Schneier on Security

Clive Robinson • February 14, 2012 12:42 PM

In these days of “ever persistent” but invisable personal data “trust” is a huge problem.

In the old human world if trust was breached, in time most people forget about it and it did not usually form part of the public record, and even when it did it was usually very localised and in a way that would be difficult to search. Thus with time the wounds caused by a breach of trust healed.

However in our modern world “ever persistent” data means that a breach of trust is not forgoton ever. The data released is now usually in the public record (the Internet) in an easily searchable way from just about anywhere. Thus even a very very minor transgression can and in some cases definatly will come back to haunt you at a later date.

As an example of what can happen, I’m aware of a compleate and utter break down in a family, where one couple decided that they had the right to add the entire familes details to their web site. The couple did not ask they just did it and then got upset when other members of the family asked the couple to remove their details from the site. The couple dug their heals in and refused to remove any details until a little over a year later another member of the family suffered identity theft and fraudsters ran up huge debts using information that could have been obtained from the couples web site. Even though the couple finally saw the light of day and took the details down over ten years ago, the details can still be found cached in various places including several geneology sites who none of the family claim to have had contact with… For one member of that family they had a broken credit history they could not fix, debt collectors and courts to face and a reputation sullied beyond repair that haunts them today. Thus they refuse to have anything what soever to do with the couple and the rest of the family has taken and still maintain sides with an ever widening gap between them.

The moral being anybody can release your personal details without asking and not even say sorry, and others can and will gather up that information for their own benifit or profit as the law in other countries either alows them to or does not prohibit them from doing so. Large organisations will actually site parts of their operations in such jurisdictions just to evade problems in their home jurisdictions.

Untill such time as individuals have the right to say “no” cheaply and easily and insist that the copies of data are destroyed wherever they are in the world then people would be unwise to show any level of trust in others.

I personaly don’t partake in the (mad?) craze of “social networking” nor do I alow my photograph to be taken, nor do I partake of store loyalty or other credit/debit cards.

I was taught during my early years as part of “work” to not trust people as the work was sufficiently confidential that others lives depended on it. So as a mater of habit I simply don’t “trust people” in the way other more “socialy connected” people do. And in fact I actualy feel very uncomfortable around people who “spray and pray” with their personal details and daily activities as the chances are they will just as readily spray mine and other peoples personal details around along with their own with no consideration at all.

I have been told a number of times that trust is important in relationships, and that I should reveal all… I’ve even been told it’s “all or nothing”. To be honest I’ve found the exact opposite to be true as I suspect have quite a few others when it’s to late. Because when relationships break down as they inevitably will people are hurt and some will get angry and throw what ever they have to hand. Thus you can look on their definition of trust as “leaving amunition for the enemy”.

One thing many people don’t understand is that trust can be partial or segmented. That is you can trust an individual in some ways but not in all. They have several saying in the UK army that begin “I’d trust him with my life…” and end with “but not to look after my drink” or “but not my wallet” or “but not alone with my girlfriend” etc etc.

In many ways I suspect life would be way way better for most people if they firstly didn’t trust so easily, secondly segmented their trust with individuals and thirdly segmented ther lives.

However the trend driven by the likes of Facebook, Twitter and most other social media is the exact opposite to spray everything to the four corners of the earth for ever. So you have to ask “to who’s benifit?” and “why?” along with “what am I realy getting out of this?”.

The idea of Privacy Enhancing Technology (PET) has been around for atleast 15years, yet it appears to be for ever stymied by legislation or the lack of it. Usually the battle cry for removing privacy or preventing it is “think of the children” or “if you have nothing to hide” or it’s necessary to “help fight” terrorists / drugs / crime etc etc. Yet every time we get this sort of legislation invariably the only thing it is used for is to remove the privacy of ordinary individuals never for what it was “advertised for”. And why? usually for no better reason than somebody things it might be of benift to them financialy…

Clive Robinson • February 14, 2012 7:10 PM

@ karrde,

But being able to claim ownership of deletion privileges over data spread onto hundreds of servers by third-parties? I don’t see that happening, not even if the entire user population of the Internet suddenly changes their mind to agree with you about it.

True, the real problem of Personal Identifing Information, is the same as Pandora and her box, life is wonderful providing you keep the lid on it, but the minute the contents take flight like the proverbial genie it just won’t go back again 🙁