Should we expect to keep communication private in the digital age? Can you have a debate on privacy without mentioning Orwell and 1984 or Bentham's Panopticon? You can certainly try, which is just what our contributors did this week, when they went head to head on the motion: In the digital age, we should not expect our communications to remain private. I kicked off proceedings, pointing out …
I repeat my comment I made on Monday's article. We shouldn't expect it, we should require it.
As regards a company mailbox the employee might well not expect confidentiality on traffic there. The company, however, will need security against third parties.
We take it for granted that snail mail in a sealed envelope will be delivered unopened other than with the sanction of a court warrant. There is nothing new about the idea of secure communication. It's insecure communication that's a novelty. Mass surveillance comes under the heading of just because you can do something it doesn't necessarily make it a good idea.
I'm about to prove it can be done, but some fundamentals MUST be addressed, not in the least applicable laws.
You are, however, forgetting a tiny detail (which I didn't throw into the mix due to lack of time):
privacy is not a binary value (well, IMHO).
Managing privacy starts with an assessment of how safe you want to be. The reason that it's variable is because both security and law are to a degree subject to risk analysis and weighing effort/cost/resources versus outcome.
Next comes then indeed how you're going to deploy the required resources and how competent the people are that do this for you and herein lies the rub: you need a blend of skills. Privacy is NOT just a security matter - even usability matters.
Last but not least, it helps having worked for "the other side" as it significantly ups the odds that you can get to a decent place. But, as said before, the fact that it takes resources to protect what ought to be your right gives a hint that it ain't going to be for free.
It also means you're heading into an almighty but interesting fight and when it comes to that, I'm definitely game..
Post mortem, I have to admit that I did not vote in this debate mainly because I was not able to decide what the argument really meant. Let me explain:
Disregarding the intro 'in the digital age' and rephrasing the double negative, I still am not sure whether the phrase 'we should not expect our communications to remain private' is 100% equivalent to 'we should expect our communications to not remain private'.
In addition, I am not sure I understand who mandates what I "should" expect and what not. In my book 'expectations' imply the existence of some vague unwritten social conventions and/or implied rules, that is an informal etiquette that is left to discretion of the communications platform(s). But again, I am not a native speaker and I may misunderstand expressions like "we should expect", "we are supposed to", "we are expected to".
Finally, what does the verb "remain" suggest? That comms should be private even after a court order? Even after a nuclear holocaust? Even if I wave my hands and scream 'help, my privacy and my UN rights are being invaded, #metoo'?
My position is that I am allowed to legally DEMAND my communications to remain private only if I pay for them. When I'm using free services (event govt ones) I fully acknowledge that I am the product and therefore am not entitled to expect anything at all - regardless of the existence of any fine print saying so. Therefore, my version of the argument is that "In the digital age, the privacy of communications should be assumed compromised, except when it's not" and I'm afraid it cannot be translated into a 'yes' or 'no' vote in the specific Reg debate.
Now that we know that 67% of respondents voted 'against', I would welcome some ELI5 explanations from them, in the hope they can shed some light to what they think they voted against and what their precise position is.
"When I'm using free services (event govt ones)"
There's no such thing as a free government service. Our taxes pay for that, therefore treating it as akin to a free email service like Yahoo! is disingenuous. Moreso, the sort of information that one typically provides to government services (like Covid test positive declaration (health service), details of earnings (tax office), all many of things (social services), right down to what books you take out from the local library) are things that you are often obliged to share, therefore an expected level of privacy should be required. Government services are not like freebie email at all. Never think otherwise, or somebody will get the idea that it's perfectly acceptable to sell your barely anonymised data to the highest bidder.....
"Taxes don’t pay for anything. ...
You might want to read up on something called Modern Monetary Theory (MMT) which is kind of in accordance with your thinking. https://www.businessinsider.com/modern-monetary-theory
Do I agree with MMT? Nope. I think that if anything, it crazier than the right wing notion that if we just abolish all taxes, we will (based on the appropriately named Laffer Curve) prosper beyond our wildest dreams.
Ah you are one of those money is created by "wealth creators" out of nowhere people.
Given how often any government runs a surplus or even break even how on earth do you think taxes actually pay for government spending?
In the UK council tax pays for council services yes (if you ignore the ever diminishing central grant), but national governments? No, not a chance.
Yes, taxes do pay for things. Some governments do not have the ability to create money. For example, those countries that use someone else's currency because they probably failed when running their own. Many countries do have the ability to create money, but you can check whether they did to pay the bills. Usually, they didn't; when they didn't have enough tax revenue to pay for something, they borrowed money that already existed from someone else rather than creating new money for it. Governments that start printing money to pay their bills directly often find it hurts them, which is why many governments limit the use of monetary creation to a less political body.
Upvoted because I also didn't vote because I couldn't really figure out what was being asked.
If the issue is whether everyone should attempt to keep personal information about others private, I think the answer is YES. With rare exceptions, data the originator wants to be public, or data with an overiding public interest (e.g. contact tracing info for a dangerous disease) backed by reasonable due process, they should.
If the issue is should we personally expect information entrusted to a public media to remain secret forever. The answer is clearly NO. Even today's state of the art encryption is tomorrow's easily readable text or viewable picture. And even today, at some point, the text/image/whatever is surely going to end up in human comprehensible form. Every now and then, it'll get picked off there.
" what their precise position is."
Private communications and personal data, whether digital or not, should remain private, or shared only with explicit consent. Users need to be clearly informed (in non-technical, non-legal jargon) of how their data is used, with whom its shared, how long its kept. Directors / c-level execs of data controllers abusing this should be personally and jointly liable together with the legal entity for any infractions.
The largest ambiguity I see is with the word "expect". Expect can mean one of two things in this context, and I voted based on my own decision as to which it should be as well as the annoyingly defeatist arguments put forth by those arguing for the motion.
One definition is basically "believe to be likely", as in "I expect the sun to emit light". On that basis, I expect some privacy but depending heavily on what data is stored where. I expect privacy on my local equipment with encryption applied. I don't expect privacy with Facebook. Given the actions I take to protect myself, it's fair to say that I don't expect privacy to be given to me so I must work to take it. However, the people arguing for the motion didn't just keep it there. They first claimed that privacy was basically impossible, which it is not. They then blamed the lack of privacy on me and others when we are not at fault. On that basis, I could not vote on their side.
The second definition, which is the one I used, is "believe that a convention, social or legal, exists". For example, "I expect not to be murdered on my walk to work". It is possible for me to be killed on my commute. I don't have an expectation in the first sense that it is impossible for that to happen, but I understand that, if it did, society would not support it. It would be seen as a morally wrong act and considered unusual. On that basis, I do expect privacy. It is a right that has been generally recognized to exist and is supported by legislation. The exactness of the legislation and the degree to which it is enforced varies dramatically between countries, but all democratic governments at least pay lip service to privacy being protected in law. Even many dictatorships lie about it. I have the right to privacy. I expect that right to be upheld. If someone tries to remove the stated protections, I will be angry with them, and when someone ignores those protections, I am angry and may seek to defend my right. That is the expectation I have in this matter, so I voted against the motion.
"I have the right to privacy. I expect that right to be upheld."
And I'm cynical enough to NOT expect that my right to privacy will be upheld, at least not forever. Those who are holding/transferring my data will always pit the benefits of maintaining my privacy against sharing/selling that data. This cost-benefit analysis will shift over time, and probably go against my "expectation" at some point, my "rights" be damned. At that point, a part of my data is no longer private, no matter the recourse.
Doesn't matter if it's digital or not. I could use only my typewriter and hand-carry (no post) any data directly to a recipient, and I still have no guarantee they won't share/sell that physical document with ink-imprinted information instead of securely storing it or shredding it. Once it's in their hands, tough.
Thus, I didn't vote "against".
But I *want* to expect privacy, upheld, forever. Obviously, it's the ideal we all share. So I couldn't bring myself to vote "for" and just didn't vote.
is that there ain't no such thing...
All there are are those arrangements that those who have power over you permit.
It all sounds very fine and dandy to have universal declaration of human rights - and even courts to enforce it - but as a general case the enforcement comes after the offense. It's no good my having a right to life if some bastard's murdered me; and it's no good having a right to privacy if some scumbag has doxed me all over the internet for some upset, real or imagined, or just because they can.
Rights - such as they are - are only enforced at governmental level, and seem to be comprehensively ignored by both Johnny in the street and multi-billion dollar companies.
Exactly, I would go even further and suggest that there are no "Human Rights" at all, only social privileges that are given to you by society (and, by extension, those in control of it) which can easily be removed or ignored if required.
No digital content is private, ever. Any attempt to regulate some way by which privacy can be enforced is naive at best and actively misleading at worst. This should be the common understanding educated into children and reinforced to adults - no privacy exists or should be expected to exist in any digital format or anything which has an in-road to digital forms (CCTV observed actions, conversations overheard by your robot butler, movements of your connected car etc etc).
Live your life assuming this is true.
The fundamental problem is that of traceable evidence. If a letter is steamed open, you might be able to tell. Once upon a time the most you could expect is a photocopy or photograph. If your phone was tapped, it sometimes added interference, and again, there would be a tape spool that the recording lived upon.
Now? Now if a person sends a dick pic to their partner, it's absolutely possible to send the original file (not a copy of the picture but the actual picture itself) to everybody in the company they work for as well as dumping it on social media for global consumption, and the first the person would know is when others start mocking them.
Likewise voice recordings can now not only happen in real-time but can be analysed for certain keywords (so long as the system can understand the accent - don't try saying eleven if you're Scottish) as the conversation is happening, and this information can be sent along with a copy of the recording to places in different continents. All completely unknown to you.
Give me the average person's computer and it's a mere draggy-droppy to dump their entire photo album onto a harddisc. Or to place something incriminating into their photos. And now? People aren't keeping their photos on their computers, they're stuffing them who knows where in "the cloud". Photo services have been hacked, and will be again.
Exact binary identical copies of things are easy now. It's what makes the internet work. But this ability can be abused and used against us just as easily as we use it for ourselves.
So it's wise indeed to assume that nothing in digital form is private, no matter how a service may make assurances to the contrary.
My experience of rights (as a European citizen and then not) is that rights aren't worth the paper they're printed upon. All the matters is if anybody is willing to stand up and defend those rights. And, clearly, that can be harder and more troublesome than conveniently turning a blind eye.
I can see a lot of eye turning going on in tech. Thank god for Max Schrems.
Indeed. I used to be a European citizen with all the rights that went with that, and then suddenly they all went away... Some of them have returned since I timed my move to Germany correctly, but wouldn't have, had I delayed; some don't appear to have any chance of returning (for example, prior to Brexit I could have dual UK/German citizenship after five years residency in Germany: now I must wait eight years, and give up my UK citizenship).
@Neil_Barnes
Of course there are "human rights"!! But in many, maybe most, discussions about "human rights" the two sides of rights are NEVER mentioned:
(1) The right conferred on the person or organisation
(2) The responsibility which the person or organisation accepts in return
Examples:
(3) The right to vote and the matching responsibility TO ACTUALLY VOTE
(4) The rights associated with citizenship and the matching responsibility TO PAY REQUIRED TAXES
(5) The right to drive a vehicle and the matching responsibility TO OBEY THE RULES OF THE ROAD
But I notice that although the rights are widely discussed, the obligations are widely ignored. So much for social responsibility.
And in the case of "the right to privacy"....well it seems to me that this "right" is much more restricted than the others mentioned above. Particularly in matters affecting the wider public, such as health and taxes. And that means that the matching responsibilities are probably more restricted too.......
......hence the debate!
Point A, I have exactly zero right to vote. Too long out of the UK, not French, and no longer European. I fully understand that voting comes with being a citizen, so no complaints with France. But since I cannot vote those useless bastards in Westminster out, I do not consider myself to need to uphold any obligation required of British citizenship. It's a two way street, guys.
Point B, I don't have citizenship here but I pay taxes. And I'm in the social system (Sécu). And employed. Reality is a little more complicated than citizen = taxes.
Point C, fair enough, but a lot of that is for basic safety of yourself and others. You can apply the exact same logic to guns, flying, and other activities and pursuits that carry a degree of danger. Dad dancing in the bedroom doesn't have rules or require a licence. Pirouetting around a mountain in a glider does. Ditto using a fork lift. Etc.
Now let's look at the responsibility side.
Point A is a tricky one. I personally believe that if you have the right to vote, you should also have the right to choose not to do so. It seems to be that there is no benefit to having an enforced requirement to go and vote. Somebody who is disinterested or thinks that nobody is worthy of a vote is likely to either tick the first name on the list or just pick one randomly, which will skew the final result. While it is possible to carry an election with only a quarter of the electorate voting for a party (as happens in the UK, and is about how many brought us "the democratic will of the people"), there is something to be gained from knowing not only how many votes got them in power but also how many simply didn't engage.
Point B. Generally speaking, it's the little guy that pays taxes. The richer you are, the more loopholes. Plus, my understanding is that taxes are paid according to primary residence. That's why I pay taxes in France and not the UK, and why I guy I knew who worked on cargo ships paid no taxes (was out at sea nine months of the year), despite us both being British. An anomaly there is the American tax regime, but they run to the beat of their own drum...
And point C. As mentioned above, things that could potentially injure or kill others tend to need training and licences. For public safety as well as safety of yourself. Imagine what the morning commute would be like if the roads were a free-for-all.
You could move to a more open minded country. Here in New Zealand, I've been voting for as long as I've been a resident, regardless of citizenship.
I've been paying taxes even longer than that. And getting all the social benefits that they pay for.
The trouble with "not voting" is that it doesn't send any coherent signal at all. Is there value in knowing how many chose not to vote? What for? - I mean, what exactly do you propose to do with that information? And how do you distinguish between "didn't vote because hated all parties or candidates", "didn't understand issues", "didn't care", "didn't get the chance because of work or life", or simply "didn't know how"?
"The trouble with "not voting" is that it doesn't send any coherent signal at all."
It isn't meant to. Some people may vote for each of the reasons you've mentioned. That is usually their choice, and if they do, I support them. Here's what I think of each option:
"didn't vote because hated all parties or candidates": This is a choice that makes sense to me. I would prefer people not be compelled to vote for someone they dislike and to refrain from voting to indicate this.
"didn't understand issues", "didn't care": In this case, I'm fully in favor. If you don't know or care about the election, then don't vote. If people who don't care have to vote anyway, you're likely to get random votes or votes on a weird basis. This doesn't mean that people need to do anything to earn the right to vote, but if they on their own decide they don't care, then I'd prefer they not vote.
"didn't get the chance because of work or life": This is not an issue with compulsory or voluntary voting. It's an issue with the way the election is run. The solution isn't to force people to vote, but to make it easy to vote. Check how many people wanted to vote and couldn't, and figure out what can be done to make that possible.
"didn't know how": Similar to the last one. Provide more information in more places.
Everyone in the UK should be forced to vote (in national elections as a minimum), as part of their duty as a citizen of society, in the same way that they're legally required to enlist on the Electoral Roll, with enforced fines for the non compliant (perhaps based on a percentage of paper wealth, as an incentive and revenue generator).
Combined with this, the ballot papers at every election should include a "None of the above" option.
This way, the winners of the "democracy" battle would have to justify their so-called mandates.
I agree partway with this concept, but with differences:
- every ballot paper should contain 'none of the above' and if that's the majority, that's who wins.
- voting is a privilege but should not be be a requirement
- a non-vote is automatically a vote for 'none of the above'
The change is from 'can't be bothered' = accept the status quo to 'can't be bothered' = voting against everything. It strikes me as hard to defend a system as democratic when a simple majority of those voting, rather than a simple majority of the voter pool, gets the win. At least in my system there is scope to complain.
I wonder what would happen if they held an election and nobody came?
You have rights mixed up with privileges and you also have some factual errors. Rights are things you get automatically and it usually has a high bar or is forbidden to remove them. Privileges are things you earn and can usually be taken more easily. Let's take each of your points in turn.
"The right to vote and the matching responsibility TO ACTUALLY VOTE"
In most countries, there is no such responsibility. Some countries make it compulsory, but such countries are in the minority. It is entirely possible that you have the right and no responsibility to exercise it. In my opinion, this is the correct approach.
"The rights associated with citizenship and the matching responsibility TO PAY REQUIRED TAXES"
These are disconnected. Citizenship rights and tax responsibilities are separate things. You can lack the rights and have the responsibilities if you live or earn in a country of which you're not a citizen. You can have the rights and lack the responsibilities if you live outside the country of citizenship and earn no income there. Each case depends on the laws of that country, but they are not matching as you state.
"The right to drive a vehicle and the matching responsibility TO OBEY THE RULES OF THE ROAD"
In most countries, you don't have a right to drive a vehicle. You earn the privilege to drive a vehicle by passing a safety test and getting a license to do so. Those who cannot drive safely don't get the privilege or have it taken off them.
Like all other rights, the right to privacy is restricted in a number of ways. However, in most countries, it is acknowledged as a right not a privilege and therefore is more protected. Government's frequently fail to follow their own laws requiring that protection, but such laws are often present.
The fact that human rights are not respected ny multiple actors and agencies does not mean that you should write them off.
Human rights ought to be innate, individually, as well as within the state and society and the simplest way to determine whether or not your rights are being maintained or eroded, is to have them written down.
Having your basic rights documented may not protect them but it provides a benchmark that enables one to see to what level your rights have eroded or maintained.
Simply announcing that rights no longer exist is defeatist and falling directly into the hands of those who oppose the ability of society and the individual to exercise their rights.
I am a boomer, I grew up with the notion that my parent's generation had sacrificed and risked millions of lives to defend basic human rights and I have no plans to lose any rights I have lightly.
There's two teams here. In the blue corner...representing privacy, security and encryption is...er...we don't know, he won't tell us and he has a bag over his head...and somehow he's pixellated himself in meatspace.
In the red corner we...
*USSR anthem intensifies*
IN THE RED CORNER...
*USSR ANTHEM INTENSIFIES*
For fuck sake.
Privacy is fundamentally technology agnostic - you can have some fun replacing the word 'digital' with 'stone' in the title of this article.
The populous had maximum privacy in the latter parts of the industrial revolution when moving away from villages (nosy neighbours) into larger towns (agnostic neighbours).
This all blew up when the desire for iDevices and 24/7 social networking became the norm.
The stinger these days is that people who do attempt to curate a whole, or partly, privacy-enabling persona stand out like a sore thumb to those with the right tools to surveil or entrap them.
Fuck the theory. I fully intend to keep my private communications forcefully private, undisclosable to other parties whether or not they have legal support to access it, decryptable only via keys held solely by the intended recipient AND NOBODY ELSE. And I do this in spite of having nothing more exciting to discuss than where and when to have the next pint with my friends. And guess what, if they are insane enough to outlaw encryption I'm fully prepared to keep doing it nonetheless via steganography by sending lolkitty pics back and forth for as long as it takes. Because it's simply NONE OF THEIR GODDAMNED BUSINESS, no matter what I have to say to that other bloke.
No, we cannot reasonably expect things we put online will remain secret.
Yes, we should put laws in place to break the business model of "doxing as a service" so that our unborn progeny might enjoy some modicum of privacy.
And in-between, the existence of deep fakes will provide some (it was a Joe-job) cover for politicians.
That won't help inventors much; it's pretty obvious if the plans are real.
Ant that's sort of a failing of crypto theory (or our application of it) isn't it? The idea is that it takes so long to crack the communication that the information is no longer of value. But some information, Saddam Hussein's CD of nuclear weapon research for instance, retain a value for a long time. Crypto only keeps things safe long enough to make business deals. It can't keep a state secret like the formula for Greek fire.
Although the poorly framed question (and it wasn't just the special bonus double negative) is noted at the end of this piece, there is the assumption that since all the "Yes"/"No" respondents could figure it out, it wasn't an issue. But that doesn't account for all those (like myself) who couldn't answer one way or the other, so didn't bother. You need three options "Yes"/"No"/"Sorry we ballsed up the question in such a way that it makes no real sense".
The initial www and ssl is based on the Eighties specifications X.500. X.500 has an underlying concept that there is an authority that you can trust (for ssl, that would be a CA, for an organization it would be who controls the CA). At that time, I talked with Universities and Corporations who were viewing X.500 as an administrative model for directories and internal identity management. In that context, X.500 seems reasonable if bureaucratic. When you change the model to one where outside agencies control the authority, the flaws (or naivete/failure to percieve the unintended consequences of) X.500 are blatantly evident. SSL and X.500 are based on centralized control. Privacy is impossible under SSL controlled by X.500 structures.
Security and privacy can not be based on trusting what someone else tells you to trust - it only exists when you control who you trust and when that trust is limited, controlled by you, opaque to all outside of you, and you never make the mistake of trusting the wrong person.
Our whole concept of trust in the web is upside down.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2023
