GDPR: Don't forget to bring a towel!
May 25 is Towel Day, when fans of The Hitchhiker's Guide to the Galaxy jokingly adorn a towel and praise the household item as if it prepares the owner for any sticky situation. Author Douglas Adams was a master of these tongue-in-cheek references to our modern existence, helping the reader (and listener) feel as if they might one day walk across their livingroom and into a silly, star-spanning adventure.
As The Guide says, "A towel is just about the most massively useful thing any interstellar Hitchhiker can carry. Partly it has great practical value." But the true power of a towel is its role as a symbol: "More importantly, a towel has immense psychological value... any man who can hitch the length and breadth of the Galaxy, rough it, slum it, struggle against terrible odds, win through and still knows where his towel is, is clearly a man to be reckoned with."
Possession of a towel is a calming force, a reification of the mantra printed across the cover of The Guide in big letters: "DON'T PANIC".
As Towel Day 2018 approached, our e-mail inboxes filled to the brim with similar platitudes. May 25 was also the day that European General Data Protection Regulation (GDPR) went into effect. And boy, did we hear about it.
"NOTHING TO SEE HERE" is the message of the marketing barrage around GDPR. It's much more bland than The Guide's cover phrase, to be sure, but there can be no desire to panic if there's no problem.
Data collectors and data brokers are keen to remind us that there simply is no surveillance concern, that small tweaks are required to shoehorn GDPR into a well-functioning, privacy-respecting system. Website popups around the world seem to say, "Maybe the reckless corporations over there have created a nightmare, but over here we would never dream of hurting you. If we screwed up in the past, we've fixed everything now so you should forgive us."
That conversation dodges fundamental threats to our computer networks that aim to segment, classify, and surveil traffic. As we emphasize at Yale Privacy Lab, there are are also serious problems with the underlying structure of our software ecosystems.
It may be difficult to communicate these concepts via e-mail and website popups, but companies that avoid mentioning the surveillance underbelly of their business model are flat-out deceiving people. GDPR contains very stringent requirements, including explicit consent from users that would limit the data harvesting that currently powers Silicon Valley and the app economy. If GDPR were followed according to security industry recommendations, it would not only threaten Facebook and Google, but also Pornhub, Imgur, AccuWeather, Yelp, and much more obscure companies.
So, what's a data hoarder to do? An Internet meme summarizes the strategy: "Hi there. You purchased a potato from us 7 years ago and we somehow got [ahold] of your email address... we have more information for you not to read on our [Terms and Conditions] and it doesn't really matter... you don't have any choice anyway if you'd like to continue using our potatoes or celeries."
Electronic contracts are notoriously ignored by users, prompting the creation of Web browser plugins that rate terms of service and try to categorize policies via Artifical Intelligence.
Shortly after our work with Exodus Privacy exposed an entire industry of hidden trackers in Google Play, Google changed its policies to ask Android app developers to "prominently highlight how the user data will be used and have the user provide affirmative consent for such use". Warning screens and verbose agreements often become software malpractice: they not only mask the poison coursing through the system, they sedate the user into a click-through coma.
Now that GDPR has landed, we're seeing challenges to the faux-consent model. Do users have a free choice when they are a captive audience just trying to use a service?
Communication about updated privacy policies may be a mechanism to hide the fact that consent was never asked for or granted by users in the past. Silence and pre-checked boxes may be interpreted as consent, even though GDPR specifically forbids this. When the dust settles, will users even know what they may have consented to, and from which service providers?
The corporate version of GDPR is a bizarre cauldron of doublespeak, intended to elicit B.F. Skinner-style conditioned responses on the part of users. As current trends to undermine, circumvent, and twist GDPR continue, the regulation begins to resemble the Towelie character from South Park, who reminds everyone "Don't forget to bring a towel!" at every possible opportunity. In stark contrast to Douglas Adams's helpful tool for survival and comfort, the towel becomes a ridiculous suggestion that serves no utility. Mere mention of GDPR may elicit the same disdain as Towelie's character, a vehicle for jokes about uselessness and lazy inaction.
No encrypted iCloud backups for you, citizen!
"Edge AI": encapsulating machine learning classifiers in lightweight, energy-efficient, airgapped chips
Writing in Wired, Boing Boing contributor Clive Thompson discusses the rise and rise of "Edge AI" startups that sell lightweight machine-learning classifiers that run on low-powered chips and don't talk to the cloud, meaning that they are privacy respecting and energy efficient.
Facial recognition isn't just bad because it invades privacy: it's because privacy invasions fuel discrimination
Bruce Schneier writes in the New York Times that banning facial recognition (as cities like San Diego, San Francisco, Oakland, Brookline and Somerville have done) is not enough: there are plenty of other ways to automatically recognize people (gait detection, high-resolution photos of hands that reveal fingerprints, voiceprints, etc), and these will all be used […]
More and more people are flocking to a wide variety of careers in IT, thanks mostly to the high pay, plentiful advancement opportunities, and an exciting atmosphere that offers new challenges every day. The only problem is that this high demand means competition can be fierce if you’re entering the job market for the first […]
Going to the beach is almost always an enjoyable experience, but trekking back through your house on the way to the shower can leave a trail of sand the quickly saps the day of its sunny fun. Thankfully this BeachBox: Portable Shower & Storage unit has you covered the next time you hit the beach. […]
When it comes to immediately grabbing a reader’s attention in any medium, few things are more important than picking the perfect font—regardless of whether you’re advertising your brand online or in print. The MyFonts Monotype Fresh Font Bundle offers over 50 handcrafted fonts from one of the world’s most revered typeface companies, and it’s available […]