our data is not being used to create profiles or not being shared with others – ever heard of people’s photo’s being hijacked for other uses? 

 I recently shared with a group of people the fact that it is easy to find out a whole raft of information about someone’s profile.  They were a little surprised at the ease with which I could get the data and one of them said that is why he doesn’t have an online presence – well at least one that he wasn’t aware of! These online businesses we are now relying on to protect our privacy, are in fact providing some privacy services (some of these we even pay for) however, you will actually find that many of them, in their fine print, inform you they are not responsible for your data and if this information is stolen or “lost” they will attempt to retrieve it but cannot promise anything.

 There have been some interesting cases recently where regulatory bodies have attempted to reign in these businesses, either in terms of how they are using our information, or how they were trying to access more.  But ultimately, what do you do when that business operates on a global scale? Given today’s environment, I am not surprised that we are hearing more and more about governments trying to tap into the Internet to listen and read what is going on. As I am sure you all know, we are really no longer sending letters via post office or making fixed line phone calls, in fact almost everything we use in terms of communications is somehow connected to the Internet.

 Interestingly, one business has recently been talking about the “connectedness of everything”, where we expect there to be some 50 billion devices connected to the “internet” in the next 5-7 years. Consider for a moment, 50 billion devices, which would include your car, refrigerator, TV, home security, washing machine, even our children (this actually happens today where a Sim card, combined with GPS, is used to track a child’s movements).  Do we really think all of this data will simply go onto a storage device in our homes? Of course not! Many of these devices being connected to the Internet will be incredibly useful to us.  Just think about it… knowing what to buy at the supermarket when you have forgotten your list or knowing when your car needs service –without worrying that something might break before you service or repair it. So, with the convenience and help that all of these devices can bring us, the concern still remains - what else would this data be used for?  Where will it go?  Who will see it?  What will they do with it?

 This is where I come back to the original question, who is responsible for our privacy? Well ultimately we are.  We need to ensure we are always checking the policy of the online providers we are using and understand what the fine print means. We need to ensure we are lobbying regulatory bodies and governments to ensure they only issue business licenses for online services to those providing clarity on what our data is used for and more importantly, for those who are intending to share our data that they MUST have an “opt-in” clause so we know what we are getting ourselves into. I don’t know exactly when governments became no longer responsible for our privacy, but ultimately we need to be aware of what we are signing up to and using the Internet for.

 Now some of you will be thinking – ok Nathan, so what are you saying turn off the Internet and resort back to mailing letters and using the landline phone for communication? Not at all! We are already far down the path to an Internet enabled world, and there is not much we can do about that. What I am saying though, is that we need to be aware of the risks, understand what we are signing up for, read the fine print and always think about what we are posting online or sharing with our online communities.  At the end of the day, we are now responsible for how we interact with our online world more so than ever before, and we need to ensure we do not assume that someone will protect our privacy or our governments will come riding in on white horses to save the day.

Our information has moved online and we must define our own individual policies.  We choose how to interact with “the net”.  We protect ourselves.  This is the new reality of privacy.