Privacy Maverick

As you may be aware, Congress is considering a bill that would require internet service providers to retain data on their customer’s assigned IP addresses  (as well as name, address, credit card number and a host of other data) for up to 12 months.  Though the bill ostentatiously targets child pornographers, the legislation goes so far beyond that one legislator proposed an amendment to rename the bill “Keep Every American’s Digital Data for Submission to the Federal Government Without a Warrant Act.“


While this bill is horribly privacy invasive, for the obvious reasons, Congress has chosen to accept the familiar bugaboo of child protection as justification enough to impose this burden.  It’s so especially odd given the number of privacy protective laws also being proposed in this Congress. However, such schizophrenic action by Congress or business is by no mean uncommon.  In fact, I would have to say it’s par for the course. Not only is it par for the course for Congress, but most businesses use this approach as well.  Collect more data and then ratchet up security in an attempt protect that data.  


Of course, there is another approach.  The one I’ve been advocating and that was recently picked up recently by none other than Forbes’ Kashmir Hill, is, of course, Privacy By Design.   

Most people’s eyes gloss over when I say I’m a “privacy professional.”  They don’t have the foggiest idea of what I mean.  This is a problem both outside and within the corporate world.  Some jobs are easily identifiable with a single word.  If I say I’m a fireman, for the most part, people can understand what I do for a living.  There may be some aberration, such as if work mostly handling forest fires versus structure fires but in general, the public understand what I do on a daily basis.

When you start talking information technology professional, the confusion begins.  Even simplifying that term into computer professional, people will tend to put you into two camps: someone who programs computers or fixes them.  If they associate you with the latter, you’re now their new best friend to come get rid of that nasty virus.  However, the range of information technology professionals is much broader. You have programmers for sure but also database developers, web developers, driver developers, component programmers, designers (who know graphical interfaces).  You have a host of administrators: network admins, sys admins, database admins, etc.  Then you have the engineers and architects who design the system.  Then the support personell.  Then you start moving into layers of abstraction and there are IT governance folks who develop data policies, auditors who enforce the policy.  The IT world is rich with nuanced professionals, none of whom would consider their job the same as others, yet from the outside they are easily lumped together, “oh you’re a computer guy.”

Apparently the same is true of lawyers.  Some lawyers have a very public persona.  The criminal defense lawyers on TV, the personal injury attorneys on every billboard, this is what the public sees.  They also know you need to go to lawyers for things like divorces and real estate but still tend to lump everybody into either civil law or criminal law.  The truth is lawyers are much more diverse once they develop a specialty really have limited ability to advise on other issue.  More importantly, some laws are so intricate that many corporate lawyers specialize in very narrow niches: Foreign Corrupt Practices, mergers and acquisitions, etc. 

Returning to my issue at hand. I get the question all the time, of people asking me what I do or what I want to do.  My response “I’m in privacy” is clearly unintellible to people outside the field.  Even people who you think might have an inkling of an idea, still seem perplexed that someone could claim such as their professional vocation.  My point of this blog post is really to help myself come up with a simple easly explanation….. an elevator pitch that I can give when confronted with the question.

My girlfriend had a good suggestion.  I actually asked her last night what she thought I did.  She had a better notion than most but still incomplete.  She says she often struggles explaining it to her friends. She suggested a three prong approach: first say what it is, second explain what it does and third give an example.

1. What is the title? “Privacy Architect”

Now I would say even most seasoned privacy professionals would have a hard time understanding what this means.  The vast majority of privacy pros come from a regulatory compliance background, they either don’t have the IT knowledge or just don’t think in terms of building in privacy up front. 

2.  What does a privacy architect do?  “I help companies design their computer systems and business practices with their customers privacy in mind.” 

While this is a really incomplete picture, I think it’s simple enough to convey mostly what I do.  My work may not be limited to computer systems and business practices.  I think about privacy of other stakeholders than customers. This doesn’t really encompass the legal issues at hand, nor the brand building that having a good privacy reputation can bring.

3.  Give an example of what you do. “Say a company wants to start an online bookstore. What books one purchases can reveal very personal interests: medical issues, political positions or financial status. Customers may want to keep such information private. What I do is help design the online store to empower their customers to preserve their privacy while still allowing the business to serve those customers.”

I’d really appreciate anyone’s feedback on this.  Does it capture what I do?  Is it simple and understandable. 

Watch this video…. http://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net.html

Now consider, how can a company help a customer protect themselves against this kind of attack?  Even given the inherent weaknesses of credit cards, consider this option:

The video says that hackers monetize compromised computers by installing key loggers. The hackers then search through the keyed data looking for credit card numbers. “But we can’t do anything if the customer’s computer is compromised!”  B.S.

What’s the solution?  Don’t have your customer enter all the digits of the credit card via their keyboard.  Display an onscreen keypad for entry of the last four digits.  This thwarts the CC thieves and demonstrates to your customers that you are attempting to protect them even on potentially compromised systems.  Simple, easy, effective.

This article describes the continuing problem of banks using social security numbers as identifiers and partial passwords.  It seems the FTC has previously identified the problem of SSNs being utilized as authentication tokens and has even gone so far as to propose legislation to reduce the over-reliance on them in industry.  I would like to point out my simple solution doesn’t require any legislation, simply publish SSNs on the internet as a ubiquitous identifier, thereby reducing their value to identity thieves and as authentication tokens.

I recently acquired the domain privacymaverick.com and I’ve moved my blog to blog.privacymaverick.com.

I’ll be speaking at the Miami KnowledgeNet event on July 14th.  The event will be held from noon to 1:30pm at

LexisNexis Risk Solutions
5000 T-Rex Avenue
Suite 300
Boca Raton, FL 33487

I’ll be talking about Privacy By Design, it’s history, justification, principles and ideas for implementation.  If you’re interested in attending go to the IAPP KnowledgeNet site.

Social Security Numbers have the unenviable position of being both identifiers and passwords.  They are designed to uniquely identify individuals (in the US) but yet are supposed to be secret enough that companies’ attempt to rely on them as passwords, keys to that person’s account.  However, unlike passwords in online systems which are (if proper protection is taken) transmitted and stored as hashes to prevent easedroppers or hackers from learning the password, SSNsare most often transmitted and stored in plain text.  The SSN is usually given to an employee of the company who must be trusted not to reveal it or use it for disallowed purposes.  When one looks that this password is shared amongst many companies, the vulnerability is clear. 

Social security numbers should really only be used as unique identifiers, and then only to correlate accounts and tie an account to a specific individual.  However, at no time should the SSN be used to identify a physical person as the person behind the social security number.  Just because someone knows an SSN does not mean that they should be authorized as the owner of that SSN. 

To push this notion through society, I would like to propose a law that would force companies to stop relying on SSN as proof of identity.  How do we do this? Not by making sanctions and imposing regulations on companies for misuse, but a simply by pubilshing Social Security Numbers and names of the corresponding owners.  The simple feat of maknig this information widely accessible and known to be widely accessible would quickly force companies relying on the false security of the SSN to reengineer their processes not to rely on that false notion.

The recent revelation that Google is applying to allow driverless cars on the road in Nevada combined with the stink over E-Verify (the backdoor National ID attempt) and its collection of drivers license data ala REAL ID got me thinking.  What happens to the identity infrastructure in this country if drivers and necessarily drivers licenses go by the wayside?  It has always been a pet peeve of mine that drivers license have become the defacto identification in our society, because so many people have them and must have them to drive.  Its a classic case of mission creep, where drivers license, which once were solely issued to display that the bearer had a license to drive (i.e. met the minimum standards) but now are used in all sorts of scenarios to verify identity.  In the future it seems, people might not need this ubiquitous item.  Its quite possible that most people may just transition to state issued ID cards, but it is interesting the pontificate on the alternative.

There has been a lot of discussion on privacy lists recently about whether IP addresses, email addresses, etc are PII (personally identifiable information).  Clearly with regards to a specific law, you’d have to reference that law (or the corresponding case law) to make a determination.  In general, though, I’d like to suggest a way of thinking about information in making this determination.  Much of the discussion has revolved around whether the information by itself or in conjunction with other information can “identify” an individual.  Does john.smith@gmail.com identify John Smith and if so, which one? What about butterfish90210@gmail.com? Does a dynamic IP address identify an individual or only when combined with the logs of the ISP?