Defending The Kingdom

A better than nothing video guide to asking Google not to keep as much information about your online behavior as they otherwise might.

It’s still a black box, though, and the only real assurance you have is that Google has some incentives to stay nice. It doesn’t always work out that way, of course.

In Google’s favor, notice how complete domination of the search market has lead the company to provide services that look a lot like public goods. Here is Wikiipedia on public goods.

The NY Times has an interesting article about targeted advertisements that follow people around the web:

Julie Matlin was tempted by a pair of shoes on Zappos.com. Then the shoes started showing up in ads on other sites she visited.

Then the shoes started to follow her everywhere she went online. An ad for those very shoes showed up on the blog TechCrunch. It popped up again on several other blogs and on Twitpic. It was as if Zappos had unleashed a persistent salesman who wouldn’t take no for an answer.

That sounds creepy. Nobody wants to feel watched while surfing the web — it’s just too much like having your mind read. Perhaps that’s not too worrying when you’re shopping for shoes, but what about when you’re looking for information about that skin rash that won’t go away?

It used to be easy to prevent the problem described by the woman in the Times story, but now there are sneakier ways to track users across websites. Now you need something like this Firefox add-on to thoroughly purge your browser of tracking technologies.

But does anyone really care?

There’s nothing easier than drumming up a bit of indignation for a news story. But does anyone really care about being tracked this way? Sure, all else equal, most of us would pick more privacy rather than less. But the real question is whether anyone is willing to pay for that privacy.

The metaphor of a persistent salesman who won’t take “no” for an answer is an illuminating one. Just as some stores try to attract customers by telling them about their easy-going, non commission-based salespeople, some websites could differentiate themselves from the competition by telling internet users that they won’t install invasive tracking technologies.

We may yet see something like that, but I have my doubts. People like privacy, but they like getting great content and services cheaply, too. Websites that earn extra money by intruding on their customers’ privacy are likely going to outcompete websites that don’t if web user preferences lean more toward getting stuff cheaply than maintaining privacy. There is no easier place for experimentation with business practices than the web, so the dearth of websites that compete on the margin of privacy suggests that there probably isn’t much demand for it.

Government regulation of privacy

Right now, there is a debate at the Economist about whether governments should more heavily regulate online privacy issues. This blog has always been in favour of things that help people protect their privacy, but I have also stressed the importance of considering the costs of doing so. To my ear, government intervention to enhance privacy protections online sounds like forcing internet users to accept a different bundle of cheap content, quality services, and privacy than they currently want.

A quote from the primary proponent of regulation in the Economist debate highlights this:

…it is hard to imagine that the typical internet user can really do much to safeguard their privacy when companies purposefully make it so difficult.

Let’s imagine an (admittedly weird) alternate world where the current Economist debate is about the problem that all brick and mortar stores must be entered via doors that measure a mere 3 feet in height. One of the proponents of government regulation for bigger doors says:

…it is hard to imagine that the typical shopper can really do much to improve their shopping experience when companies purposefully make it so difficult to fit in the entrance.

It’s laughable because we know how easy it would be for stores to install larger doors and capture the customers who are dissatisfied with the doggy door experience. When you realize that privacy is something that can and is bought and sold today just like any other commodity, you have to admit that a lack of concern on the part of businesses when it comes to privacy issues may just mean there is limited demand for it from most consumers’ point of view. And, in fact, it is possible that the current equilibrium is pareto optimal.

On Tuesday last week, The Economist keenly observed that:

Whenever you read about a dispute between a web-based service and a country, you need to ask yourself only one question: where is the server located?

BlackBerry servers are located in Canada, and data is encrypted when it is sent from one phone to another. That’s a problem for countries that want to intercept and monitor information sent across BlackBerry networks. From The Economist article:

Countries have two basic technical methods of controlling the flow of information over the internet. First, they claim legal jurisdiction over information stored on servers within their own borders. Second, they can read or block traffic moving through the choke-points where internet cables cross the border.

Neither of those options is available to countries wanting to spy on BlackBerry users, which is why Research In Motion, the makers of the BlackBerry, have been getting flack from the governments of India, Lebanon, Saudi Arabia and now the UAE:

The UAE’s Telecommunications Regulatory Authority said it would suspend BlackBerry Messenger, email and Web browsing services beginning on October 11th if RIM does not provide a solution for local messaging control.

Fortunately, Research In Motion told its customers not to worry:

The BlackBerry security architecture for enterprise customers is purposefully designed to exclude the capability for RIM or any third party to read encrypted information under any circumstances. RIM would simply be unable to accommodate any request for a copy of a customer’s encryption key since at no time does RIM, or any wireless network operator, ever possess a copy of the key.

Unfortunately, Research In Motion quickly made a deal with the government of Saudi Arabia that undoes those fine intentions:

The agreement, which would involves placing a BlackBerry server inside Saudi Arabia, would allow the government to monitor users’ messages and allay official fears the service could be used for criminal purposes.

A similar deal with the UAE is likely to follow.

Staying secure when eavesdropping is a risk: VPNs

This brings up a general point about safe internet use in any setting where third parties — including governments, your ISP, or the guy next to you in the coffee shop sharing that WiFi hotspot — may be able to peek at your communications. A commentator at The Economist’s article wisely noted that:

…one can go to any hotel in Dubai, hop on its wifi with your laptop and use your own VPN (or company VPN in my case), effectively blocking them from seeing your communications.

Although it may be illegal to do so depending on your location, and I’m in favour of following the laws in the country you’re in, using a VPN may be a good idea in some scenarios.

The best explanation of VPNs I’ve read is from HowStuffWorks.com, which suggests the analogy of the internet as an ocean and most internet traffic as being like a ferry from one island to another. When you’re on a ferry, everyone can see who you are and what you are doing. It’s public.

A VPN, on the other hand, is like a submarine that allows you to travel underwater from island to island. Some savvy observers of the ocean (your ISP, for example) may know that you are in a submarine, but they won’t know your ultimate destination or what’s inside of the submarine (i.e., the information you are transferring from your computer to the destination computer).

To use a VPN, you simply need to install VPN software on your computer (some suggestions are provided below), connect to the internet, start the VPN software, then proceed to browse the net.

Drawbacks of VPNs

As with any security solution, VPNs have some drawbacks:

1. You have to trust the VPN provider more than you trust your current connection. There’s no way around this if you’re using a commercial VPN (highly technical users can set up their own VPN servers to get around this problem, but the process is too difficult for most of us). The best assurance any VPN company can give you is something like this:
   

   What needs to be understood, is that our livelihood depends on keeping you safe and honoring your privacy. If we ever compromised that, unwillingly or with bad intent, I would imagine word would get out pretty fast. I can say that here at WiTopia, we take it very very seriously.

2. They slow your browsing/VOIPing/messaging. Because of the encryption/decryption process and because your internet communications are first routed to your VPN’s servers before being routed to the ultimate destination, you’ll probably notice some lag.

A few VPN companies

I can’t promise that these companies will keep your information secure. There is no such thing as perfect security. If it’s important to you, you need to do the background research and decide for yourself if using a VPN is safer than the alternative. That said, here are two companies that were discussed by CNET and one that a friend recommended to me:

1. WiTopia
2. HotSpotVPN
3. proXPN, which is free and has a Facebook page where the company often answers user questions

Added 10 Aug 2010: U.S. authorities are already able to tap BlackBerry messages. And Bruce Schneier noted a few days ago that:

The UAE can’t eavesdrop on BlackBerry traffic because it is encrypted between RIM’s servers and the phones. That makes sense, but conventional e-mail services are no different. Gmail, for example, is encrypted between Google’s servers and the users’ computers. So are most other webmail services. Is the mobile nature of BlackBerrys really that different? Is it really not a problem that any smart phone can access webmail through an encrypted SSL tunnel?

Any site that asks for a username and password pertaining to another site should raise red flags for you, but apparently contact scraping is getting results:

Once you enter your credentials, like your [email] user name or password, the company sweeps through your contact list and sends everyone an invitation to join the site.

Nothing new here, but the tactic can be tough to spot. Facebook has nearly tricked me into giving up all of my email contacts a couple of times.

From Wired:

A Chinese-language version of Skype scans users’ chat messages for keywords such as “democracy,” and sends a copy of the offending message to the company’s servers, according to a report released Thursday by a Canadian online human rights group.

That’s despite adamant claims by the Ebay-owned company that its software offers encrypted, safe communication.

Emails, too, often prove less than private. The hacking of Governor Sarah Palin’s Yahoo account is only the most recent example.

Bottom line

if you would be unable to bear the consequences of your communication getting intercepted, you probably shouldn’t send it by Skype, email, or any other electronic medium. Of course, even snail mail can be intercepted, face-to-face conversations recorded. No communication method is perfectly secure, and, as always, you must make make tradeoffs between security and convenience. Few of us would be satisfied to go the tin foil hat route.