Despite PRISM, privacy is not dead

The cover of Newsweek magazine on 27 July 1970 featured an innocent couple being menaced by cameras and microphones and new technologies like computer punch cards and paper tape.  The headline hollered “IS PRIVACY DEAD?”.

The same question has been posed every few years ever since. 

In 1999, Sun Microsystems boss Scott McNally urged us to “get over” the idea we have “zero privacy”; in 2008, Ed Giorgio from the Office of the US Director of National Intelligence chillingly asserted that “privacy and security are a zero-sum game”; Facebook’s Mark Zuckerberg proclaimed in 2010 that privacy was no longer a “social norm”.  And now the PRISM scandal looks like a fatal blow to privacy.  

But the fact that cynics, security zealots and information magnates have been asking the same rhetorical question for over 40 years suggests that the answer is No!

PRISM, as revealed by whistle blower Ed Snowden, is a Top Secret electronic surveillance program of the US National Security Agency (NSA) to monitor communications traversing most of the big internet properties including, allegedly, Apple, Facebook, Google, Microsoft, Skype, Yahoo and YouTube (most of which have strenuously denied involvement).  Relatedly, it is reported that US intelligence agencies have also been obtaining comprehensive call records from major US telephone companies. 

At tweet speed, forces have lined up on both sides of the stereotypical security-privacy divide. 

One side says privacy is a luxury in these times of terror, and that in any case, much of the citizenry evidently abrogate privacy in the way they take to social networking. The other side says this indiscriminate surveillance is the stuff of the Stasi, and by destroying civil liberties, we let the terrorists win. 

Governments of course are caught in the middle. President Obama defends PRISM on the basis that we cannot have 100 percent security and 100 percent privacy.  

Frankly that’s an almost trivial proposition. It’s motherhood. And it doesn’t help to inform any measured response to the law enforcement challenge, for we don’t have any tools that would let us design a computer system to an agreed specification in the form of, say “98 percent Security + 93 percent Privacy”.

I suggest one of the difficulties is that all sides tend to confuse privacy for secrecy. They’re not the same thing. 

Privacy is a state of affairs where those who have personal information about us are constrained in how they use it. In daily life, we have few absolute secrets, but plenty of personal details. 

Not many people wish to live their lives underground; on the contrary we actually want to be well known by others, so long as they respect what they know about us. Secrecy is a sufficient but not necessary condition for privacy. Robust privacy regulations mandate strict limits on what personal information is collected, how it is used and re-used, and how it is shared. 

Therefore I am a privacy optimist. Yes, obviously too much personal information has broken the banks in cyberspace, yet it is not necessarily the case that any “genie” is “out of the bottle”. 

If personal information falls unfairly into someone’s hands, privacy legislation around the world provides strong protection against re-use. For instance, in Australia Google was found to have breached the Privacy Act when its StreetView cars recorded unencrypted wi-fi transmissions; the company cooperated in deleting the data concerned. 

In Europe, Facebook’s generation of tag suggestions without consent by biometric processes was ruled unlawful; regulators there forced Facebook to cease facial recognition and delete all old templates. 

We might have a better national security debate if we more carefully distinguished privacy and secrecy.  

I see no reason why Big Data should not be a legitimate tool for law enforcement. I have myself seen powerful analytical tools used soon after a terrorist attack to search out patterns in call records in the vicinity to reveal suspects.  

Until now, there has not been the capacity to use these tools pro-actively. But with sufficient smarts, raw data and computing power, it is surely a reasonable proposition that population-wide communications metadata can be screened to reveal organised crimes in the making. 

A more sophisticated and transparent government position might ask the public to give up a little secrecy in the interests of national security.  

The debate should not be polarised around the falsehood that security and privacy are at odds.  Instead we should be negotiating appropriate controls around selected metadata to enable effective intelligence gathering while precluding unexpected re-use. If (and only if) credible and verifiable safeguards can be maintained, then so can our privacy.

For me the awful thing about PRISM is not that metadata is being monitored; it’s that we weren’t told. Good governments should bring the citizenry into their confidence. 

We generally don’t use secret cryptographic algorithms anymore, for there is no lasting security in obscurity. For precisely the same reason, we must not have secret security programs either.

Steve Wilson is a privacy and identity security adviser. He tweets as @Steve_Lockstep.