Privacy and Dinner Conversation

It's fashionable these days to say that "privacy is dead". Take, for example, these comments from Mark Zuckerberg, CEO of Facebook. I can't decide if this is political on his part, or truly disingenuous. In either case, I could not disagree more.

The counter-example I like to give is very simple. It is the dinner conversation. Consider:

You've made it through a hard day at work. You make it home and sit across from the dinner table with your wife, discussing your day. You talk about what happened, share your feelings, etc. This is a healthy, rejuvenating experience.

Now imagine the same scenario, but instead of you speaking privately with your wife, the entire conversation is recorded. It MAY be viewable by your boss or your co-workers, your friends, your government, maybe even the entire world. Does this change things? Do you now have to be on guard, more careful? Is the experience potentially less healthy? Less rejuvenating?

It seems pretty clear to me. I'd consider just such an example as proof that privacy is not dead (yet).

New is Hard

"Thousands of years ago, the first man discovered how to make fire. He was probably burned at the stake he had taught his brothers to light."

  -- Ayn Rand, "The Fountainhead"

Creating something new is hard. Yes, this is not news, but a few things hit home today for me that brought this into perspective. My company is trying to do something truly new in telecom and public safety, I should have known this would not be easy. I've identified the following sources of friction:

1. Lawyers. Lawyers are in their element when they are enforcing the status quo. They are the "sticky" in "sticky spaghetti".
2. Bureaucrats. We all know what a bureaucrat is. I think the most direct definition is this: it is someone who succeeds by effectively making others fail.
3. Fear of failure. This is a hard one. In fact we probably all fear failure to some extent (yes, I acknowledge that the rare exception exists, and we need these people too...) This is probably an important survival trait, but in modern society subverting it can be a challenge.
4. Paralysis by analysis. This is common in business. We need analysts. People who can sift through the data, add up the columns, and come up with the decision that maximizes benefit while minimizing risk, etc., etc. I just don't want these people responsible for actually making the decision. That is just plain dangerous.

We'll get there.

Salinger and Kerouac

I recently came across this interesting juxtaposition of J.D. Salinger and Jack Kerouac in the New York Review of Books. I especially liked:

There's no alternative "lifestyle" for Holden Caulfield or the members of the Glass family to retreat to, as there is for the Beats, no group of like-minded adventurers. Salinger's characters aren't after thrills. Their quest is for an impossible purity that drives them away from the workaday world, toward a dangerous, self-burying seclusion. "We're...freaks with freakish standards," says Zooey Glass to his sister Franny. "We're the Tattooed Lady, and we're never going to have a minute's peace, the rest of our lives, till everybody else is tattooed too."

Exporting the Social Graph

In a recent blog post Jason Calacanis suggested five ways Facebook could improve its position with regard to customer privacy. Although it is not clear from the post how serious these suggestions are, in this post I will take a closer look at the first suggestion, namely "add an export key".

To understand this, we need to consider what Calacanis means by this suggestion, and further, what it would mean for FB to allow this kind of export. Fundamentally, the value of a social network is contained in two things:

1. The User Profile. This would typically include some kind of identity information (such as reliable contact information), personal information about the user, and personal media, such as photos and videos.
2. The Social Graph. That is, some definition of who the user's friends and family are, or more generally, who they wish to communicate with.

What Calacanis is suggesting is that users be given the ability to "export" these things externally so that they may be used to participate in other social services that would make use of them. Before addressing the likelihood of such a feature, let's first consider why the social graph is so important.

Social networks are about sharing information. Regarding the content I create, I don't always want to share everything with everyone. Some things, such as family photos, I may only want to share with family and friends. In the language of Twitter, these are the folks that are following me. Regarding content I consume, of all the content created, there's only a very small percentage I actually care about. This is typically content created by friends, family, colleagues, etc. These are the folks that I am following. Together, these make up the social graph. In other words, the social graph is a realization of folks and things I care about, and folks I am comfortable sharing my content with.

Any time a user logs into FB for the purposes of either sharing content or managing their social connections (or social graph), FB wins. From the user's perspective, they are building (at least part of) their social community around the FB ecosystem, and becoming more and more "locked in" to this network. This is in fact the primary goal (at least for now) of FB, namely, getting users to invest time and energy into building this relationship.

Based on all of this, it may seem counter-intuitive for FB to share this kind of information with outside parties, but that is exactly what they are doing with Facebook Connect. Facebook Connect allows external services to access profile and social graph information for consenting FB users. Of course they expose this not for the purposes of "exporting" the data for use in other social networks, but rather so that other services can build on top of this existing "social infrastructure", further strengthening their position in terms of having the end user "locked in" to their FB profile and social graph.

What Calacanis is suggesting is something very different. He is questioning the concept of ownership and the underlying closed nature of FB. He is suggesting in fact that FB support a more open environment where users are free to "pack up" their profile and social graph information and take it to another (potentially competing) social network.

In short, FB will not do this. And the bad news (at least for proponents of an open web) is that it doesn't really matter whether they do or not. Even if such an "export key" existed, there's no really compelling reason for anyone to use it. For this to be compelling to consumers, two things are needed: 1. Something about FB that makes them want to move out, and 2. An alternative place for them to move to. Or, as Mickey Roarke said in Rumble Fish: If you're going to lead people, you have to have somewhere to go.

Alternatives are possible, such as Diaspora, but it's still too early to tell whether or not such "open" efforts can overcome the network effect FB has so obviously achieved.

Location Privacy and the Courts

"One who does not wish to disclose his movements to the government need not use a cellular telephone."

-- DOJ under G.W. Bush

Recently, the question of using location derived from cellular networks for the purposes of law enforcement has come up in the courts. The DOJ under President Obama has appealed to a Philadelphia court an earlier decision that access to location requires a search warrant based on probable cause. In particular, the brief put up by the Obama DOJ states that as part of using a cell phone, the user assumes the risk that location will be accessible by the government.

The argument the government is making is essentially this: it is reasonable to believe that the user of cellular services understands that the service provider must have some knowledge of the whereabouts of the user in order to provide the service, and thus by participating in this service, they are in effect providing information about their whereabouts to the service provider, and in turn to the government.

OK, there are a number of obvious concerns I have with this line of argument. Here is my shortlist:

1. It's not at all clear why sharing location information with my service provider would imply a willingness to share it with the government.
2. In order to provide cellular service, the service provider also has access to a variety of other information, including who the user communicates with, and the information communicated. They certainly need to know the former, and for practical purposes have access to the latter. Does this then imply that there is no reasonable expectation of privacy regarding this information?

In short, I believe that instead of continuing to fight for these draconian measures initiated by the Bush administration, the Obama administration would be well served to move in favor of the Fourth Amendment here and drop this appeal. It would not be a stretch to consider this issue in the context of Obama's promise while running for office to eliminate warrantless wiretaps.

Evaluation Criteria for Location Privacy

I ran across an interesting study the other day out of the U.C. Berkeley School of Information. The study considered the privacy provisions laid out in the W3C Geolocation API, and recommendations for its improvement. The Geolocation API is a part of the HTML5 specification, and as such will play an important role in location-based mobile web applications as mobile devices continue the rapid adoption of HTML5.

While the conclusions of the study were certainly excellent, I found most interesting the list of privacy-related criteria that were derived after considering a range of existing frameworks and standards. These are reprinted here:

1. Appropriateness: Is the collection of location information appropriate given the context of the service or application?
2. Minimization: Is the minimum necessary granularity of location information distributed or collected?
3. User Control: How much ongoing control does the user have over location information? Is the user a passive receiver of notices or an active transmitter of policies? Are there defaults? Do they privilege privacy or information flow?
4. Notice: Can requesters transmit information about their identity and practices? What information is required to be provided to the user by the requesting entity? What rules can individuals establish attach to their location information and transmit? Is there a standard language for such rules?
5. Consent: Is the user in control of decisions to disclose location information? Is control provided on a per use, per recipient or some other basis? Is it operationalized as an opt-in, opt-out or opt model?
6. Secondary Use: Is user consent required for secondary use (a use beyond the one for which the information was supplied by the user)? Do mechanisms facilitate setting of limits or asking permission for secondary uses?
7. Distribution: Is distribution of location information limited to the entity with whom the individual believes they are interacting or is information re-transmitted to others?
8. Retention: Are timestamps for limiting retention attached to location information? How can policy statements about retention be made?
9. Transparency and Feedback: Are flows of information transparent to the individual? Does the specification facilitate individual access and related rights? Are there mechanisms to log location information requests and is it easy for individuals to access such logs?
10. Aggregation: Does the standard facilitate aggregation of location information on specific users or users generally? Does the specification create persistent unique identifiers?

When designing Veriplace, we considered these very same questions. In some cases (such as appropriateness and minimization) the application developer is largely in control of managing these issues. Veriplace addresses these cases by working with the developer, ensuring that guidelines such as these are followed. In other cases (such as user control, consent and transparency) Veriplace is more actively involved, building these requirements and safeguards directly into the platform architecture.

Taken together, this is a great list, and expands in important ways on existing guidelines, such as the CTIA Best Practices and Guidelines for LBS. Although perhaps an implementation detail, I might add one item: Uniform Privacy Management Interface. As LBS services proliferate, it will become more difficult for the end user to effectively manage location privacy. Providing a unified, consistent interface for managing access to location across services will be critical to ensuring the simplicity and transparency necessary to safeguard user privacy.