Privacy Online

What strikes you about the resulting patterns and connections that Lightbeam (and/or NoScript and Privacy Badger) presents to you? Are there any surprises here?

As we will explore more fully below, “privacy” online is not simply a matter of protecting our own personal or sensitive information. Moreover, in an age dominated by our use of social networking sites, microblogging services such as Twitter, shared video sites such as YouTube, etc., our internet use and web-browsing also reveal a great deal about those to whom we are closest. In at least some cultures and contexts, such as Denmark and Norway, what we want to protect is not solely the personal or sensitive information of an individual but also the personal information of those within our “intimate sphere” (intimsfære) – our close circle of friends and family. In these contexts, what is important to protect is not simply individual privacy but our “private life” (privatlivet) as made up by these close relationships.

So, before going much further in thinking about privacy, we need to be clearer about just what we want protected and/or what we have a right to have protected. Hence two questions here:

(i) In terms of the information available about you as you send email and use the Web, just what do you think/feel needs to be kept within your control? Personal and sensitive information about you – and, if so, what counts as such information? And/or personal and sensitive information about those with whom you communicate and interact in various online environments, beginning with your close circle of friends and family?

(ii) Given the amount of information you supply – in the form of your IP address that accompanies your email, and especially the picture of your web-browsing habits and patterns created as various websites and services record your IP address along with your specific visits –

how much “privacy” do you appear to have online? More specifically: given your response to the first question above, do online environments allow you to control and protect the kinds of information you think/feel should be protected, e.g., as a right?

(E) Whatever your responses in (D), explain why. That is, what arguments/evidence/reasons and/or other grounds, including feelings or intuitions, can you appeal to that would justify your response(s)?

Of course, it is no surprise (at least to most of us) that companies, governments, and some savvy individuals have access to extensive databases that record and document individual web-browsing: when coupled with other databases that record, say, your purchases at your favorite store (whether online or offline) and increasingly powerful “data-mining” techniques that cross-correlate this information, such institutions (and at least some hackers) thus learn an astonishing amount of detail about you as an individual consumer. And so it is that Amazon or Facebook, for example, along with thousands of other corporations, are able to “micro-target” advertising precisely to you and tailored to meet your apparent interests and needs.

While much of this may be useful to interested shoppers, or at least benign, it is certainly not without its risks and discomforts. To cite a now classic case: early in 2012, the US chain store Target sent coupons for baby cribs and clothes to a high-school girl. Target’s sophisticated software analysis of the young girl’s shopping activities indicated a high probability that she was pregnant – but the coupons came as a less than pleasant surprise to her father who, until the coupons’ arrival, had not been informed of the situation.

All of this makes clear that IP addresses are indeed “sensitive and personal” (to use the language of EU data privacy protection laws): this is all the more so in an era of Big Data techniques of aggregating the thousands and tens of thousands of “digital breadcrumbs” we leave behind on a daily and weekly basis. But this further helps to highlight the fact that there are important differences between how diverse countries and cultures decide to treat IP addresses. US-based Google has long held that IP addresses are not “personal information”: by contrast, European Union data commissioners ruled in 2008 that IP

addresses are indeed personal information and thus require data privacy protection. More recently, the EU has drafted and implemented even more stringent data privacy regulations as implemented in the GDPR. This is in part as “the maximum fines [for violation of privacy regulations] are now very high” – i.e., up to 4 percent of global gross income. In fact, Google has now been fined c. US$57 million for violation of these new regulations. Stay tuned …

More broadly, we have begun to see that there are indeed strong cultural influences on how we understand and value “privacy” – beginning with strong differences between the United States and the European Union, as these examples make clear. However these contrasting views may be resolved (if at all), here we can continue by noting that it is possible to establish and sustain at least some level of anonymity online: in addition to using security add-ons such as NoScript, you can explore using “anonymizer” software and webmail and web-browsing services that hide this sort of information, beginning with Tor (www.torproject.org/index.html.en). As well, by using encryption software (e.g., the freely available “Pretty Good Privacy” software), users can send emails that can be easily deciphered and read only by recipients who have been given the required encryption key, thereby assuring themselves a reasonably strong degree of privacy. But unless users take these unusual – and, in my experience, not widely familiar – steps, their transmissions across the internet will thus be more or less open to anyone who cares to look.