Monday, March 8, 2010

Privacy, Identity and Safety

When people talk about privacy concerns related to Internet usage, their main concern Is often a risk of financial loss – that someone will steal their credit card, bank account number or their entire identity and they will lose all their savings, or at least their good credit. These are valid concerns. An instance of identity theft can take months or years to sort out.

But there is also a certain amount of concern over personal safety. There is a fear of being stalked or attacked or that one’s home will be broken into. There have been news reports of these sorts of things happening and it can be frightening. Is it a big risk?

While there have been a few anecdotes involving stalking and persons being lured into situations where they are victimized or robbed, there seem to be no statistics available on these types of crimes that are related to Internet activity.

But to emphasize the potential, a group that calls itself “Forthehack” created the web site pleaserobme.com, where you can find twitter posts from people who identify that they are not at home. The idea is that these people’s homes are available for burglary. The web site creators are not trying to get people robbed – they are trying to make the point that your Internet postings could be used by unscrupulous persons and that you should be careful. The results shown on pleserobme.com can be obtained from a simple search on Twitter, which the site shows you how to accomplish.

The FBI and other US governmental agencies focus their attention on three broad areas of Internet-related crimes: those related to terrorism, those that involve a possible or actual financial loss and those involving the exploitation of children. It is that latter category where the greatest physical crime threat exists.

It might be argued that in recent years we have become overprotective of children and too worried about threats to their safety. But it is also true that many of the threats are real and must be addressed by parents, law enforcement and the public. In the past, it was relatively easy to teach children not to talk to strangers, not to take candy from them and not to accept rides from them. Strangers on the street or in cars are easy for anyone, even a child, to identify as a stranger.

In the on-line world, of course, we have the ability to be anonymous. This is an aspect that we seem to value about the internet and we have seen a lot of advice to the effect that it is better to be anonymous to protect our own identities and our safety. This ability to be anonymous then gets turned on its head by those who wish to exploit – especially those who want to exploit children. It is not as easy for the child to spot a stranger as being dangerous when they seem to be just another 11 year-old in a chat room.

Most parents understand these risks (and if they don’t they should get informed fast). But how should those who manage online resources respond? Do the owners of social media sites and the like have a responsibility in this? Some of them try to put in place methods to identify their members as being who they claim to be and even monitor online chats. But there are usually easy ways to get around these identity checks.

Professionals who deal in any way with consumer identity information have a responsibility to at the very least make their best efforts to ensure the privacy and safety of those who buy their products or use their services. This is done by setting and following policies on privacy and security and designing systems that provide for compliance with regulations and ethical standards. It takes a little extra work to get it right, but it must be done to protect customers and users and most particularly children.

I’ll be speaking on the subject of privacy and identity at Enterprise Data World in San Francisco next week. My presentation will be at 8:00 a.m. on March 17. For more information on the conference, go to http://edw2010.wilshireconferences.com/.

Thursday, March 4, 2010

Privacy and Data Mining

When the 2003 version of the Outlook e-mail program came out, it would by default not display graphics in HTML e-mails where they were to be downloaded from the Internet once you opened the mail. The message that displayed in place of the graphic was “To help protect your privacy, Outlook prevented automatic download of this picture from the Internet”. What did this strange message mean? How would downloading a picture damage my privacy?

There are two issues here. The first is that there are some pictures you may not want to see and which could potentially offend. This is, however, a not very common worry.

The second, and more important, issue is that once you download the pictures, the sender of the e-mail knows you have opened the mail. Thus your anonymity is compromised. They may not know who you are, but they do know you are someone who has at least bothered to open the e-mail before deleting it. By downloading the picture you provide information to the sender that the e-mail address is live and someone is looking at the mail, even if only for a moment.

And of course if you click on any of the links in the mail and go to the sender’s landing pages, you provide the sender with more information about yourself and your viewing habits. The marketer can then start to build a profile about you. They can use cookies to track what you do on their sites over time. If you purchase anything, the amount of information they have about you starts to increase rapidly.

This brings us to the subject of data mining. I’m using data mining in the popular sense as being any activity that collects and analyzes data for marketing purposes. Professionals know that data mining is more properly defined as automated methods of discovering hitherto unknown patterns in any set of data. But the popular media have pretty well equated it with an invasion of privacy.

There are two broad categories of actions that marketers can take with data collected about individuals. First, they can target the person directly with offers that might interest the individual and prompt them to purchase goods or services. Second, the individual can be grouped together with others who seem to have similar characteristics in order to determine how that group behaves, leading to marketing that can better target that group or similar groups.

The first scenario, personal targeting, is the thing that consumers often find intrusive and sometimes just plain “spooky”. They don’t want their mail boxes or e-mail in-boxes filled with offers for things that they would normally not consider purchasing. They have a low tolerance to ads that say, “you might also be interested in...” or “other people who bought this product also bought ...”. Those kinds of suggestions must be used sparingly or the consumer is turned off.

Some consumers consider the use of their spending habits for market analysis as an invasion of privacy as well. But usually they are not even aware this is going on. Most people use grocery store discount cards with hardly a thought as to what is being analyzed about their shopping habits – they just like getting the discounts that are available. The use of the data gathered from such loyalty card programs has been limited, primarily due to the fact that marketers aren’t sure how far they can go towards targeting consumers with specific ads without offending them and driving their business away.

The controversy over data mining is just one more symptom of our conflict between identity and privacy in this digital age. We want to stay anonymous to feel safe, but we also have a need to be identified properly when we want to transact our business, on-line or off-line.

I’ll be talking further about the subject of identity and privacy at my presentation at Enterprise Data World later this month in San Francisco. My presentation will be at 8:00 a.m. on March 17. For more information on the conference, see:
http://edw2010.wilshireconferences.com/