USC Annenberg Online Journalism ReviewUSC

Sections
Article Archive
Readers' Blog
Wikis
Ethics
Events Calendar
Making Money
Reporting
Video
Writing
Resources
Register
About OJR
Privacy Policy
OJR Delivered
OJR by E-mail
RSS Article Feed
RSS Blog Feed
Search




Internet Privacy:A Case of Real Fears, Inadequate Solutions

There it was, staring at me from my computer screen at 7:30 a.m. one recent Monday morning. '... I'm going to have the President killed...now the U-Haul truck goes to D.C.,' declared the message posted in the 'Clinton Under Fire' bulletin board discussion at LATimes.com.

After checking with my supervisors and company lawyers, I called the Secret Service. I provided as much information as I knew about the purported sender of the message. Legally, we believed, we had no choice. ? Over the next few hours, however, our own and affiliated experts determined that the message originated from an Internet address used by a community college in San Antonio, Texas. This information was passed to the Secret Service and to the college's Internet account administrator, who thought he knew a likely suspect -- a student militant who had been troublesome in the past. For now, the investigation remains under wraps. But the college's Internet usage logs could yield evidence needed for federal authorities to use in prosecuting someone for threatening to end Bill Clinton's life.

For me, the bulletin board incident personalized the debate raging over Internet privacy. Although assassins aren't in the habit of declaring their intent in public forums, it's not difficult to imagine some person stealing an Internet account and then taunting authorities, daring them to stop him from carrying out some heinous plot (and then seeing authorities hassle the wrong person). Co-conspirators might even exchange information via encoded Internet messages, immune to government wiretaps. Hollywood has already turned this scenario into a cliche.

And that's what FBI director Louis Freeh capitalized on recently in mounting a major campaign in Congress to increase both the FBI's computer and telephone surveillance capabilities. In private briefings, he scared lawmakers with horror stories, and warned of the government's inability to prevent strikes by terrorist groups or track drug lords who can afford high-tech, digital communications systems.

Freeh was onto something. Brilliantly, he set up a battle between twin desires: freedom from government snooping, and freedom from bad guys, especially terrorists. Freeh is betting that the fear of bad guys is stronger. After all, in some cases Bill Gates can see what applications are on your hard drive -- and, unlike Freeh, he can look without a court order. Those steeped in the Internet's anti-authoritarian culture are aghast that either Louis Freeh or Bill Gates can gain access to information previously deemed private or off-limits without our permission. Civil libertarians hearken back to the protest movements of the 1960s, when undercover cops and FBI agents infiltrated peaceful organizations illegally, kept dossiers on law-abiding citizens (including me) and hurt innocent people with false arrests, beatings and worse. Those protesters now are today's consumers, and they're complaining bitterly about merchants sharing information about their buying and Internet surfing habits. So much so, that according to a recent Boston Consulting Group survey, 43 percent of Web users refuse to provide demographic information online, and 27 percent deliberately provide false data.

As a society, how much government snooping will we tolerate to ease our fears of bogeymen? And what should businesses be allowed to do with our so-called personal data?

The government snooping debate takes form in a bill before the House Select Committee on Intelligence. Known as SAFE, the legislation originally was intended to loosen export restrictions on encryption software. This software scrambles data and requires a password or 'key' to decipher it. This is important for protecting banking transactions and other forms of commerce, as well as personal communications that involve sensitive information.

Generally, the computer industry, Internet users and civil liberties groups favor widespread availability of encryption. However, they oppose giving the government the ability to read encrypted messages without the proper key.

But, as former Los Angeles Times writer Jonathan Weber wrote last fall, Freeh's scare tactics turned the SAFE bill 'on its head.' Among other things, SAFE keeps export controls and now includes a government right to decryption information when a judge signs a subpoena.

Even if the SAFE bill becomes law, however, putting it into practice would be a programmer's worst nightmare. It would involve creation of a complex system for obtaining and storing decryption keys without the information falling into the wrong hands. Computer scientists strongly oppose the legislation.

So do most our allies overseas. The European Union has urged member governments to adopt encryption standards, arguing that there should be legal recognition of digital signatures. Britain and the United States opposed the move.

An EU report argued that allowing third parties to secretly decode personal and business communications wouldn't stop criminals but would create many new security headaches and threaten personal privacy. (The same report noted that such a policy also would damage European interests in electronic commerce.)

Partly in response to Freeh's campaign against encryption, the Americans for Computer Privacy coalition was unveiled on March 4, in Washington, D.C. Supported by high-tech firms and their trade associations, ACP plans a $10-million media effort to educate the public about the threats to privacy posed by the Clinton Administration and Freeh's claim on domestic encryption control.

That same day, in a letter to Senate Minority Leader Tom Daschle (D-S.D.), Vice President Al Gore advocated a continuing dialogue. But, he added, 'the Administration remains committed to finding ways to preserve the ability of the nation's law enforcement community to access, under strictly defined legal procedures, the plain text of criminally related communications and stored information.'

Hearings on SAFE continue, as well as on rival bills that promote widespread use of encryption schemes that allow government access to decryption codes.? But what about merchants' access to your personal information?

A study by the Electronic Privacy Information Center showed that 49 of the 100 most frequently visited Web sites collect personal information from users, yet only 17 have any policy about keeping the data private. Worse, those with privacy policies aren't meeting basic standards, EPIC found.

Some businesses currently ask customers if they can share information before doing so and give consumers a chance to 'opt out.' But Internet groups, including Vanderbilt University's Project 2000, are urging companies to adopt a system that would keep data private unless you affirmatively 'opt in.' Germany currently mandates such behavior.

Indeed, many Internet denizens would prefer a private solution, in the spirit of keeping the medium as free as possible. Even some of those who rail against 'spam' believe government regulation is the wrong approach.

Esther Dyson, a Net veteran who publishes her own computer industry newsletter, believes individuals should be responsible for protecting their own data, not government. The Internet 'can give each individual the power and the tools to bargain on his own terms,' Dyson wrote in the Wall Street Journal last year. Dyson, however, may be giving the average online customer more credit than he or she deserves, given the energy and depth of interest one must have to successfully combat hundreds of channels of marketing abuse.

Last June, The Federal Trade Commission gave businesses another year to come up with their own solutions; the Commission is scheduled to release its own report on privacy issues by summer.

Recently, Netscape, Firefly, VeriSign and other firms promoting digital signatures have supported the so-called Open Profiling Standard. This would enable users to manage how much personal data is shared via controls through your Web browser and give you a record showing every site that has tracked them and what data was exchanged.

But critics see this as a feeble attempt to get personal data into a standard format that can be more easily exploited. After all, how may people are going to familiarize themselves with browser options? How many do you know today?

How important is consumer confidence in connection with Internet privacy?

More than 69 percent of respondents in a Georgia Tech survey done last year, said they resist registering as Web site visitors because it's not clear how the collected information will be used. And 62 percent rated sites seeking demographic information as 'untrustworthy.' Imagine the impact of these attitudes on companies attempting to launch e-commerce ventures.

'A combination of industry self-regulation, government nudging and consumer monitoring will most likely be the short-term solution for providing a degree of information privacy in the Internet area,' Deborah Claymon wrote in the March issue of 'The Red Herring,' a technology investment magazine.

She may be right. That's usually what happens because that's what's politically doable. Eventually, however, the U.S. will tilt towards Europe's more open market approach, since no one there, save the Brits, wants to kowtow to the imperial wishes of Uncle Sam on Internet communications issues.

You can monitor what's happening regarding Internet privacy in Congress -- and in other countries -- via these Web sites: Electronic Privacy Information Center (EPIC), http://ww.epic.org

The Privacy Forum, http://www.vortex.com

The Electronic Frontier Foundation, http:/www.eff.org For a description of e-mail encryption methods, see http://www.cnet.com/Content/Features/Howto/Encryption/index.html

 

News briefs from around the world give you the latest developments that affect online journalism.
LATimes.com
http://ww.epic.org
http://www.vortex.com
http:/www.eff.org
http://www.cnet.com/Content/Features/Howto/Encryption/index.html