Security and Privacy on Cloud - [Part 2]

Author: Smitha HS

For Part one: Please click on this link: http://www.lawinfowire.com/articleinfo/security-privacy-on-cloud-part-1

What does privacy mean in the digital world?

Introduction

Privacy is the ability of an individual to be free from being observed or disturbed by other people. It is the right of the individual to reveal oneself or any information about oneself either entirely or selectively. Privacy is also sometimes anonymity where an individual can reveal himself anonymously or adopt a pseudonym to maintain his privacy. Does this definition or understanding of privacy needs to change if the individual is on the Internet? What does privacy mean in the digital world? Is it possible to remain anonymous on the internet? This article attempts to answer these questions.

Privacy on the internet 

“You have zero privacy anyway, get over it” – Scott McNealy, Sun Microsystems, 1999 .

Transposing the general definition of privacy to the cyberspace, privacy on the internet is right of an individual in respect of storing, repurposing, sharing and displaying of his personal information on the internet. The personal information can be both Personally Identifying Information (PII) and non-PII.  Personally identifying information includes but is not limited to name, email, IP address, Digital identity (eg. public key), telephone number and screen name (eg. twitter handle).  Non-PII can include internet behavior (eg. likes on Facebook, Flipkart wishlist).

On November 20th 2013, the United Nations General Assembly adopted a draft resolution (approved without vote) on what privacy means in the digital world.

The UN General assembly called upon its members to

To review their procedures, practices and legislation regarding the surveillance of communications, their interception and collection of personal data, including mass surveillance, interception and collection, with a view to upholding the right to privacy by ensuring the full and effective implementation of all their obligations under international human rights law.” – UN A/C.3/68/L.45/Rev.1

This resolution follows the recent revelations about Unites States surveillance worldwide and notes that new technologies that increase the ability for surveillance, interception and data collection by governments, companies and individuals “may violate or abuse human rights, in particular the right to privacy”

The draft resolution reiterates that privacy is a fundamental human right.  Right to privacy is as essential as right to liberty and freedom of a human being. More importantly it provides that all rights people have offline must also be protected online including the right to privacy.

Anonymity on the Internet 

“The only true protection is to understand that anything you put up there can be accessed by somebody else,” – John Simpson, Consumer Watchdog

In the initial times of the internet, anonymous communication was perceived as the cornerstone of internet culture. It was greatly appreciated of promoting free speech and sharing amongst the netizens.  American Association for the Advancement of Science’s conference on “Anonymous Communication Policies for the Internet” found that “the online communication is morally neutral” and “it should be considered a strong human and constitutional right”.

The myriad ways in which the technology has grown since then alters this perception rapidly. Now, there is every reason to be gloomy at the prospect of privacy on the Internet. Telecom Service Providers, Internet Service Providers and all websites collect large amounts of data to gather more and more private and personal information of an online consumer.  This data is a treasure trove of information when connected with each other can reveal the privacy of an online consumer more than he ever wanted to! Everyone from third party marketing companies to Law enforcement agencies want to lay their hands on this data.

An individual’s online activity and third party plugins (eg. twitter or facebook button) compound the privacy problems even more than what an individual can experience in the offline world. Technologies like cookie proliferation wherein invisible cookie software tracks browsing habits and collects personal information across websites without user’s knowledge pose a huge threat. 

The Internet does provide a veil of anonymity albeit not entirely. Location data makes it increasingly difficult for individuals to visit websites on the internet without someone knowing exactly where he is at any given time. The web-based services are cleverly designed to tempt the user to give away his location without much pondering. (Eg. Google Maps, Just Dial etc.) For instance, anyone can create an anonymous email ID, set up a social media account and maintain their presence online without revealing their true identity. But enforcement agencies can always track down a person online based on details like the websites visited, IP address, and mobile number.

Mass and targeted surveillance by law enforcement agencies can scan any individual’s online behavior in the name of cyber security. Every cutting edge web service or mobile device comes to the marker is equipped with fringes that make surveillance more and more simpler and tighter.

Internet users must take adequate precautions before entering any Personally Identifiable Information to check if the website has a privacy policy. There is no need to provide any more information than one is not comfortable revealing. Before posting on social media websites, it is important to understand the consequences of making one’s opinion public. Often the information willingly provided by an individual to these social media websites can prove to be more dangerous to him than the data that can be collected through targeted or mass surveillance by his ISP or law enforcement agencies.

Using encryption or Anonymizing services (eg. Onion router) and most importantly taking an informed decision to disclose one’s personal data online can eliminate the threat to data privacy.

Conclusion 

“ Privacy protects us from abuses by those in power, even if we're doing nothing wrong at the time of surveillance.” - Bruce Schneier, The Vaue of Privacy

The privacy debate is no longer about protecting an individual’s privacy. The symbolic resolution passed by the United Nations also reflects concerns among governments around the world on the impact of international surveillance on its people and leaders. Existing human right laws need to be updated include rights of individuals in times of modern surveillance techniques. Several groups of human rights activists and privacy organizations have started initiatives to protect privacy as a fundamental human right in the age of digital surveillance. Privacy does not need to be necessarily compromised in view of security.  Bruce Schneier says that the real choice is liberty versus control. Liberty requires security without intrusion, security plus privacy.