Sunday, 5 June 2011

Out of the mouths of Europeans?

We in Britain can often be highly suspicious of things that come out of Europe – and particularly so when it comes to laws. There’s a level of distrust, a degree of distain and sometimes a sense that these ‘continentals’ really don’t know what they’re talking about, and that somehow we need to save them from themselves.

Two prime examples of this are current in the world of privacy law. Two pieces of legislation, one current, one proposed, have been given the disdainful British attitude over recent months.

The first is the so called 'Cookie Directive' which came into force on May 26th, essentially suggesting that installing or amending any cookie on any user’s computer would require prior, explicit and informed consent. A strong requirement, and one that was launched amid confusion and complaints – needing to be clarified not just by the issuance of advice by the ICO but subsequently 'clarified' by the DCMS in a way that many people thought just added more confusion. The attitude from ministers that suggested they really thought it was essentially stupid and that complying with it was pretty much irrelevant. The Open Rights Group summed it up well, suggesting that Ed Vaizey thought it was all meaningless.

The second is the proposed ‘right to be forgotten’ - an idea currently being pushed by European Commissioner Viviane Redding for inclusion in the forthcoming revision to the Data Protection Directive. This time it was Ken Clarke's turn to be dismissive and disdainful, suggesting in a speech to the British Chamber of Commerce in Brussels that it was unworkable and, in essence, that the Europeans need to listen more to the British. As he put it:

'I am optimistic that there's a common sense solution on this. Our experience in the UK is that security, freedom and privacy are possible.'

Perhaps, however, it's us, the British, who need to listen more to the Europeans rather than vice versa. For sure, there are problems with both of these two issues. The cookies directive is highly problematic, probably over-the-top, somewhat confused, and clearly very hard to work out in practice - which is why only three of the 27 member states had actually implemented it within the prescribed timescale. The right to be forgotten is ill-defined, also confused, and capable of producing over-emotional reactions - which is why I've blogged in the past about renaming and refocusing it - and clearly needs more thought. Both, however, exist for good reasons - and the problems with them should not blind us to those reasons.

The cookies directive was brought in because people are, justifiably, concerned about being tracked, profiled and monitored without their permission, knowledge or understanding. The right to be forgotten is being considered because people are, equally justifiably, concerned about the amount of data being gathered and held about them, and the purposes to which all this data is being put. These are genuine concerns, connected with real rights of great importance - and so far the internet industry and most governments (and particularly the UK government) have paid scant attention to them, and done little to allay our fears or deal with the problems. The European Parliament and Commissioner Redding understand those fears - and want to do something about it. Their reactions may not exactly work, and may even cause more problems than they solve - but they have at least tried to address the issues. Rather than react with disdain and superiority, it would be far better if our ministers listened a little more - and understood that they need to do something....

Tuesday, 26 April 2011

Dogs will be dogs...


The growing furore over the gathering and retention of location data by smartphones reminds me very strongly of a joke that I heard first in the school playground many years ago. ‘Why does a dog lick his balls? Because he can.’

The same is true about smartphone operators. Why do they gather location data? Because they can. Technically, they can, because of the very nature of smartphones. Legally they can, because our laws over this kind of thing are obtuse and opaque – and because they understand the way they can get ‘consent’ through the small print of terms and conditions that no-one ever reads, let alone understands.

A lot of the discussion about the current furore has centred around the individual companies concerned, and brought out all the usual views of the merits or otherwise of Apple, Google and Microsoft – but whether you consider each of them to be fancified show-bred French poodles, friendly and loveable Labradors or ageing but far from toothless Rottweilers, they’re all dogs, and dogs will be dogs. Even the best behaved and most presentable show dog will lick his balls if he’s allowed to.

Three questions arise for me. Firstly, why are people surprised? Many people seem to be genuinely shocked by what has been revealed – even people who know a great deal about the subject. Is it really such a surprise? We’ve known about the capabilities of smartphones since they first emerged, and about the behaviour of all the companies involved for even longer. Dogs will be dogs.

The second question is whether any of it matters – and for me the answer is clear. Of course it matters, and matters a lot. That doesn’t mean that we need to panic, or need to throw our iPhones, Blackberries and HTCs in the nearest river – just that we need to aware of what is going on, and do what we can to ameliorate or manage the situation.

That brings me to the last question – what, if anything, can be done about it? Well, if we were talking about dogs, the answer would be simple: make sure they’re well trained, and well managed. If badly looked after, dogs behave badly. If they’re well trained, they can be very useful, helpful and excellent pets. They can help us in our personal lives, in our work and in many social situations – but you still need to train them and manage them. We need to do the same for the likes of Apple, Google and Microsoft. Show them who’s boss – using all the tools we can to do so. That means putting the right laws in place, but also using our powers as consumers, as advocates, and lobbyists.

If dogs know what they can do and what they can’t, they’ll behave much better. It's very hard to train a dog not to lick his balls - and probably just as hard to train companies like Apple, Google and Microsoft not to push the limits of privacy - but it can be done. We need to tell them that this kind of thing is not acceptable – and back up what we say with the law and with our money. If we don’t want our location data gathered, we need to be clear about it.

My personal view is that we have the right not to have this kind of thing happen to us - and that we need to proclaim that right (and other rights) loud and clear.


Thursday, 21 April 2011

The real challenge for IT Lawyers: the law!

Sometimes it's tempting for an IT lawyer - or rather an academic IT lawyer - to feel that things are moving essentially in the right direction, that the subject is getting more mainstream, more understandable - and more importantly, more understood. In some ways, of course, that's true - but in others, we need to remember that things are far from positive, and that in many ways the 'establishment' - the legal system, the politicians, even the public - still don't really 'get it' at all. Perhaps the most important of these is the legal system. To a significant extent it seems as though the legal system - and the law - is just completely out of kilter with the reality of the IT world, and in particular the internet.

A couple of things in recent weeks have driven that home to me. Neither was surprising, but both were disappointing, particularly to those of us interested in privacy and autonomy. First of all, there was the announcement that there won't be any prosecutions arising from the Phorm secret trials, something which has been greeted with dismay by privacy advocates. Secondly, and most recently, was the failure of the judicial review to overturn the Digital Economy Act.

In both cases, it's easy to see how the results came about - and indeed to argue that from a precise legal standpoint the results might have been technically correct. In both - and in the case of the Digital Economy Act in particular - it shows that the legal system really doesn't understand what's going on in the internet, and how our online world functions. The Digital Economy Act - in its provisions concerning the policing of illegal downloading - is so clearly inappropriate that it's hard to find an academic lawyer in the field who believes it's appropriate or proportionate, or even who believes that it stands any real chance of being effective. Precisely the opposite. It won't work. It misses the point. It will victimise the innocent. It shows a fundamental misunderstanding of both the nature of the internet and the habits of most of those who use it. It's such a bad law it just makes many of us shake our heads in disbelief.

The Phorm story is a little less dramatic, but demonstrates some similar features. The CPS have decided not to prosecute - and they may be right that there might not be much chance of a result. That, however, just reveals that our legal system doesn't have the teeth or the capability to deal with the reality of the internet - for what Phorm and BT did was something that the law should have been able to deal with. It was a serious invasion of privacy on a very serious scale - secretly tracking the entire internet activities of 30,000 people without their knowledge or consent - and yet the law seems to be incapable of dealing with it, incapable of providing people with the kind of protection that people need. The kind of protection that people have a right to expect. The law should do this - and in its current form it doesn't.

In the grand scheme of things, neither of these two incidents are likely to matter in the end. Despite the failures of the law, Phorm still failed, brought down by a combination of the privacy advocacy of such excellent groups as the Open Rights Group and the Foundation for Information Policy Research, interventions by the European Commission, and the belated intelligence of businesses like BT who withdrew their support as they began to understand how things really work. Similarly, the Digital Economy Act is likely to end up an irrelevance, as the people who it is intended to catch find ways to sidestep it, as further legal challenges arise, and as embarrassing prosecutions fail - and something that gets closer to understanding the reality of the situation is brought in to replace it.

It feels, though, as if the legal system needs to be dragged kicking and screaming into the modern world. That's the challenge for IT lawyers. People are thinking and writing interesting, informative and insightful things about the nature of the internet - but right now, it isn't being sufficiently read or understood, and certainly isn't finding its way into the mindsets of those creating or enforcing the law. It needs to be - for though other forces will (and have, in the case of Phorm) stop many of the worst things from happening, without the law being 'fit for purpose' everything is a struggle, and many people suffer along the way.

Wednesday, 13 April 2011

Let's forget the right to be forgotten...

....and talk about the important part of that right in less emotive, less distracting, and more accurate terms. I'm not interested in rewriting or erasing history, I'm not interested in hiding my past - selectively or completely. I am, however, interested in cutting down the amount of data held about me for spurious purposes, and interested in having more control over what commercial enterprises do with the data they have on me. I don't want a right to be forgotten - I want a right to delete personal data!

I asked a question about this at the Westminster Media Forum a few weeks ago, and gave a presentation on the subject at BILETA in Manchester yesterday - but I think the subject needs more attention. At the Westminster Media Forum, there was a particularly acerbic attack on the right to forgotten by journalist Tessa Mayes, who seemed to think that the right was all about restricting journalists' rights to report on past events. At BILETA, even though I made the point very directly that the right to delete data isn't the same as a right to be forgotten, one of the biggest questions I got was actually exactly about how such a right would effectively mess up the historical archive that the internet provides. For me, the right to delete data isn't like that at all - but calling it a right to be forgotten can easily mislead people into thinking it is.

The right to delete, as I set it out in my presentation (slides of which are available by email), is something that allows individuals control over what data is held about them - but it has a number of specific exceptions, situations where data should be allowed to be kept, regardless of the desire of the individual concerned. They include examples such as medical records, criminal records, electoral rolls and so forth - and appropriate historical archives. All that should be clear - and should prevent the problems that would be associated with a real 'right to be forgotten'.

The point is, though, that those holding data should need to justify that holding - rather than the individual justify why they would like data to be removed. If there ARE good reasons to hold data, then say so. If not, then the individual should have the right to delete it. The key thing to understand, though, is that BUSINESS reasons - and in particular the fact that you can make money out of holding someone's data - are not sufficiently strong to override someones right to delete data. Privacy is more important than that.

Forgetting is important too - as Viktor Mayer-Schönberger has described so eloquently and compellingly in his excellent book Delete - but, as Mayer-Schönberger himself suggests, rights may not be the best way to bring it about. Talking about a bald 'right to be forgotten' doesn't really help either the understanding of what is a complex and important issue, or about dealing with the important both practical and ethical issues surrounding rights over personal data.

So let's forget about the right to be forgotten - but fight strongly for the right to delete personal data.

Tuesday, 22 March 2011

The ICO: between a rock and a hard place? Not really...

In the last week I've been to two events in which representatives of the Information Commissioner's Office have spoken. First came the 16th March meeting of the Society for Computers and Law entitled 'Privacy by Design: Grand Design or Pipe Dream?' at which Steve Wood, the ICO's 'Head of Policy Design' spoke to a mixed group of lawyers of various kinds, some representing companies in the computing business. Then, on 22nd March, the Information Commissioner himself, Christopher Graham, spoke to the Westminster Media Forum, which was discussing 'Social media, online privacy and the 'right to be forgotten'.

On both occasions, the representatives of the ICO had a pretty rough ride, one way or another. At the first meeting, Steve Wood was given a hard time by people working in or for the people providing online services for the way that the ICO has dealt with the 'EU Cookie Directive', about which the ICO has recently issued a warning, suggesting that 'UK businesses must ‘wake up’ to new EU law on cookies'. To put it at its most basic, the ICO was being castigated for being too tough on the industry. Steve Wood's primary defence seemed to be 'don't shoot the messenger', and that all they were doing was following orders from the EU, though how well that defence went down with the audience seemed a little unclear.

At the Westminster Media Forum, the Commissioner himself had an equally rough ride - and I have to admit that I was one of those who asked him a question that was perhaps a little negative in angle, wondering why so little attention was paid to data minimisation by the ICO, despite it embodying some of the most fundamental principles of data protection. The reply I got was somewhat terse - but my question was one of the gentlest that the Commissioner had to answer. In effect, he was being challenged by privacy advocates, consumer groups and others (including Microsoft's Caspar Bowden) for not being tough enough on the industry.

So what are the ICO to do? One week they're attacked for being too tough on the industry, the next they're attacked for not being tough enough? Are either forms of attack fair or justified? Is there anything that the ICO can do to meet the expectations of both sides? Is the problem just an intractable one that can't be resolved?

As someone who's on the privacy advocacy side of the debate, I have a lot of sympathy for the ICO. They do a lot of good things, provide a lot of good guidance, and generally say the right things. They try to tread a delicate path between the industry and the people - and do their best to tread that path with care and without causing too many fights - and have asked (and now received) for some more 'teeth' to punish those who transgress and deter those who might be tempted to.

Still, however, I find myself wanting to criticise them quite a lot of the time, and find myself in general agreement with NGOs like Privacy International who wondered in February whether the ICO was fit for purpose. Why? Mostly, because the role I think they should be playing does not seem to be the role that they think they're playing. They shouldn't be playing a kind of conciliation service, working out compromises between the industry and the people - they should be on the side of the people first and foremost, and supporting those people's rights. We haven't got anyone else on our side - while the industry has huge amounts of lobbying power, together with the support of great ministries of government to whom trade and finance is the be-all and end-all. They also have the tacit support of large parts of the security lobby, who'd like as much surveillance and data retention as possible, as many back-doors into websites and social networks as possible, and would be happy for the industry to do the building, gathering and retaining of data for them.

So does the ICO need to be so careful not to upset them? I don't think so - they should be braver to speak out and upset companies when those companies need to be upset, and to challenge them when they need to be challenged. They shouldn't be ashamed of this - Steve Wood seemed highly apologetic at the SCL meeting, as if he was ashamed to acknowledge that, deeply flawed though the Cookie Directive may be, it was introduced to address a real issue, and a real issue that the industry had failed to address themselves. If the ICO ends up caving in on this issue too, it really will be showing that it's not fit for purpose...

Sunday, 13 February 2011

Do we have a 'right to be found'?


I've thought (and written) a lot about privacy and autonomy - but I'm fully aware that privacy and autonomy are not the only important human rights relevant to the internet. Indeed, they may not be the most important, particularly compared to freedom of expression – the internet is to a great extent a communications medium, and much of the current use of the internet relates to the expression of ideas, particularly in relation to what might loosely be described as the Web 2.0 applications: blogs, wikis, social networking and related services. Free expression can be considered another aspect of autonomy – what's more, the privacy-related threats to autonomy can have a significant impact on freedom of expression, not just directly (for example where a dissident blogger is tracked down and arrested as a result of breaches of privacy) but through the chilling effect – a kind of ‘Internet Panopticon’ effect – that the knowledge of the potential privacy-related risks can produce.

There are also, however, aspects to the issue of free expression that do not relate just to privacy. One particularly direct aspect relates to the functioning of search engines and other navigation methods through the internet. Does the creator of a website have a ‘right to be found’? That kind of a right wouldn’t mean that a site could demand special treatment from a search engine – but that the site should be able to be sure that it wouldn’t receive specially unfair treatment, and that a search engine should treat it on its merits, according the principles that are known and understood. Any kind of a right to free expression, in relation to the internet, wouldn't seem to mean much if what you express can't be found.

The implementation of a right like this would have particular difficulties in relation to the rights of the search engines themselves to trade secrets insofar as their search algorithms are concerned, but companies and the EC have already bitten the bullet sufficiently to take Google on in terms of possible biasing of search results in the ‘Foundem’ case and this kind of right would related directly to this kind of bias, as bias in favour of something is by its very nature bias against something else. Google have responded to that accusation in relation to Foundem by saying (amongst other things) ‘We built Google for users, not websites,' (see for example here) but in an increasingly personal internet, where users are becoming publishers, is that a sufficiently strong argument? If free expression is to be taken seriously, it may not be.

A ‘right to be found’ would be intended to prevent both bias and censorship – of the kind exercised by authoritarian regimes, for example – and would also have direct implications on the work of organisations like the Internet Watch Foundation, requiring them to be properly transparent and accountable, something that at present they generally seem not to be...


Wednesday, 26 January 2011

A Disinformation Age?

Those of us who are fans of Silent Witness had a pretty traumatic beginning to the week. This week's show, which broadcasts its two-hour drama in two hour-long parts, one on Monday and one on Tuesday, included some truly traumatic stuff: those of us who watched on Monday night saw one of the three main characters, Dr Harry Cunningham, seemingly brutally executed, doused with petrol and then set on fire. It was very realistic - so much that someone naive like me was totally convinced, and even began to mourn poor Harry, my favourite character.

What has this got to do with the subject of this blog, and why have I called it 'the disinformation age'? Well, being a bit of a geek, my laptop was sitting on my coffee table as I watched the programme, and as the titles rolled at the end of the show, I found myself immediately looking on the web to try to find out what would happen next - being naive, it still hadn't occurred to me that Harry wasn't actually dead. I was wondering whether they were going to replace him, or whether this was going to be the end of the show, or something else dramatic. I couldn't find much directly, so I checked on the fount of all wisdom, Wikipedia. There wasn't much there, but there was a list of the main characters, and how long they had been in the show. Of the three main actors, William Gaminara was listed as being in the show '2002-present', Emilia Fox as '2004-present', and Tom Ward, who plays Harry, was listed as '2002-2011'. That last fact confirmed, it seemed, that Harry was dead, gone from the show....

Of course the BBC had done the usual kind of tricks to hide the fact that Harry wasn't actually dead - he didn't appear in the trailer for the second part, and the actor's name was conspicuous by its absence from the opening titles, so it was a solid shock when he did reappear, some time into Tuesday's episodes - and added to the fact that the previous episode had been full of flashbacks and dream sequences, it took some time to realise what was actually going on. That, however, is just ordinary broadcasting, and nothing that out of the ordinary. At the end of the episode, rejoicing at Harry's return, I went back to Wikipedia - and already the page had mysteriously changed, listing Tom Ward as '2002-present'....

So what was going on? Why do I call it the 'disinformation age'? Well, of course I don't know who edited the Wikipedia page - but if it was anyone connected to the BBC, I'm impressed. They had thought through how to really convince people that the character was dead, had understood what people like me were likely to do, and set out to create a perfect illusion - to supply the disinformation needed to complete that illusion. On me, it worked - though I know very well I'm naive in a lot of ways, and actually like to be convinced by this kind of thing - but there is a somewhat more sinister side to this. If illusions like this can be created for artistic reasons, aren't they equally likely to be created for other, less palatable purposes? And then what do we trust? 'Official' information? 'Trusted' sources? A combination of these? Could we be moving to an age where as much effort is put into the creation of false information as is put into the presentation of real information? A disinformation age?

One thing's for sure - I'll be even less trusting than I was before..... and that, in itself, may not be such a good thing. Mind you, I thought the week's Silent Witness was great!