Monday, January 16, 2006

Anonymity or Privacy on the Internet?

Last week, Bruce Schneier wrote a great comment on Anonymity, how it won’t kill the Internet, and that it has to do with accountability mostly.

Logically, if identification is impossible, then there cannot be adequate accountability. Though, alternative methods based on the collective trust exist, and are as anonymous, as necessary. Spoofed identities, perhaps even hijacked ones should also be taken into consideration. But how important is Anonymity today? What is Anonymity and Privacy anyway? When is the first desired to preserve the second? How blur is the line in between? I think Anonymity is so much broader than it is originally perceived.

I’ve once mentioned the possibilities of IP cloaking for competitive intelligence/disinformation. On the other hand, for me today’s concept of anonymity has three dimensions :

- The individuals trying to achieve anonymity with the idea to express their right of free speech, and access censored information
 
A chinese citizen is the first thing that comes to my mind, though many others are having the same problems when trying to access information or express their right of free speech, such as Saudi Arabia, United Arab Emirates, Bahrain, Iran, Singapore, Burma, and Tunisia.

- Those trying to avoid accountability for certain actions, in one way or another
Anonymous-p2p.org has for instance featured a list of P2P applications that improve anonymity to a certain extend. In this case, anonymity is desired in order to cover up certain actions. The use of proxy servers to try to hide originating host should also be mentioned as a possibility.

- Those with an established pseudo-anonymity, netizens for instance

I think pseudo-anonymity is important in today’s society, it’s utopian worlds(online gaming worlds etc.), express freedom and promote creativity to a certain extend. The entire trust and accountability model is actually entrusted on the service, for instance, Ebay as mentioned in the original article. You trust that Ebay’s practices going beyond this pseudo-anonymity would achieve accountability in case it’s necessary.

What others think on privacy, and why is anonymity hard?

There’s no Privacy, get over it” Sun's CEO Scott McNealy, back in 1999

John Young, Cryptome.org on privacy, data aggregation, data mining, terrorism fears and our constantly digitized lifes :

Privacy should be a right of citizens worldwide, in particular the right to keep government and business from gaining access to private information and personal data. The argument that government needs to violate privacy in order to assure security is a lie. The business of gathering private information by corporations and then selling that to government and other businesses is a great threat to civil liberties. Much of this technology was developed for intelligence and military uses but has since been expanded to include civil society.

Dan Farmer and Charles C.Mann – Surveillance Nation
Low-priced surveillance technologies will help millions of consumers protect their property, plan their commutes, and monitor their families. But as these informal intelligence-gathering networks overlap and invade our privacy, that very could evaporate.”

To report, or not to report?

Computerworld is running a story that, “Three more U.S states add laws on data breaches”, but what would be the consequences of this action? Less security breaches? I doubt so. Realistic metrics and reactions whenever an actual breach occurs, as well as its future prevention measures? Now that’s something I think.

Such legislations have a huge impact, both, on the industry, the public opinion, and company itself. No one likes admitting getting hacked, or having sensitive information exposed to unknown and obviously malicious party. Yet, if it wasn't companies reporting these breaches, thousands of people would have been secretly exposed to possible identity theft, and we’ll be still living with the idea that the Megacorporations are responsibly handling our information. Which they obviously aren’t! And even if they try to hide it, sooner or later a victim will starting digging in, and the story ends up in mainstream news. Privacyrights.org have taken the time and effort to compile a "A Chronology of Data Breaches Reported Since the ChoicePoint Incident", and as you can see, it's not getting any better, though, reporting and legislations have the potential to change a lot.

At the bottom line, I am a firm believer that, reporting breaches greatly improves the accuracy of security metrics, and hopefully the solutions themselves. Security through obscurity is simply out of question when it comes to storing unencrypted databases online, or even distributing them offline, though, it’s still obviously very popular today.

What do you think? Are the long-term negative PR effects worth the uninterrupted business continuity as a whole? Are you comfortable with not knowing how exactly is any of the organizations possessing sensitive info on you, is taking care to secure it? I'm not!

As well as various other comments on the topic :

Information Security Breaches and the Threat to Consumers
Security Breaches : Notification, Treatment, and Prevention
Recommended Practices on Notification of Security Breach Involving Personal Information
What Does a Computer Security Breach Really Cost?

Technorati tags :
,,,

Future Trends of Malware

Great news, that I greatly anticipated, my "Malware - Future Trends" research got Slashdotted. The strange thing is how my actual post and numerous others from different respected sites weren't approved. I guess I would have to live with that, given the huge number of hits and new subscribers to my feed I have received for the last couple of days :))

Someone once said, that it’s all about to courage to write down what you think. And he was right, but he missed to mention, that you should also stand behind what you believe in. There’s nothing more important than disseminating that kind of information to the broadest audience possible, in the fastest way achievable. The comments, links recognition and active feedback that I have been receiving, are the best benchmark for the usefulness of my research. So, thanks!

My “Malware – future trends” publication has recently appeared at :

Packetstormsecurity.org
Securiteam.com
Net-security.org
LinuxSecurity.com
Infosecwriters.com
WhiteDust.net
ISECA.org
BankInfoSecurity.com
Wiretapped.net
Astalavista.com
CGISecurity.com
Megasecurity.org
Secguru.com
Wikipedia's entry on Malware

to name few of the sites, and in various blog comments :

Computerworld’s IT Management Blog
Datamation's Blog
Sergio Hernando's post, and the Google translation
Alan Cardel's Blog
Worm Blog

And many others : 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20

The more naysayers, the more important is what you are doing, and I have come across a lot of them, though I wouldn’t even bother to link them back. They are a valuable incentive on a certain occasions. It's a great feeling that I missed for a little while, it reminds of the how differently people react to one another’s success and hard work. I totally enjoy people quoting me on every sentence from a 26 pages publication I pretty much finalized on Xmas eve, just for the idea of doing it.

Cheer up, guys, and go through my points objectively.

What I truly like, is the debate it opened up here and there, one of the main ideas behind it. Feel free to post your comments at my original announcement, Malware - Future Trends.

Technorati tags :
,,,,,