Schneier on Security

Bless Ralph Nader • May 20, 2008 3:48 PM

Pass A BroadLaw™! Government should do more! Where’s our Big Brother to protect us?! We’re helpless without him! And as vulnerable as newborn lambs to the Evil Corporations out to get us.

We’re too dumb and lazy to help ourselves. Only Government can save us! Help us, Superiors!

Bless Ralph Nader • May 20, 2008 6:20 PM

@Ale

“I presume that you would propose data confidentiality to be controlled by market governance”

Market governance? Well, no. Excepting the prevention of fraud or the initiation of force, market governance is a contradiction in terms.

“How costly would it be for you to constantly audit all the companies that hold your data?”

How costly would it be for you to withhold your data from all those companies in the first place? Your answer: very. My response: not when a “proxydata” company, which manages your data for you using proxy identities, offers their high-quality service at a reasonable price (high-quality and reasonbly priced as a result of competition from other companies with similar offerings.)

But that company, nay, that entire industry, never comes into being, nor refines, solidifies, streamlines it products and services offerings, because the incentive to create them was removed before it could gain a foothold in the first place.

“It is not in their best interest to report breaches and errors.”

Name an instance when it was in the best interest of a government agency to report its breaches and errors. When a private company errs, and a whistleblower reports it to the press, you can take your dollars elsewhere. Try taking your dollars elsewhere when the “service” you’re getting is from a government agency that errs (if you can ever find out about it. Last I checked, only government agencies have the power to make it illegal, under penalty of prison time, to blow the whistle.)

“..aligning the incentives for a fully private control of privacy is a terribly difficult (if not intractable) problem.”

How silly. Such a statement smacks of the fatal conceit that brought down the Eastern block economies, and makes sense only if you believe, as every good pro-regulation statist does, that you know a priori all of the possible solutions to a problem, and knowing them, can conclude ‘ I do not see any other way of solving the problem’, so there must not be any other way.

Here’s a phrase that you might like better: “none of us is as smart as all of us.” The market, defined as the contributions of as many individuals and voluntarily associated groups as would like to participate, toward the solution of expressed wants and needs by means of the best-performing service or product at the best price, will always beat out a BroadLaw, without exception.

Bless Ralph Nader • May 21, 2008 11:59 AM

@Bruce

“The problems I cite are the result of no laws.”

You haven’t cited any problems yet. You’ve tried to portray laziness in negotiation and due diligence on your part as violations of non-existent rights foisted upon a helpless you by omnipotent corporations.

“Our data is a part of us. It’s intimate and personal, and we have basic rights to it.”

Simply asserting falsehoods doesn’t make them true. Data is owned by the person who created it, not by the entity whom the data is about.

Let’s say I walk to work every day, at a slightly different time every day, using a slightly different route every day, using public roads. I do that for a year, and I don’t keep track of when I leave for work, nor which routes I take.

No data has been created.

Now, beginning on January 1st of the second year, and continuing for 365 days, you observe me from afar every morning as I traverse public roads. You keep track of when I turn a particular corner, and whether I take a left or a right at a particular stop sign.

At the end of the year, you have accumulated a bunch of data about my walking-to-work habits.

You own the data. I don’t own the data. You have all property rights in that data. I have none. If you want to sell the data, any law prohibiting you from doing so is as bad of an idea as any other law infringing property rights.

When you sign up for a supermarket affinity card, (your example), the common law would be correct to impute to you the same knowledge any 12-year-old has: that you don’t get something for nothing, and any discounts or rebates you receive from usage of that card are “paid for” by the use of “your data” in the form of your buying habits. If you don’t want that data collected or used, don’t get the affinity card. Any whining that you want one without paying the cost should be treated as you’d treate any child who holds his breath and stomps his feet trying to get something for nothing.

What’s needed is not a law exempting you from making intelligent decisions about which data you wish to trade for what with whom, nor creating a false right in the work-product of others. What’s needed is the self-discipline and maturity to realize your data is valuable, and to negotiate its use to your best benefit with your bank (or your bank’s competitor, when you take your business elsewhere), your grocery store, the company owns the toll roads you drive, the company owns the chat service you use, which airline you fly, etc.

Any less is just laziness on your part masquerading as victimhood.

Bless Ralph Nader • May 21, 2008 1:45 PM

@Panzer

” If there are no feasible alternatives”

Name one desire whose satisfaction can be achieved in only such a specific way that there can’t possibly (or, more realistically, practically) be any other way to satisfy that desire except in the way that an existing market or industry is currently satisfying it.

(Hint: by posing the question the way you have, you’ve already fallen in the trap of assuming a priori all knowledge of all potential solutions to a problem.)

(The classic example of the problem you bring up is the buggywhip indsutry in the U.S. in the late 1800’s. All the buggywhip companies were charging exorbitant prices, and treating their customers horribly. What possible solution (to the problem of transportation) could there be, except to pass a BroadLaw tightly regulating the price and supply of the products of these buggywhip companies?

Of course we know how that problem was solved. The desire for transporation was met in a way just slightly different than the regulators foresaw. The market provided a much better product and service.)

A demand for a feasible alternative(s) where none currently exists, when there’s a profit to be made from meeting that demand, are the incentives that cause entrepreneurs to create companies that produce solutions.

Does the market respond to a problem in 5 seconds? No. (And you have byzantine regulations to thank for that.) But the response that rises to the surface, when the incentive to create and offer better solutions is untainted by BroadLaws™, and which becomes the most popular with consumers, is, by definition, sufficiently worthwhile to consumers to trade some of their wealth for (otherwise they would have purchased the product of a competitor.)

Broadlaws™ are not free, but their costs are hidden. And the solutions which come from a few bureaucrats aren’t as good as the solutions that survive the brutal feedback mechanisms of the market: if your product sucks, and the few first-adopters say as much, nobody will buy it, and you’ll go out of business.

If a BroadLaw’s solution sucks, we’re stuck with it, because its implementation (forced subsidization through taxation) destroys the profit incentive for entrepreneurs, so we have no alternatives, because the alternatives never came into existence.

This is all basic economics, explained clearly here: http://www.econlib.org/library/Bastiat/basEss1.html

Bless Ralph Nader • May 21, 2008 4:11 PM

@xd0s

“As it stands now I believe US law treats data via proprty law, and that IMO is the core of the problem.”

It’s actually the core of the solution. Treating data in any other way, as Bruce advocates, is the heart of the problem.

Data created in the manner of my example (created while the subject’s activity took place on unambiguously public property), is the intellectual property of its creator. You, as the subject of that data, have no more right in it that you have in a painting I created depicting you walking down a public street.

Only if you stand on principle against the concept of intellectual property, could you view treating data as the thing it is (property) as a problem.

When ones creates something, it is property.

Bless Ralph Nader • May 22, 2008 2:43 PM

@JohnJ

“Incorrect. Data was created. You created it. That the data was not recorded does not mean it never existed.”

No. Data comes into existence only when it’s recorded. That’s part of the definition of data.

You’re confusing “data” with “information.” Information exists without being recorded. Data is recorded information.

“Yes, I’ve accumulated the data. But that doesn’t change the fact that you created it. I merely observed & recorded it.”

You observed information. Once you made a recording of it, you created data.

“Is your data (your path to work using your example) owned by me merely because I took the effort to record it?”

Yes.

“What if more than one observer recorded the data?”

You own your instance, and the other observer(s) owns his instance(s).

“Is there joint ownership?”

No. You own your instance, and the other observer(s) owns his instance(s).

“If a burglar did the monitoring, they could determine that, inclusive of variations, you’re never home between 9:15 and 3:45, granting them a 6.5 hour window of opportunity to rob your house.”

That doesn’t mean the burglar doesn’t own the data he created.

If I buy groceries using an affinity/club card and pay with a debit card, at least six and probably more players have information about the transaction …So, who owns the data?”

Which instance? Player 1 owns Player 1’s instance. Player 2 owns Player 2’s instance, etc.

If you don’t like that situation, shop at a grocery store who makes the following offer (like my local grocery store does): “We respect your privacy, and we offer ‘affinity card prices’ without the affinity card. Shop with us, instead.” (BTW, I’ve comparison-shopped, and they’re right, their prices are as good as the stores with affinity cards.)

Affinity programs aren’t free. You trade information about your buying habits in exchange for the benefits of an affinity card. If you view that information as private, then don’t trade it.

Wanting to get the benefits of an affinity card without paying the price is to be greeted with the same hard truth as any instance of someone wanting something for nothing (or worse: someone wishing to force externalities onto others, forcing them to pick up the tab for benefits you receive) : in economics, there’s no such thing as something for nothing.

“You can’t say all of them own the entire transaction.”

No ones owns the entire transaction to the exclusion of everyone else. Player 1 owns Player 1’s instance. Player 2 owns Player 2’s instance, etc.

You don’t own Player 1’s instance of the data (nor Player 2’s, 3’s, etc.) that is created by your affinity card purchase, as well you shouldn’t. It’s information that you agreed could be recorded (made into data) when you signed up for your affinity card. At the point the information is made into data by the store, the store owns the data, and shoud be able to sell their data as they see fit.

You have no more right to exclusive use of that data than you would have to the information that, after you whispered in my ear that you secretly love peaches, and I wrote that fact down on a piece of paper (making it data, my data), and I then yelled to a room full of people “JohnJ loves peaches!” , and each of them wrote that information down on each of their pieces of paper (making it data, their data.)

If I glance into your basket at the grocery store and see it filled with peaches, you think I’ve violated your privacy? That you somehow “own” the information that you love peaches? I doubt you think that. It’s information you’ve exposed in public.

Why should your store, or your bank, or your credit card processor be treated as if your peachlove were private information, owned exclusively by you?

Bless Ralph Nader • May 23, 2008 11:00 AM

@xd0s

“I believe that we change laws to support privacy not privacy definitions to support laws.”

Well, in this case, the classical concept of property is well established, being the result of hundreds of combined years of quality thinking. Insofar as the laws of property reflect that, they should not be lightly altered to serve today’s fashionable issues.

@JohnJ

“Your definitions are reversed.”

So reverse them back. Just as long as you understand that the concepts are separate. You can use whatever labels fits your fancy. 🙂