Schneier on Security

Lemming#33203183 • October 6, 2006 5:30 PM

Very interesting talk, here are a few notes (which don’t do justice, and most are distillations and not direct quotes):
—————— begin —————————
The debate is not security vs. privacy. (think of a locked door). “The real debate is liberty versus control.”

The problems with companies recording our data come mainly from the secondary uses (i.e., what happens once our data is sold to someone else).

Mutual disclosure (the police officer shows his id, and I show mine) is not the
answer, because of the power imbalance.

• “Security, I think, is liberty plus privacy.”

There are times when security and privacy are at odds.

“In general in our society, when privacy has to be violated we maintain security* through a mechanism called oversight.”

The death of privacy is not inevitable, despite the claims over the decades to the contrary.

“What we are lacking in our country is a comprehensive privacy law.”

Short term we’re going to lose, but “eventually society won’t be able to sustain no privacy, that there will be a backlash.”

“this is a multiyear project, I give this project ten, twenty years.”
—————— end —————————

I agree wholeheartedly that a comprehensive privacy law is the solution.

Bruce seems to say that we’re going to have to lose our privacy first, and then have the kind of disaster that will cause us to pass a law protecting it, because this is the way our system works: when we have “grandmas calling congressmen” that’s when we get a law passed.

So we need to have a privacy law ready to go when that time comes. (Ironically, much the same way the Patriot Act was pretty much off-the-shelf.)

Lemming#33203183 • October 6, 2006 6:59 PM

@Pat Cahalan, I’m wondering what gives you that optimism.

The public don’t seem to understand the issues involved yet, and they’re still too busy being afraid of terrorism to worry about either big brother or corporate databrokers.

Meanwhile, corporations have a vested interest in being able to collect and buy and sell your information. Therefore, just as in California, they will lobby hard against consumer privacy protections. Why shouldn’t they?

I fully expect that as soon as anything approaching real privacy protection gets passed in the states, the feds will pass something that supercedes it and waters it down to nothing, just as they have with a number of other issues relating to consumer protections. (States’ rights only applies when it fits a certain agenda, apparently, but I digress.)

I’m also wondering who is out there putting together a law and what principles they are basing it on. One point of Bruce’s talk was that such laws need to be technology-neutral, since we can’t forsee the next tech innovation and the privacy challenges it will bring.

And for that matter, how did the Europeans get whatever laws they have? Was there a crisis first, or just those who remember police states?