By Bruce schneier
Editor’s note: Bruce Schneier is a security technologist and chief technology officer for Co3 Systems. The opinions expressed in this text belong exclusively to Bruce Schneier.
(CNN) – In the age of the internet, we have no choice but to entrust our data to private companies: email providers, service providers, retail stores and so on.
We realize that this data is at risk of being found by hackers. But there is also another risk: the employees of the companies that keep our data for us.
In the early years of Facebook, employees had a master password that allowed them to see everything they wanted on any account. Employees of the NSA (United States National Security Agency) occasionally checked on their friends and associates. The agency even has a name for this: LOVEINT. And long before the internet, people with access to police or medical records occasionally used that power to search for famous people or people they knew.
The most recent company to be accused of allowing this kind of thing is Uber, the internet car transportation service.
The company is under investigation for spying on travelers without their permission. Called “God’s sight,” some Uber employees can see who is using the service and where they are going; and they used this at least once in 2011 as a party gimmick to show off service. One executive also suggested that the company should hire people to suppress criticism, making its database of people’s travels more “useful.”
None of us want to be harassed; whether it’s viewing our location data, medical data, emails and text messages or anything, by friends or strangers who have access due to their jobs. Unfortunately, there are few rules that protect us.
Government employees are prohibited from viewing our data, although none of the NSA’s LOVEINT data was prosecuted. HIPAA protects the privacy of medical records, but we have nothing to protect most of our information.
Your Facebook and Uber data is only protected by company culture. There is nothing in their license agreements that you clicked “agree” but did not read that prevents those companies from violating your privacy.
This needs to change. The corporate databases that contain our data must be secured from all those who do not need access for their work. Peepers who see our data for no legitimate reason should be punished.
There are auditing technologies that can detect this, and they should be required. As long as we have to give our data to companies and government agencies, we need them to assure us that our privacy will be protected.
On the other hand, we need legal limits on what can be done with our data. Companies begin to analyze our personal data and publish the results, sometimes in an effort to obtain positive feedback.
And while it may be fun for Uber to post data on travelers heading out on one night stands and hookups with prostitutes (Uber recently deleted both posts) or for OKCupid to post the sexual preferences and habits of its users, this is very intimate information.
If OKCupid or Uber were a university, this analysis would have to be approved by an ethics council in charge of protecting the privacy of the subjects. Research by private companies is not supervised in any way, which means that no one reviews this research with a view to protecting subjects.
Changing this doesn’t need an act of Congress. It is something that the US Federal Trade Commission can do under the auspices of consumer protection. As long as companies collect and store our data, they need to adhere to standards of security and professionalism.
The general problem of our data being accessible will not go away. There are great benefits to putting your data in the cloud, and that is not going to change. Companies like Google and Facebook need to be able to work on the computers and networks that hold your data, so engineers will need access. Unless your data at these other companies is encrypted; And in many cases they will never be because it will be useless, interested persons will be able to access your personal information.
We now live in a world where a lot of intimate data is stored in some third party database somewhere; the emails and text messages we send and receive, our location data from our cell phones, the things we buy, the web pages we view, and the search terms we use. This data is bought and sold, and used to manipulate us with personalized advertising.
But there is something extra creepy about people using it to harass us or analyze our lifestyles. The corporate collection of our data has far exceeded the laws that protect us. We need to rewrite those laws for the information age.