Surveillance and the Internet of Things

https://www.schneier.com/blog/archives/2013/05/the_eyes_and_ea.html

by Tsiolkovsky • 13 years ago

146 42 13 years ago

Why does he always have to be such a pessimistic grandpa? Privacy as he knows it doesn't exist anymore because majority have made a choice to give it up in exchange of new value created by new technology. I'm unsure of what Bruce Schneier has added of any value to the society lately except his rampant skepticism. To me he's turning into a Richard Stallman of security/privacy.

stephengillie• 13 years ago

At this point, I think this may be the only way in which Schneier can get any attention. Everything else he does is too bizarre to the rest of us to be relevant. Edit: I believe I was incorrect about the email thing.

WickyNilliams• 13 years ago

He doesn't use email like us, therefore his argument is not valid. A slight case of Ad Hominem, don't you think?

Though I am curious as to what that might mean - how does he use email?

rubbingalcohol• 13 years ago

Skepticism _is_ valuable when people otherwise blunder blindly forward. Although, I would like to see proposed solutions with his account of the problem.

crikli• 13 years ago

I read the implication that there isn't a solution; his point seems to be that connected devices are becoming so pervasive that even if you want to avoid them you can't.

The implication, at least to me, is that the only way to avoid it would be to go mountain man (I'm aware that may be a bit non-sequitor). But even that would be a wasted effort should the government, for example, decides it wants to surveil you. I've recently finished reading The Triple Agent (http://www.amazon.com/Triple-Agent-al-Qaeda-Mole-Infiltrated...) and Manhunt (http://www.amazon.com/Manhunt-Ten-Year-Search-Laden-Abbottab...). The capabilities held to detect and surveil are staggering and the abilities developed over the last decade to find and capture/kill are impressive and a bit scary.

cytzol• 13 years ago

The majority have made a choice, but not a conscious choice. Not only do many people still chase the latest shiny thing or hand over their details willy-billy without thinking of the consequences, but it's quickly becoming the default to do so, making it even less of a choice, and more just what you do in everyday life!

There are plenty of things I've found worth trading my privacy for, but it's been a conscious choice every time.

alan_cx• 13 years ago

Do you really have a choice?

Some things you really need to sign up for, like say signing up for an internet connection, but you have no choice about what happens to your data. You know almost all ISPs will roll over if any authority wants your data from them. You just have to accept it if you want the service, and often things are vital services. Its not much of a choice.

progrock2• 13 years ago

Funny you say that. A lot of retail chains in the UK, ask for your postcode as you make a purchase, and basically identify you. I'm never comfortable with that arrangement, but hand out the data anyway, basically because I don't want to make a scene in public.

I like the way you've phrased it: not a conscious choice. I wouldn't say that ignorance is an active part in choice making. But it certainly feels less complicated.

_seininn• 13 years ago

And we need people like Richard Stallman to provide a contrast. That said, I think the guy provided a fair article on how things might turn out based on how they are currently progressing.

kaoD• 13 years ago

> To me he's turning into a Richard Stallman of security/privacy.

Which means... that he's always right?

Richard Stallman is usually dismissed due to his eccentricity, but he's ALWAYS right. AL-WAYS.

I lost track on how many times I've seen the internet raging about something while I think "Richard Stallman told you so".

sp332• 13 years ago

You're saying, even though the near future will be as he describes, we shouldn't worry about it because most people prefer things that way?

jiggy2011• 13 years ago

I think the issue is that people outside of our space often fail to fully understand how information can be collected on them and how much analysis is possible.

For example, people don't necessarily really understand basic stuff like client/server architecture and believe that their facebook profile just "is" without thinking that every time they do something on facebook a row is being added to a relational database on a computer that is somebody elses private property.

And that row will probably never be deleted regardless of how they toggle their privacy settings.

betterunix• 13 years ago

I think you are overestimating the majority's ability to make an informed decision on these issues. Most people are still shocked by the idea of web servers keeping logs, let alone the privacy implications of their decision to use GMail or Facebook.

asmithmd1• 13 years ago

I work in the IoT space and I try to temper my enthusiasm for it when I talk to non tech people. After giving some cool examples I tell people,

"Soon, Moore's Law will make it cheap enough to connect everything you own to the Internet - it is not a question of if, just when. All your things may or may not talk to you; but they will definitely be talking to each other about you."

squozzer• 13 years ago

I think it is up to us to figure out how to make this brave new world work.

As Bruce says, the real issue now is not surveillance or even information, but power. Who gets to watch whom, and (of course) who watches the watchers?

I see four strategies for coping with the issue of power --

1) Default - maintain current trajectory - this is what most of us will do.

2) Withdraw - lower one's profile. This seems to be Bruce's plan.

3) Expose - bring buried secrets to light, and the watchers under surveillance. Expect harsh repercussions. The US govt has been increasingly secretive. It has been removing whistleblower protections for some years now. It has been punishing exposures of information more harshly than in the past (though I suppose the exposure of Valerie Plame might pass as an exception, unless your name is Scooter Libby.)

4) Disrupt -- frustrate the collection of information through jamming, feeding false info, deletion. But info seems to be cheap enough that bad info doesn't really hurt those using it.

sinnerswing• 13 years ago

> As Bruce says, the real issue now is not surveillance or even information, but power. Who gets to watch whom, and (of course) who watches the watchers?

I couldn't agree more.

"Fox News Reporter James Rosen’s Private Emails Given To Justice Dept. By Google"

http://apps.washingtonpost.com/g/page/local/affidavit-for-se...

cmnzs• 13 years ago

I think breaking down those strategies is actually really useful. It's interesting to think of these strategies from a product development perspective as well; how will products react to new consumer strategies?

1) Default - most products will (I think) continue to collect as much data as they can

2) Withdraw - I doubt most companies will withdraw from the data collection frenzy that is the current marketplace

3) Expose - There's definitely room out there for more services that expose patterns in public data, or more mechanisms for publicizing private data (the New Yorker Strongbox, for example)

4) Disrupt - One example in this space that I love are location spoofers like MediaHint, that allow users to access content that is designed to be location-locked.

knowaveragejoe• 13 years ago

Additionally, we should be voting with our money on services that embrace privacy and plausible deniability as a core design tenant. Unfortunately at the moment there aren't many good examples that I'm aware of, the most noteworthy would be Mega(assuming it lives up to what they claim).

itistoday2• 13 years ago

Shameless plug re plausible deniability: http://www.espionageapp.com

It's nice because in the next update (to be released this month, v3.5), you'll be able to do things like encrypting your email and having it in two different versions of it (one for you, and one for those you don't want knowing what your actual email is). You can already do it in the current version, it's just not as user-friendly.

It will only protect data that's kept encrypted on your local drive though, so with the example of email, it doesn't protect you from the government if your email is also stored on Google's servers.

legutierr2• 13 years ago

There is a fifth option, which is to construct through the democratic process a new set of civil rights and policies designed to confront and limit these new powers.

For example: we can seek to make it illegal for certain information to be tracked; we can require that any information collected be disclosed to the individual at risk of being tracked; we can expand fourth-amendment protections explicitly, forcing a warrant to be issued to collect any of the information made available through these systems, even if the data is stored on a corporate server (doing away with national security letters and administrative subpoenas, and prohibiting disclosure without a warrant); and we can impose criminal penalties on government and corporate officials that violate these rights.

And more: we can make exposure of all but the most sensitive government "secrets" mandatory by law, rather than relying on legally questionable whistle-blowing for disclosures; we can ensure that encryption technologies (and other self-protection techniques) always remain legal, and remove any requirement that backdoors be added to new communication technology; we can work to decentralize corporate power in telecom by aggressively enforcing anti-trust laws; we can improve transparency and oversight of telecom services by explicitly encouraging that high-speed data service be provided as a local public utility.

And we can reduce the incentive that exists at every level of law enforcement to undermine privacy and civil liberties (and in turn further centralize power) by making fewer things illegal--most importantly, drugs.

sedev• 13 years ago

While I'd love for those things to come to pass, it's alarming that you elide methods and obstacles entirely. The democratic process has been purchased by the entities you're proposing to regulate, and the entities that you propose enforce these new rules, are beneficiaries of the current arrangement and would be greatly inconvenienced by the changes you propose. The beneficiaries of the current arrangement will resist changes to that arrangement with utmost vigor, so it doesn't speak well of your proposal that it supposes that they will cooperate with changes that are against their interests by handwaved methods and tactics.

How are you going to get from here to there?

stinkytaco2• 13 years ago

I think this is the correct course of action. No matter what amount of privacy we have, and I think we are entitled to a lot of it, nothing stops someone who has more power from exploiting someone who has less. All the encryption in the world doesn't stop someone from breaking down a door and breaking the code with a rubber hose, so to speak. What does stop people from doing this is a very strong social stigma against this kind of behavior. Or at least it was a very strong social stigma, it seems to be breaking down if you are of a certain color or religion now.

Only by maintaining the social stigma can we really protect ourselves.

This is, at its core, a social issue, not a technological one.

wyager• 13 years ago

Some people don't mind being tracked, and some people prefer it (because it can increase the quality and relevance of services offered to them). I can't think of a reason we should outright deny such services from existing. Additionally, such regulations would probably end up applying only to corporations (who are usually not malicious, and only want my money) but not applying to governments, who can cite "national security" concerns to justify tracking people anyway.

As for mandating government transparency and protecting encryption, I think those could have a lot of potential to help without unfairly limiting any person or group. And I agree, we should make fewer things illegal, which is another reason it might not be smart to make collecting consumer data illegal.

cottonseed2• 13 years ago

Speaking of feeling like science fiction, I wish everyone had read David Brin's The Transparent Society in 1998. Such a prescient book.

https://en.wikipedia.org/wiki/The_Transparent_Society

cottonseed2• 13 years ago

Some replied with this (somewhat old) response by Bruce Schneier to the Transparent Society:

http://www.wired.com/politics/security/commentary/securityma...

It is an interesting response, although I don't think I agree with his argument. I'm not sure why they deleted it.

tripzilch• 13 years ago

from one of the comments:

> Bruce, it is getting depressing to read your posts. You don't prescribe any kind of resolution such as calling your congressperson.

(I hope they were being facetious with this remark)

snowwrestler• 13 years ago

Why? Calling members of Congress is incredibly effective, especially in large volumes. Organizing politically has always been the way to create real, durable change in the law. It's how the U.S. got labor, civil rights, and environmental protections enshrined in the law despite well-funded opposition.

I know it's very cool these days in Internet-land to consider the system too broken to engage, but that seems to me to be a self-fulfilling prophecy.

smacktoward• 13 years ago

It's effective on an individual level, but just telling people "call your congressperson" doesn't scale. Most people are too busy to individually monitor each bill, vet it on privacy, and decide whether or not a call is needed. So to really effect change you need an organized movement or interest group that can pool the voices and resources of all those people together into something so big it can't be ignored.

Currently the only group like that I know of on technology & privacy is the EFF, but so many corporate giants have an interest in eroding your privacy that you'd need to bulk up their funding base considerably to make them able to take those giants on directly. (Or go the other direction, people-power rather than money-power, and develop a base of activists who are willing to march for privacy.)

vhost-• 13 years ago

Can you cite some sources with data that proves calling members of Congress is effective?

I don't know if it is or not and I see those words spoken a lot without any sort of proof.

D9u• 13 years ago

We don't have to use Google, nor Facebook, and we can still buy prepaid mobile phones with cash, and it's up to us just how much information we share online.

Maybe I'm a hermit, but I'm online every day and images associated with my name are quite scarce.

Add to that the fact that there are literally dozens of Americans who share my exact name, my privacy worries are negligle within the context proposed by the author.

That said, I do agree with the premise that surveillance is growing increasingly intrusive, thus my habits outlined above.

Surveillance and the Internet of Things

Related Stories