GDPR: Don't forget to bring a towel!
May 25 is Towel Day, when fans of The Hitchhiker's Guide to the Galaxy jokingly adorn a towel and praise the household item as if it prepares the owner for any sticky situation. Author Douglas Adams was a master of these tongue-in-cheek references to our modern existence, helping the reader (and listener) feel as if they might one day walk across their livingroom and into a silly, star-spanning adventure.
As The Guide says, "A towel is just about the most massively useful thing any interstellar Hitchhiker can carry. Partly it has great practical value." But the true power of a towel is its role as a symbol: "More importantly, a towel has immense psychological value... any man who can hitch the length and breadth of the Galaxy, rough it, slum it, struggle against terrible odds, win through and still knows where his towel is, is clearly a man to be reckoned with."
Possession of a towel is a calming force, a reification of the mantra printed across the cover of The Guide in big letters: "DON'T PANIC".
As Towel Day 2018 approached, our e-mail inboxes filled to the brim with similar platitudes. May 25 was also the day that European General Data Protection Regulation (GDPR) went into effect. And boy, did we hear about it.
"NOTHING TO SEE HERE" is the message of the marketing barrage around GDPR. It's much more bland than The Guide's cover phrase, to be sure, but there can be no desire to panic if there's no problem.
Data collectors and data brokers are keen to remind us that there simply is no surveillance concern, that small tweaks are required to shoehorn GDPR into a well-functioning, privacy-respecting system. Website popups around the world seem to say, "Maybe the reckless corporations over there have created a nightmare, but over here we would never dream of hurting you. If we screwed up in the past, we've fixed everything now so you should forgive us."
That conversation dodges fundamental threats to our computer networks that aim to segment, classify, and surveil traffic. As we emphasize at Yale Privacy Lab, there are are also serious problems with the underlying structure of our software ecosystems.
It may be difficult to communicate these concepts via e-mail and website popups, but companies that avoid mentioning the surveillance underbelly of their business model are flat-out deceiving people. GDPR contains very stringent requirements, including explicit consent from users that would limit the data harvesting that currently powers Silicon Valley and the app economy. If GDPR were followed according to security industry recommendations, it would not only threaten Facebook and Google, but also Pornhub, Imgur, AccuWeather, Yelp, and much more obscure companies.
So, what's a data hoarder to do? An Internet meme summarizes the strategy: "Hi there. You purchased a potato from us 7 years ago and we somehow got [ahold] of your email address... we have more information for you not to read on our [Terms and Conditions] and it doesn't really matter... you don't have any choice anyway if you'd like to continue using our potatoes or celeries."
Electronic contracts are notoriously ignored by users, prompting the creation of Web browser plugins that rate terms of service and try to categorize policies via Artifical Intelligence.
Shortly after our work with Exodus Privacy exposed an entire industry of hidden trackers in Google Play, Google changed its policies to ask Android app developers to "prominently highlight how the user data will be used and have the user provide affirmative consent for such use". Warning screens and verbose agreements often become software malpractice: they not only mask the poison coursing through the system, they sedate the user into a click-through coma.
Now that GDPR has landed, we're seeing challenges to the faux-consent model. Do users have a free choice when they are a captive audience just trying to use a service?
Communication about updated privacy policies may be a mechanism to hide the fact that consent was never asked for or granted by users in the past. Silence and pre-checked boxes may be interpreted as consent, even though GDPR specifically forbids this. When the dust settles, will users even know what they may have consented to, and from which service providers?
The corporate version of GDPR is a bizarre cauldron of doublespeak, intended to elicit B.F. Skinner-style conditioned responses on the part of users. As current trends to undermine, circumvent, and twist GDPR continue, the regulation begins to resemble the Towelie character from South Park, who reminds everyone "Don't forget to bring a towel!" at every possible opportunity. In stark contrast to Douglas Adams's helpful tool for survival and comfort, the towel becomes a ridiculous suggestion that serves no utility. Mere mention of GDPR may elicit the same disdain as Towelie's character, a vehicle for jokes about uselessness and lazy inaction.
“Big Brother, it turned out, was wearing a MAGA cap”
The video conferencing app Zoom has become suddenly ubiquitous over the past few weeks, as the coronavirus shutdown closes schools, businesses, and keeps us all indoors. Shares of Zoom dropped 9% on Monday, adding to their sharp declines in recent days, as security and privacy vulnerabilities are reported. There is also new competition from other […]
“Researchers conclude that Zoom uses non-industry-standard cryptographic techniques with identifiable weaknesses and is not suitable for sensitive communications.”
While all the downsides of stay-at-home orders and social distancing are evident, there are at least a few small silver linings to come out of all this. For many, this time spent indoors has meant a happy reintroduction to your very own kitchen. You know your kitchen. It’s usually the place that holds all your […]
Have you ever had more time to hone in on fine details than right now? Sure, at first glance, this might not seem like the time to get tripped up on the nitty-gritty of minutia. But how often are you ever going to have this much time to really stop and think about hows and […]
There are plenty of productive ways to spend time while stuck indoors. While it’s undoubtedly fun to binge all 15 seasons of Supernatural or sink days of playtime into an Overwatch campaign, learning something new is definitely a more meaningful and long-term beneficial use of open hours. And if you’re going to invest time in […]