Is Privacy dead? Or just Modesty?

As I have noted before, Sun Microsystems co-founder Scott McNealy was famously quoted saying: "You have zero privacy anyway. Get over it." But that was said way back in 1999!!  Back then, there was no Facebook, no MySpace, no Twitter, nor LinkedIn; Google was barely a year old.
 And privacy was already dead?!? (Where was I?)

Mark Zuckerberg, CEO and founder of Facebook recently said in an interview that "People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people. That social norm is just something that has evolved over time." And then went on to say that “ …we view it as our role in the system to constantly be innovating and be updating what our system is to reflect what the current social norms are," he said.

Interesting. So is Facebook and other social networking sites only reflections of what is currently acceptable in society at this point in time? If that is the case, then why must there be laws, for example,  against drunk driving if people should know when to quit (the social norm) and not to do something dangerous like get behind the wheel after too many cocktails? Yet we have had to put laws in place that actually define what is drunk in the legal sense (i.e. blood alcohol level). Self-regulation, at least in this instance of personal behaviour, does not universally work out so well.

So what drives what? Does Facebook reflect the new normalcy of openness or does it merely provide an outlet for pent–up desire for everyone to engage in a community, share some intimate details with friends (but mostly acquaintances), and attempt to parse the much desired 15 minutes of fame into smaller, longer bits. Are our egos crowding out the sense of Victorain modesty that used to prevail in company of strangers, or even friends? With 350 million users now on Facebook, it is difficult to believe that only the extroverts have inherited the Earth…..

The question is: are sites like Facebook (not the only enabler here) simply the exploitation tool that drives the users to reveal more private detail, or rather, just the medium? Social networking sites like FB can be no different than videos like “Girls Gone Wild.” This outlet more than enables bad behavior; it rewards it with some kind of validation and exposure. But then again, should I be able to blame the New Jersey Turnpike for me being caught going 100 miles an hour…..?

2009 Privacy Putz of Year Award

In the tradition of the year–end custom of awarding something or someone with a “Best of” award for outstanding achievement in a particular category, I have decided to do the same with the area of privacy – with a bit of a twist. We constantly hear about of our loss of privacy as one of the chief byproducts of our interconnected, always-on world, and how we are barely grasping to what’s left of the shredded veil of secrecy behind which we were so used to hiding. I thought it would be more interesting to award the one person who has done the most to willingly obliterate his or her right of privacy.



So, welcome to the 1st annual ‘Privacy Putz of the Year’ award. Unlike the complexity of trying to choose who has done the most to advance the interests of privacy and security in our culture and day-to-day lives, it was comparatively simple this year to highlight the individuals who have done the complete opposite of what makes sense as it relates to try and maintain one’s anonymity and low-profile in this quasi-Orwellian world of me, me, me on the Web and TV.


For this year’s inaugural award, I decided to forgo the obvious, the deluded attention-seekers who were purposely willing to give their privacy away for a small taste of the nectar of fame. It would have been too easy, for example, to choose one of the three top higher-profile candidates: first, Nadya Suleman, the so called “Octo-mom”. This is the lady who recently produced a set of octuplets and then signed on to her own reality show so we could all voyeuristically enjoy another person taking care of their kids, only in this case it was 14 of them at the same time time. What was more interesting about Suleman, however, was that the world soon found out that this 33-year-old single mother already had six children who were born, just like the octuplets, through in vitro fertilization. (Six isn’t enough?!)


The second candidates I quickly discounted were the White House party crashers, Tareq and Michaele Salahi, I spoke about in my last blog who must have been shocked, shocked I say! that their personal lives would be so scrutinized after this little misdeed of theirs. However, to their credit, the Salahis did organize their Facebook page very nicely, fully detailing every person and dignitary they met that night, with glossy color photos in case the Secret Service didn’t know where to look for evidence of the security breach.


Finally, the last obvious candidate that was too easy to ignore was the pair of Kate and Jon Gosselin. These two have been so overexposed in the media and their story has been so hashed and rehashed that it warrants no further comment from me. They have reaped the wind; so let them now sow the whirlwind.


As for the viable candidates, First Runner up to the Privacy Putz award goes to one Craig Lynch, a 28 year-old prison escapee from Suffolk, England, who escaped from prison back in September but has not been content to just keep the low-profile of your average bloke who manages to make it over the prison wall, but has continued to update his Facebook status regularly - describing everything from what he had for dinner to who his next girlfriend in the New Year might be. This might be the digital version of the trail of popcorn…


But the real winner of the Privacy Putz Award for 2009 goes to the one individual who in my opinion did the most harm to her own privacy, the most to undermine her overall well being and anonymity, and that person was one Natalie Blanchard, an IBM employee from Quebec. Ms. Blanchard was out of work on long-term disability for depression for 18 months when suddenly her insurance company, Manulife, immediately terminated her monthly payments. How was it that the company came to such a definitive diagnosis of Ms. Blanchard’s ostensibly legitimate condition? A psychological examination? A thorough medical evaluation? Rock, paper, scisssors? Nope. Ms. Blanchard, actually, was apparently only too eager to assist the company in its conclusive diagnosis of her remarkable recovery from major depression.

Blanchard undermined her own case by posting certain pictures and status updates of herself on her Facebook page. What’s wrong with that, you ask? Well, in the past 18 months while she was “recovering,” a series of pictures she posted on her Facebook page show her taking the time-tested remedy for depression by attending a Chippendale’s male strip show while on vacation. Other pictures showed Blanchard at bars, beaches, and on three other 4-day holiday trips, which were recommended by her psychologist all the while collecting the benefits from her job at IBM. A Facebook status message said that she had climbed a mountain recently, as well. You go, girl.

It appears that her privacy settings, or lack thereof, on her Facebook page allowed either someone from her company or someone from the insurance company to view her tell-tale postings, because when she eventually called the insurance company to inquire why her payments had abruptly ceased, the reason given was that according to the photos and postings on her Facebook page, Blanchard was apparently no longer depressed! Wow! Manulife was able to diagnosis Ms. Blanchard essentially through hearsay, assumption and innuendo all from the comfort of the office PC. One small step for psychology; one giant leap for Manulife. Case closed. It’s a Holiday miracle.

Congratulations to Natalie Blanchard for the 2009 Privacy Putz of the Year award. Well deserved.

As I attempt to emphasize in every blog post here, we now live in a post-privacy world, devoid of the traditional trappings of common sense, guilt, shame and discretion. Using tools like Facebook, MySpace, Twitter, and even blogs like this puts your life, opinion, ideology and in some cases private life right out on the web for all to see, and see it forever.

Just think, the world used to be your oyster; now it is your fishbowl.

Happy New Year.

The Paradox of Privacy - Part III, The Exciting Conclusion

I hadn't intended this piece to run beyond one part, let alone two, but there are just too many interesting things to discuss about who the biggest threat to your privacy is…


I want to discuss the recent event of the two publicity seekers who crashed the White House state dinner last month. Their obvious desperate need for attention and B-List fame reflects what Andy Warhol said about everyone: we all want 15 minutes in the spotlight. Some get it. But at what cost? What the party-crashing couple is now finding out about the dark side is fame (even fleeting, undeserved fame like theirs) is what the first casualty always is: privacy.

Because these two miscreants put themselves in the spotlight willingly, it is obvious that the last thing they wanted from the experience is anonymity. What they are now and will experience a hundredfold more is the degree to which the blogosphere will go to turn over every stone and look for every skeleton in every closet to attempt to (rightfully) embarrass these two. What they will find is that they have awakened a sleeping giant of spite and vindictiveness that will rain down all hell upon them. You can see it already occurring by the revelations that the couple is involved in a plethora of lawsuits, bankruptcies and intra-family fighting.

Why? I believe primarily that Americans are easy lot to entertain and amuse - American Idol, People Magazine, NASCAR don't require much brain matter to process - but the one thing we demand is that our 'celebrities' bring something to the table. Michael Jackson, Tiger Woods and Oprah are famous for a reason - talent. Talent is their currency and we exchange it for fame and adoration. We realize at some level that we cannot easily be like them because they are 'better' then us in some unique way. The couple that crashed the White House is not better than us in any way; we resent their pretentiousness and base arrogance that is offset with nothing in return - it is a classic bait and switch. That they could crash the White House party - okay, good trick - but what do we get in return? A vacuum. Luciano Pavarotti could be arrogant; Bill Gates can be arrogant; Dr. J can be arrogant, he was after all one of the greatest basketball players that ever lived. These two, however, deserve what they get.

Most of only give up our privacy piecemeal – a bit here for some small convenience, a bit there for a 25% off coupon, etc. This couple relinquished their personal privacy wholesale with this selfish and thoughtless antic. Who will they have to blame for the sudden and very public loss of privacy? Who else? Themselves. I hope it was worth it.

The Paradox of Privacy - Part II

I want to continue my discussion from last month one of the biggest threats to your right of privacy - you.

If you have a Facebook account you probably get 10-15 requests a week from your Friends to answer or play games or contests that require some personal information to be input or revealed - the most famous and pervasive application was the "25 Things You Don't Know About Me" which took the Facebook community by storm over the spring and summer.

Notwithstanding that fact that you get to know random, irrelevant and mostly inane 'facts' about your friends and friends of friends, what is more insdious is what you reveal to them and the world at large. Since most cases of identity theft are commmited by people that the victim knows well or has some relationship with, it is not improbable that you may have 'friended' that person on Facebook as well. Now that they know what your first dog's name was, or favorite grade school teacher, or that you eat peas with a fork, that insight allows them to glean little bits of info about you that helps build a case of identity theft. Think about all of the websites that ask either passwords or security questions for credentials. You supply very similar information as the answers, and in many questions also provide your own questions - some which mirror the ones asked by that Facebook application iself. Perfect fodder for ID thieves....and most valuable because it comes right from the source.


So think before you surrender little pieces of your personal life for what you may think to be only harmless and transitory amusement (and for free!). It may have some very long-lasting and unwanted repurcussions.

An effective incident response process

Thanks to the great people at SC Magazine for publishing this piece of mine.

Security and privacy incidents pose real risks to companies of any size and complexity.

These types of unwelcome events do not discriminate. The steps your company takes to deal with the response and remediation, however, will allow you to differentiate yourself from other companies who suffer the same fate.

An excellent first step in the incident response process is to simply define and understand what the terms violation, incident or breach mean in the context of your industry's lexicon. The terms may already be defined by regulations or laws that govern your industry or company. If so, you should align your understanding with these already-defined measures since you will probably be legally held to them in the case of an incident. It also will be beneficial to try and articulate the possible scenarios that are likely to occur in your line of work. While you cannot possibly define every likely incident, you should be able to imagine a short list of the ones within the realm of possibility.

Second, define, document and publish procedures that are to be followed in the event of an incident. However, the procedure should include steps to take in reaction to the incident that define who does what and when. The procedures don't necessarily need to be overly detailed or verbose, but they should avoid being subjective or too generic so as not to invite indecision or confusion during a time when you least want it. Having a single procedural guide on which to rely during incidents fosters accountability and follow-through.

Once a central point of contact is appointed, then a response team can be created. Depending on your company, this may be an army of one or a group of 25. If you don't have the luxury of dedicated resources, then a virtual team can be named that comes together in a time of crisis, and then just as quickly dissolves once the storm has passed. This process allows a company to harness the particular expertise of its employees, while still allowing them to do their day jobs.

In this age of free-flowing information, your customers and clients do not realistically expect you to never have a security or privacy breach. No rational person expects all of their data, in all its iterations, in all locations, to forever remain safe and secure. What those customers and clients do expect of you is to have a process in place to reasonably prevent the incident from happening and, when it does happen, have a plan in place to deal with the consequences. Part of those consequences involve notice to clients and customers of what happened, details on how you will rectify the current situation and, finally, plans to ensure that this same event does not happen in the future.



From the October 2009 Issue of SCMagazine  (http://www.scmagazineus.com/An-effective-incident-response-process/article/151825/)

The Privacy Paradox Part I

"You have zero privacy anyway. Get over it." - Former Sun Microsystems CEO, Scott McNealy.

With the increasing evidence of the lack of personal privacy that average Americans are experiencing daily, it might be interesting to try and uncover possible culprits and root causes. Technology? The Government? Global warming? Nope. Here's the answer: You. Read on.

Forget about the lack of privacy for a second. Instead, think about all you do to try and stay secure, and low profile enough so as not to make yourself a target for identity theft: you shred all of your sensitive documents, you only do business online with SSL enabled websites, you check your credit score annually, you read your credit card statements carefully. And yet, ironically, many of your daily habits work to undermine the anonymity and low visibility to seek to maintain. How? Simple. Throughout the week, in the on and off-line world, start counting up all of the places you leave an electronic fingerprint or footprint big enough that Hansel and Gretel would have no problem following it home, let alone someone more nefarious trying to track you.

Let’s start in the morning. You head to Starbucks for coffee and breakfast. You pay with your Starbucks card and a little crumb is left that you were there. (Literally and figuratively.)

As you head over the bridge, you maneuver towards the E-ZPass lane to expedite your crossing, while the camera reads your E-ZPass tag and debits your account for the $4 toll. At the same time, it records that you were crossing the bridge, again, that morning at around the same time every week day.

Once you’re at work, all day you’ll be logging into websites that you typically frequent that will greet you will the “Welcome Back!” message since you checked the “Remember Me” box on the sites and a ‘cookie’ was placed on your computer. Ostensibly created to enrich the surfing experience and save the users from logging in every time, the cookies tell the websites not only when you went to the site but what kind of things you like to do when you are there. You may have even given them a credit card to hold for you as a matter of convenience! (Yours or theirs?)

You head to the gym at lunch and swipe your bar-coded gym card to let L.A. Fitness know you exercise at least 3 days a week. After the gym, you stop at Chick-fil-A for a grilled chicken sandwich, which you pay for by credit card. MasterCard now knows you like waffle fries.

You stop on the way home from work at ShopRite for flowers for the wife and before you pay, you swipe your ShopRite Plus card at the register to save $1.50 on the bouquet, and, unknowingly, to help Shop Rite know to not only order another batch or orchids for its inventory, but what your shopping preferences are as well. Finally, you make a call to home to let them know you’re running late. But the GPS tracking in your iPhone already knows this.

And this is all in just one day…the pattern amplifies once you begin to travel further away from home and to other countries. Everything collected about so far was possible because you felt it a worthwhile voluntarily tradeoff of a bit of your privacy for the sake of convenience and efficiency; none of it was required or mandated by anyone.

Here’s the kicker. Think of the proverbial frog in the pot; you turn up the heat immediately and he jumps out. If you slowly turn up the heat incrementally, he boils to death without realizing it. So you think you are losing your privacy little by little every day? Guess what? You are. And it’s not because the government or advancements in technology is necessarily taking it away, it is because you are giving it away. Little by little. And you may not realize it. Just like the little oblivious frog.

Data Breach: Overview of Trends in Litigation and an Approach to Practical Prevention

I just published a White Paper with an associate, Todd Ruback, entitled
"Data Breach: Overview of Trends in Litigation and an Approach to Practical Prevention".


The purpose of the paper is to review the topic of data breach from two perspectives: first, an overview of the trends in data breach litigation, and second, a more granular perspective of practical data protection processes that may serve as a guidepost to help reduce the risk of likelihood of data breach. Taken together the reader will understand why a measured approach to data protection can reduce the risk of financial liability from a data breach lawsuit.

Here is the link to the paper. Please let me know your comments or feedback.

http://tinyurl.com/n9d9lc

Al