Digital Privacy in a Data Based Economy

I. Introduction

Data are to this century what oil was to the last one: a driver of growth and change. Flows of data have created new infrastructure, new businesses, new monopolies, new politics and—crucially—new economics. Digital information is unlike any previous resource; it is extracted, refined, valued, bought and sold in different ways. It changes the rules for markets, and it demands new approaches from regulators. Many a battle will be fought over who should own, and benefit from, data.

Hence in this internet age, The good reason for worrying about the internet giants is privacy. Organizations, citizens and governments are susceptible to trustbusting. It is right to limit the ability of Google and Facebook to use personal data: their services should, for instance, come with default settings guarding privacy, so companies gathering personal information have to ask consumers to opt-in. Europe’s politicians have shown more interest in this than American ones. But to address these concerns, they should regulate companies’ behaviour, not their market power. Some clearer thinking by European politicians would benefit the continent’s citizens.

II. Need for encryption to ensure digital privacy

In Britain, a report into the jihadi-inspired killing of a soldier in London said websites such as Facebook provide a “safe haven for terrorists” to communicate. Such statements echo similar concerns made in America.

This is not how technology firms see it. Apple and Google, for instance, say they are making their mobile operating systems more secure because people and businesses want their data to be protected. This encryption is not only robust but often cannot be disabled. Moreover, it may require little or no effort on the part of a user to render data stored on their devices or being sent to another person impossible for all but the most determined governments or criminal organizations to retrieve.

This is a big change. In the past built-in security, if provided, was often easily subverted. Most devices and software came with the doors wide open, and only geeks knew how to shut them. Now, although plenty of users may not be aware of it, spying on them is getting harder.

Apple, for instance, has encrypted all data passing through its FaceTime and iMessage applications since their inception.WhatsApp, an instant-messaging service with more than 600m users, has adapted a highly regarded open-source system called TextSecure for its app running on Android-based devices. WhatsApp, which is owned by Facebook, provides the new security in a routine update which reduces almost to zero the possibility of messages being intercepted or decrypted. Moxie Marlinspike, one of TextSecure’s developers, says the software was designed to be simple to add to apps. WhatsApp now plans to extend it to devices using other operating systems. Apple and Microsoft have offered full-disk encryption (FDE) for their desktop operating systems for years, in which a user’s login or other token unlocks an encryption key that is then used for all data read from and written to a disk drive. Destroy the key, and the disk’s data is unreadable forever. FDEs were fiddly and slow but now can be turned on during a software upgrade with only a mouse click. Faster processors and custom-made chips also eliminate slowdowns. Android, Apple’s iOS and other mobile platforms adopted similar forms of encryption a few years ago, but the protection has only recently become complete². Apple and Microsoft have offered full-disk encryption (FDE) for their desktop operating systems for years, in which a user’s login or other token unlocks an encryption key that is then used for all data read from and written to a disk drive. Destroy the key, and the disk’s data is unreadable forever. FDEs were fiddly and slow but now can be turned on during a software upgrade with only a mouse click. Faster processors and custom-made chips also eliminate slowdowns. Android, Apple’s iOS and other mobile platforms adopted similar forms of encryption a few years ago, but the protection has only recently become complete. The new level of security builds on efforts by hardware- and software-makers to divorce themselves from the ability to decipher or recover users’ data from mobile devices.

Apple’s Touch ID fingerprint-recognition on iPhones or iPads is a further example. Rather than having its data reside in the normal memory of those devices or have it sent to a secure repository in the cloud, Apple developed custom circuitry it calls Secure Enclave. This incorporates into its processors a way to stash scrambled data into a one-way memory cache that neither the operating system (nor Apple) can directly access.

However, While clamping down on the passage of unencrypted data makes monitoring or intercepting it harder for profit or malicious intent, not all avenues will be closed to the FBI and others. WhatsApp and iMessage offer end-to-end or peer-to-peer encryption, but a secure web interaction still terminates on a server somewhere in a data centre, where the data is decrypted to be acted upon. Apple, for instance, sets up encrypted connections by default to its email servers, but the email itself may be read by those at Apple with access and turned over if required to authorities armed with the necessary legal niceties. Likewise, data stored in the cloud passes to and from Dropbox, Google Drive and other services with strong encryption and is scrambled when it is stored. But those services encrypt the data on their servers using keys that they control, not their users.

III. Data is a highly valued asset

Although signs of the data economy are everywhere, its shape is only now becoming clear. The value of data is increasing. Facebook and Google initially used the data they collected from users to target advertising better. But in recent years, they have discovered that data can be turned into any number of artificial intelligence (AI) or “cognitive” services, some of which will generate new sources of revenue. These services include translation, visual recognition and assessing someone’s personality by sifting through their writings—all of which can be sold to other firms to use in their own products³. The more users write comments, “like” posts and otherwise engage with Facebook, for example, the more it learns about those users and the better targeted the ads on newsfeeds become. Similarly, the more people search on Google, the better its search results turn out.

These firms are always looking for new wells of information. Facebook gets its users to train some of its algorithms, for instance, when they upload and tag pictures of friends. This explains why its computers can now recognize hundreds of millions of people with 98% accuracy. Google’s digital butler, called “Assistant”, gets better at performing tasks and answering questions the more it is used.

Uber, for its part, is best known for its cheap taxi rides. But if the firm is worth an estimated $68bn, it is in part because it owns the biggest pool of data about supply (drivers) and demand (passengers) for personal transportation. Similarly, for most people, Tesla is a maker of fancy electric cars. But its latest models collect mountains of data, which allow the firm to optimize its self-driving algorithms and then update the software accordingly. By the end of last year, the firm had gathered 1.3bn miles-worth of driving data—orders of magnitude more than Waymo, Alphabet’s self-driving-car division.

IV. The privacy mindset of the European Union vs us

While Europe sets some commendable standards like the General Data Protection Regulation (GDPR), which is used to police the use of personal information by major companies and organizations online, it does little for Americans' digital privacy rights.

GDPR was adopted on April 14, 2016, and before it became enforceable on May 25, 2018, the US Congress enacted the Clarifying Lawful Overseas Use of Data (CLOUD) Act on March 23, 2018. Rather than being compatible with the GDPR, the US CLOUD Act overrules it.

Federal law requires U.S.-based software companies and IT service providers to ensure that authorities can have access to all stored data, including data stored on foreign servers. Furthermore, it guards US service providers against having to tell customers whether authorities have requested their data. European companies can object to any data transfer, but the chances are it will end up with the US government, which can share the data as it likes⁴.

Another threat is the government's work with companies (including US big tech) to use technology to collect potentially sensitive health and location information data in the fight against Covid-19. While there are undeniable safety concerns from the global pandemic, the worry from a privacy perspective is that the US government will use people's fears to normalize mass surveillance.

Edward Snowden, as a contractor with Booz Allen Hamilton, Mr Snowden turned against the system and smuggled out files about its spying activities. America’s House Permanent Select Committee on Intelligence recently published its own verdict on Mr Snowden, calling the leak “the largest and most damaging public release of classified information in US intelligence history”. It endangered troops and agents overseas and undermined defences against terrorism. The vast majority of the documents Mr Snowden stole did not touch on the privacy of American citizens. Instead, they revealed details of how the National Security Agency (NSA) spies on non-Americans, including foreign leaders, who do not enjoy constitutional protection. The committee says that America may have to spend hundreds of millions or even billions of dollars to mitigate the damage. Others point out the indirect costs. Private companies were embarrassed by being shown to co-operate with the American authorities. The very fact that the leak took place may lead people and companies to conclude that working with America is not safe.

The example of Snowden's whistleblowing shows that the US hasn't had the best track record for using its data collection powers, all for good or just on a temporary basis. Clearly, the US has a lot of lost ground to be regained when it comes to privacy.

V. The Cambridge Analytica scandal

Aleksandr Kogan, a researcher at Cambridge University, enticed some 270,000 people to take part in a survey in exchange for a small fee. When those users installed the survey app, they shared details about themselves and—unwittingly—their friends, around 50m Facebook users in all, which is how the data on Facebook users was obtained. Surprisingly, before 2015 Facebook’s rules allowed the mining of social connections without each user’s consent. Mr Kogan provided these data to Cambridge Analytica, which then allegedly shared them with customers, including Mr Trump’s campaign. Cambridge Analytica is backed by Robert Mercer, a Republican donor; Steve Bannon, formerly a top adviser to Mr Trump, used to serve as an executive. Although news of Cambridge Analytica’s peddling of Facebook data was first reported in December 2015, the social network reportedly did not respond until eight months later, with a letter asking the firm to delete the data. It seems not to have checked that this was done⁵.

The scandal reverberates through politics as well as the internet. Facebook has built a mammoth advertising business, with sales of around $40bn in 2017, by gathering detailed information about users’ identities and behaviour online and then selling access to them. Facebook tracks users not only on its services, including its eponymous social network and Instagram (which it owns) but across the web. Though political advertising is still a minuscule percentage of Facebook’s revenues, perhaps around 3%, it is a growing and lucrative line. Politicians have found that using Facebook can pay dividends⁶. Even without using illegitimately obtained data to boost targeting, the social-media firm offers precise tools to political campaigns, including reaching users on Facebook whose names, phone numbers and email addresses they already have. Facebook also enables campaigns to target voters who show an interest in the same issues or have similar profiles, packaging them into what it calls “lookalike audiences”. No other Western company apart from Google has such rich data. Micro-targeting someone in order to influence their political behaviour is more sinister.

Mr Zuckerberg’s response to the scandal has been modest. He has apologized and promised thorough audits of third-party app developers and steps to make it easier for users to control their privacy settings. Such basic assurances may not be enough to reverse flagging corporate morale and win back the enthusiasm of users. Trust in social media is already low, and Americans have been spending less time on Facebook, in part because so much of what they see online is negative and dubious. Globally, users spent around 50m hours less per day on Facebook in the fourth quarter of 2017, which translates into a 15% drop in time spent a year over year, according to Mr Wieser.

In July 2019, it was announced that Facebook was to be fined $5 billion by the Federal Trade Commission due to its privacy violations. In October 2019, Facebook agreed to pay a £500,000 fine to the UK Information Commissi-oner's Office for exposing the data of its users to a “serious risk of harm”. In May 2018, Cambridge Analytica filed for Chapter 7 bankruptcy.

The United States Senate Judiciary Committee called witnesses to testify about the data breach and general data privacy. They held two hearings, one focusing on Facebook's role in the breach and privacy on social media, and the other on Cambridge Analytica's role and its impact on data privacy. The former was held on April 10, 2018, where Mark Zuckerberg testified and Senator Chuck Grassley and Senator Dianne Feinstein gave statements. The latter occurred on May 16, 2018, where Professor Eitan Hersh, Dr Mark Jamison, and Christopher Wylie testified, while Senators Grassley and Feinstein again made statements. On May 16, 2018, Christopher Wylie, who is considered the “whistleblower” on Cambridge Analytica and also served as Cambridge Analytica's Director of Research in 2013 and 2014, also testified to the United States Senate Judiciary Committee. He was considered a witness to both British and American authorities, and he claims he decided to whistle-blow to “protect democratic institutions from rogue actors and hostile foreign interference, as well as ensure the safety of Americans online.” He claimed that at Cambridge Analytica, “anything goes” and that Cambridge Analytica was “a corrupting force in the world.” He detailed to Congress how Cambridge Analytica used Facebook's data to categorize people into groups based on political ideology.

VI. Aadhar hack and the perils of digitization

Creating a digital identity system was a triumph for a largely poor and gigantic country like India. Its “Aadhaar” biometric system has created digital identities for 1.3bn people. It has flaws: many Indians who were unable to register have suffered gravely from not being able to access services. But it has streamlined government services and massively reduced fraud. If rural Indians can prove who they are online, it is scandalous that many Brits and Americans cannot.

Unfortunately, things took a turn for the worst when the Unique Identification Authority of India (UIDAI') database was compromised by a software patch that disables critical security features of the software used to enrol new Aadhaar users blowing the lid off what could possibly be one of the biggest data breaches of unique identity database of over a billion Indians. In 2010, the UIDAI allowed private agencies to enrol users to the Aadhaar system in order to speed up enrolments. In the same year, Bengaluru-based Mindtree won a contract to develop an official; standardized enrolment software called the Enrolment Client Multi-Platforma (ECMP )- that would be installed onto the thousands of computers maintained by these private operators.

Instead of using a web-based system in which all software would be installed on the UIDAI's own servers, and enrolment operators would have a user name and password to access the system, software was installed on each enrolment computer.

According to the report, B. Regunath, a software architect who led the team at Mindtree that worked on the project, said a web-based enrolment software for Aadhaar was not practical at the time because many parts of the country had very poor Internet connectivity.

To make data security foolproof, more features were added to the software that was used by Aadhaar enrolment operators. They were required to log in to the software by first providing their own fingerprint or iris scan. Also, a GPS device was attached to verify the location. Unfortunately it was possible for a software hack to bypass these security features.

A software patch, which can be bought for as little as Rs 2,500, allows unauthorized persons based anywhere in the world to generate Aadhaar numbers. Aadhaar patch disables the enrolment software's GPS security feature, which is used to identify the location of enrolment centres. The Aadhaar software patch allowed users to bypass critical security features such as biometric authentication of enrolment operators to generate unauthorized Aadhaar numbers. The report said that the Aadhaar patch disables the enrolment software's GPS security feature, which is used to identify the location of enrolment centres. The patch reduces the sensitivity of the enrolment software's iris-recognition system, making it easier to spoof the software with a photograph of a registered operator rather than requiring the operator to be present in person.

VII. Conclusion

The world economy is centred on data as our lives are on the internet. Prestigious institutions all over the world are generating data scientists, and trailblazing Data Analytics Startups are well on their way to carving out a niche for themselves. The data-analytics industry in Britain was already worth up to £500m ($700m), employing 6,700 people. It was also the fastest-growing bit of the market-research sector, having grown by 350% in the previous four years. PwC found that market research as a whole was worth as much as £4.8bn, already more than the PR and communications industry. Data analytics converts raw data (from a machine’s sensors or a warehouse) into useful predictions (when equipment will fail or what the optimal stocking levels are) with the help of clever algorithms. A booming industry is what generates the need for data.

With the pandemic, we have come to rely increasingly on the internet, even for the most mundane tasks such as shopping for groceries. Student have their timed seminars streamed inconveniently into their parents living rooms, and about a half of white-collar workers work from home. Our migration to the virtual world often entails us disclosing our private information, and without airtight privacy laws, we are susceptible to many of its dangers. As we can see in Cambridge Analytica and Aadhar, Unauthorized access to private information costs us dearly. It somehow provides unscrupulous organizations plenty of incentives to further their shady motives. Before a privacy bill is brought into the parliament, there are certain discussions to be had, such as how transparent data collection should be, what limits there should be on it, how to avoid burdensome regulations. The worlds biggest internet markets are planning to protect personal data. The Cambridge Analytica Fiasco underscored the need to tighten lax regimes and reminded the world that data breaches come with extremely serious repercussions. The General Data Protection Regulation is a tough set of rules imposed by the EU to improve data storage and give individuals more of a say in handling their information and by obliging companies to handle what they should have handled carefully. It is wise to obligate organizations to create an inventory of the personal data they hold.

The right of access to personal data is a fundamental right, and after the Cambridge Analytica Fiasco, the focus of the company, Facebook, has shifted to locking down data from data portability.

*****