Getting Permission To Use HaveIBeenPwned From Your Legal Dept
There’s an on-going battle to influence public opinion about the balance between privacy and surveillance. Law enforcement officials tell us we’re in danger. Security experts offer commentary. A movie is coming out about Snowden. Some participants in the debate are trying to help inform the public. Others are polluting the debate by cynically exploiting people’s fears.
Both sides of the privacy verses surveillance debate have merit. Intelligence agencies and law enforcement need to be able to access information in order to keep us safe. Privacy is also important to keep us safe. There are people around the world for which the exposure of their sexual orientation or thoughts on religion or politics is enough to put them at risk of death or serious injury. There has never been a freedom of expression so meek as to fail to inspire violence by zealots in some far corner of the world.
The debate about the balance between privacy and surveillance is important. The problem is that some participants aren’t helping. They’re polluting. Rather than engage constructively they have resorted to a number of underhand techniques that distract and obscure.
Firstly, some have tried to deny the trade-off between surveillance and privacy. The FBI attempt to force Apple to weaken their security is a good example of this. A world where iPhone users are protected from cyber criminals and repressive regimes is also a world where the FBI won’t always be able to access everything it wants. The converse is also true. If intelligence and law enforcement agencies have back doors to bypass encryption then criminals can discover and exploit those same back doors. We’ve tried back doors before and they don’t work. Remember the special TSA approved luggage locks that had special master keys for airport security? Well instructions on how to make your own are available on the internet. Those proposing magic back doors that only the good guys can use don’t know what they’re talking about or they’re deliberately trying to mislead us. Either way, denying the existence of a trade-off disqualifies you as a credible commentator.
Secondly, cynical attempts have been made to sway the public and avoid a proper debate. An example is using the relatives of terrorist attacks to turn the debate emotional rather than rational. We’re told that if we don’t give law enforcement and intelligence agencies the access they want then they might not be able to prevent future attacks. Thinking rationally, the same argument can be made about search warrants and attorney-client privilege. These occasionally inconvenience law enforcement but exist to serve a greater good. We would have banned them if making the job of law enforcement easy was our single overriding priority. But it’s not. The irony is that we live in a golden age of surveillance. Law enforcement and surveillance agencies have never had it so good.
Thirdly, there’s an absurd notion that companies like Apple were considering themselves ‘above the law’ by choosing to exercise their right to due process. Companies have a duty to use the courts to represent the interests of their customers and their shareholders. To pretend otherwise is to mislead the public.
Privacy vs surveillance is an important debate. Are companies allowed to design effective security for their systems? Even if this means law enforcement and intelligence agencies can’t bypass it? Look beyond phones. What about PGP encryption software? How about cars? Does the public have a right to effective security products or not? Some proponents of surveillance have done a poor job of advancing their argument. But that doesn’t mean they’re wrong.
Security professionals have an important role in this debate. To speak up. To educate. To criticise nonsense when we hear it and help clear the smog. This issue is too important to give up on and isn’t going away any time soon.
Related posts
Currently I always say privacy and security are separate items. A choice can be made on losing on trading one for the other. I consider security to be what we used to protect from unauthorised access and privacy to be what we have to protect us from authorised access.
As we move to an era of mass data collection and more importantly the processing. The concepts of privacy blur with those of civil liberties and changing the government of your part of the world. The question becomes does the lack of privacy hinder a move to more democratic society. Is privacy a requirement of this? Does full information on the citizens change the changes we have seen in the past. We know from many examples the information gathering happens on what we now thing of citizens moving government in the correct direction. So from my view we need to understand more how much private has helped and hinder the directions of civilization and then compare this with how much security has done. Final we must also accept that to gain some things we as I said at the start trade some things that is the hard part to get across to a population in a sound bite.