By Eric Beach, Adam Marcus & Berin Szoka
In the first entry of the Privacy Solution Series, Berin Szoka and Adam Thierer noted that the goal of the series is "to detail the many 'technologies of evasion' (i.e., empowerment or user 'self-help' tools) that allow web surfers to better protect their privacy online." Before outlining a few more such tools, we wanted to step back and provide a brief overview of the need for, goals of, and future scope of this series.
We started this series because, to paraphrase Smokey the Bear, "Only you can protect your privacy online!" While the law can play a vital role in giving full effect to the Fourth Amendment's restraint on government surveillance, privacy is not something that cannot simply be created or enforced by regulation because, as Cato scholar Jim Harper explains, privacy is "the subjective condition that people experience when they have power to control information about themselves." Thus, when the appropriate technological tools and methods exist and users "exercise that power consistent with their interests and values, government regulation in the name of privacy is based only on politicians' and bureaucrats' guesses about what 'privacy' should look like." As Berin has put it:
Debates about online privacy often seem to assume relatively homogeneous privacy preferences among Internet users. But the reality is that users vary widely, with many people demonstrating that they just don't care who sees what they do, post or say online. Attitudes vary from application to application, of course, but that's precisely the point: While many reflexively talk about the 'importance of privacy' as if a monolith of users held a single opinion, no clear consensus exists for all users, all applications and all situations.
Moreover, privacy and security are both dynamic: The ongoing evolution of the Internet, shifting expectations about online interaction, and the constant revelations of new security vulnerabilities all make it impossible to simply freeze the Internet in place. Instead, users must be actively engaged in the ongoing process of protecting their privacy and security online according to their own preferences.
Our goal is to educate users about the tools that make this task easier. Together, user education and empowerment form a powerful alternative to regulation. That alternative is "less restrictive" because regulatory mandates come with unintended consequences and can never reflect the preferences of all users.
Many forthcoming Privacy Solution Series entries will describe tools that fit into two broad categories:
- Encryption (protecting communications): The scrambling of content to protect against unauthorized viewing.
- Anonymization (protecting identity): Paradoxically, the Internet offers an unprecedented degree of both anonymity and transparency/track-ability. While most behavior online does leave a plethora of tracks in the form of ISP records, server logs, and cookie IDs, users can achieve a significantly greater degree of privacy online by blocking data collection mechanisms like cookies or routing traffic through a non-monitored server.
For some, one category is more important than the other. For example, some believe that public message boards are more civil when users are prohibited from posting anonymously and posts are signed with the user's real name instead of a made-up "handle." But these same people may feel very strongly that the content of emails should be protected (i.e., encrypted) so that only the intended recipient can view them.
In other situations and/or for other people, the exact opposite may be true. A user might not care that Gmail scans their email to provide targeted advertising as long as Google does not associate that information with their actual identity.
Regulatory solutions inevitably fail to recognize such complexity and even inconsistency of user preferences. By contrast, user empowerment offers diverse solutions for a diverse citizenry.
Additional information about encryption, anonymity & other technologies of evasion
- Bruce Schneier's Applied Cryptography (available online in part in an older version online), is considered one of the definitive works about encryption for the layman.
- Access Denied: the Practice and Policy of Global Internet Filtering, published in 2008 by Harvard's Berkman Center, discusses encryption and technologies of evasion, while also describing current filtering and censoring efforts in many countries. You can view much of the book at the OpenNet initiative or preview the book at Google Books. Berkman's 2007 Circumvention Landscape Report outlines technologies of censorship and technologies of evasion in an applied context.
- The Electronic Frontier Foundation offers an excellent introduction to the basics of encryption as part of its Surveillance Self-Defense Project.
- The Handbook for Bloggers and Cyberdissidents published by Reporters Without Borders, which details techniques for circumventing censorship.