[iwar] [fc:On.a.digital.privacy.crusade]

From: Fred Cohen (fc@all.net)
Date: 2002-01-30 17:33:28
Next message: Fred Cohen: "[iwar] [fc:Castles.Built.on.Sand:.Why.Software.is.Insecure]"
Previous message: Fred Cohen: "[iwar] [fc:Terrorist.Interest.in.Water.Supply.and.SCADA.Systems]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-Id: <200201310133.g0V1XSI02949@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Wed, 30 Jan 2002 17:33:28 -0800 (PST)
Subject: [iwar] [fc:On.a.digital.privacy.crusade]
Reply-To: iwar@yahoogroups.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On a digital privacy crusade

By Rachel Konrad 
Staff Writer, CNET News.com
January 30, 2002, 11:15 AM PT

David Holtzman is on a crusade to change the way the digital world defines
privacy. 

Best known as the former chief technology officer of Network Solutions, the
45-year-old former cryptographic analyst with the U.S. Navy during the
Vietnam War oversaw the growth of the commercial Internet from 500,000
domain names to more than 20 million. He watched in amazement as technology
made it easier for marketers to collect and distribute vast amounts of
data--everything from the value of homes and stock options to arrest records
and death certificates.

Early last year, Holtzman became CEO of Opion, a market research start-up
that scoured newsgroups and message boards to determine which anonymous
participants were the most influential trendsetters. But $7 million in
venture funding dried up by the fall, and the company couldn't raise more
money. The Herndon, Va., resident took a hiatus from the daily grind and is
teaching an online marketing course at American University, working on a
book about privacy, and trying to encourage legislators in the United States
and around the world to think creatively about privacy vs. security.

Holtzman fears that, in an effort to protect their reputations and guard
their privacy, people who participate in digital society will become
polarized into two camps: the "vanilla politicians" and the
security-obsessed "curmudgeons." Holtzman talked with CNET News.com reporter
Rachel Konrad about virtual schizophrenia, online dating and other facets of
the privacy debate.

Why is the privacy debate your pet issue?
I have a degree in philosophy and was an intelligence analyst on submarines
for a number of years. Then, I got into computers 15 years ago and built a
lot of large-scale information systems. I went to (Network Solutions) and
started a company, and now I'm on a bunch of boards and I'm writing. I'm in
an interesting position to see a lot of different things.

The conclusion I've come to is that privacy is being treated like a
regulatory issue in some parts of the world, but really it's being driven by
technology. Technology makes new things available every day--not just
blue-sky stuff like nanotech...but Sony digital recorders and Tivo. It's not
clear to me what it means if AOL says they won't share information with any
third party. Does that include the entire AOL Time Warner family? That's a
large portion of the media world. Do I want my information from AOL shared
by HBO or Time magazine? We need to find answers to these questions.

Give me an example that most people can relate to about how technology is
changing privacy.
You go to a grocery store and swipe your courtesy card. It's clear to me
what they could do with that. It's not too bad--it feels like there might be
a relationship between you and your grocery store, and maybe they'll give me
a special coupon or give me a discount on my bill the next time I come to
the store. 

But it's another situation altogether if they take that list and merge it
with the cell phone list of another company, or they check it with my car's
(global positioning satellite) system and get a triangulation map on me. I
don't want my grocery store to know that I'm in the neighborhood, even if
they send me a coupon to my cell phone. Keep in mind that I don't know who
"they" are, but "they" could do that. Technology makes some ugly things that
were never before violations doable and simple.

How do you define privacy?
I've been struggling with this. I think it's the ability to control
information about yourself to some extent--your personal, private
information. It applies to people, communities, governments and companies.

In the 1700s, you probably could have predicted that Pittsburgh and
Baltimore and San Francisco would eventually become big cities because of
their positions on rivers and lakes and oceans. But relatively few people
did that at the time. Now the big issues are privacy, technology and
marketing and research. I'm trying to understand what that will mean for us
and how they will change our lives.

How much privacy do you personally want or need?
Enough that by simply exercising the right to have it you don't call
attention to yourself. There's this peer problem now. When somebody sifts
through your data in a grand jury, it doesn't mean you're guilty. But it
sure sounds like it. If you send e-mail to somebody and you've got P3P
(Platform for Privacy Preferences) all over it, unless you're (Electronic
Freedom Foundation co-founder) John Barlow, it's like you're walking around
with tin foil on your head. People think you're a creep and you must be up
to no good because you want privacy.

How much privacy does the average online user have?
(Sun Microsystems CEO Scott) McNealy said, "Privacy is dead. Get over it."
He's right--in the sense that privacy is complete control over your
information. If you think of young college kids, the people who do
everything online all the time, everything they're doing leaves a digital
footprint, and they won't be able to sweep it away. They may be looking at
their thesis papers 30 years from now. That's pretty scary.

So what? Would people behave any differently if they knew a term paper on
drug legalization would surface when they're 45 years old?
Yeah, lots of people probably would. It causes people to start acting the
way politicians act, trying to hide their tracks...We've seen what's
happened to presidential candidates in the past 40 years: They've gotten
vanilla. You don't see the extreme people anymore because they're afraid.

I was a child of the late '60s and '70s. I could live lifestyles that I
couldn't live now because the consequences weren't very bad. There weren't
any records or diseases you could get. But if I were growing up today, and
everything I did left a record...well, I probably wouldn't live differently,
but I'm on the fringe. Most people probably would do things differently.

You sound like someone who says, "Back in my day, things were better."
Doesn't the generation that was raised in a wired world think differently
about privacy?
You're right. I have five kids 14 to 22, and I raised them by myself as a
single parent until I remarried two years ago. Three of them hit puberty in
the same three-year period. That's why my hair's gray.

Here's the difference: They don't use e-mail. They use instant messenger. My
one daughter will be talking to the other daughter downstairs on IM. My
other daughter is going to college in Pittsburgh, and they know what she's
doing at any given time because they're all on IM together. And then there's
me: I feel IM is repugnant. It's intrusive, and I couldn't get any work done
if I had it on. 

This is the new kind of digital divide--those who opt into this culture and
those who get into all the privacy stuff. Each one is a different species.
The cultures are predicated on privacy, or more accurately, online identity.
It's easy to see looking at my kids and me.

What are your thoughts on Passport, Microsoft's controversial strategy to
compile personal data such as credit card numbers, addresses and purchase
logs?
Microsoft products have this tendency in which the longer you wait to use
them, the harder your life becomes. People who used Netscape kept crashing
until they finally used Internet Explorer. That's how it's going to be with
Passport. It's not going to be a "bang your fist on the table" command from
Microsoft to use it; it's going to be the annoyance of rebooting and typing
in your credit card numbers in over and over that drives people to use it.

The curmudgeons who don't want to do digital things or give away their
privacy are going to be in for a rough ride. It's going to be like trying to
live without a credit card today. You couldn't even rent a car.

So we're all going to cave on privacy?
Yeah, I think we're all going to cave. I hate to say that, but we're going
to have to deal with it. Because of that, we need to start asking questions
and have a cultural understanding of what it all means.

Presumably people who don't use the Internet will still have some shred of
privacy. Anyone else?
There are three types of people who will not leave footprints: the very
poor, who don't have access to the Internet; the curmudgeons--the men and
women who for one reason or another refuse to opt in; and the very wealthy.
The very wealthy don't use their own credit cards. If I were a senator or a
CEO or movie star, I'd have somebody with me all the time solely for the
purpose of using their credit cards. If I were a senator, I'd be pretty damn
careful about not using my credit card at a hotel or online.

There's going to be a whole new job--I don't know what you'd call them,
maybe credit gophers? They're going to go with the Gordon Gekkos of the
world and slap down their credit cards at the hotel and online so their
employer doesn't leave a trace. (Gordon Gekko is the acquisitive,
unscrupulous arbitrageur who declares, "Greed is good!" in the Oliver Stone
classic "Wall Street.")

How do politicians make laws about privacy and online rights? How would you
do it differently?
First, there are virtually no laws about privacy and identity. Everyone
thinks there are; it's one of the few places where there is a mismatch
between intuition and reality. In this case, this is a pretty egregious
difference. You have the Judge (Robert) Bork video tape law (which forbids a
video rental or sales outlet from disclosing information concerning what
tapes a person borrows) but otherwise it's scattershot.

One of the real problems with regulatory issues is that politicians take the
extreme fringe issues and form their opinions from there. Take child
protection--they mean well, but it results in draconian legislation.
Instead, let's go down the middle.

If marketers strip our online identities of privacy, what's to stop us from
creating new online identities--or even detaching our online identities from
our real identities?
Isn't that what Hotmail is for--free accounts so you can pretend you're not
the person you really are and keep evading the spammers? To some extent we
already do have different identities online. That's exactly what's
happening. 

Would that cause a society of schizophrenics--people who toggle divergent
personas whenever they turn the computer on and off?
People who are dating online, the gamers, the people who are really rabidly
political online--they already have their own virtual identities. It's a
question of age and flexibility. Some of us won't make that gap and will go
schizo, but others will be able to fade in and out. We already toggle
between religion, family, profession. We all swap these masks, and we're OK
with that. 

The masks aren't necessarily bad, by the way. I met my wife on an Internet
dating service. It's an unusual experience when you're dating online. First
the person is in digital format, then on paper, then on the telephone, then
it's for real. It's pretty effective because you don't have the judgment at
first whether they're fat or thin, tall or short. You only hear their
voice--whether they're articulate or not. Their soul comes through much more
easily. 

You don't have an official job these days. What do you do?
I'm in transition now--working with VCs, doing board stuff, writing a book
on privacy and digital identity. I'm trying to appreciate what happens when
information changes a culture and society. I'm trying to take polarized
issues like privacy and clear my head of the garbage everyone is throwing
around and ask, "What does this really mean?"

How would you describe yourself politically, at least when it comes to the
digital privacy issue?
I'm a forceful moderate. I say that because plain old moderates always sound
like wimps. I don't want to call myself a liberal or libertarian; I don't
want to take extreme polarized stances on issues like privacy. There's a
middle ground, and it's not for wimps. But no one seems to want to take it.

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Sponsored by VeriSign - The Value of Trust
Do you need to encrypt all your online transactions? Find
the perfect solution in this FREE Guide from VeriSign.
http://us.click.yahoo.com/jWSNbC/UdiDAA/yigFAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Next message: Fred Cohen: "[iwar] [fc:Castles.Built.on.Sand:.Why.Software.is.Insecure]"
Previous message: Fred Cohen: "[iwar] [fc:Terrorist.Interest.in.Water.Supply.and.SCADA.Systems]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
This archive was generated by hypermail 2.1.2 : 2002-12-31 02:15:03 PST