THE JOURNAL OF EDUCATION, COMMUNITY, AND VALUES
by Glee Cady <gleecady@gmail.com>
Greetings.
I have been invited to write a column on Internet Privacy and Security for Interface and this is our beginning. I'm not going to do an academic piece because even though I have been accused by editors of writing those kinds of pieces, I am no longer affiliated with an academic institution. And I am not a researcher either. I intend a more personal piece: musings on what I have been working through, based on things I have had to think about. I am fortunate to have worked with many intelligent and thoughtful people who are working on Internet policy matters and I may do columns on some of the things we talk about when we get together. And while I will not be discussing proprietary matters, I will sometimes let you know what I wrestle with during my "day job" in privacy and information security risk management for a financial institution. Perhaps we will discuss current legislation or the nitty-gritty of trying to implement new regulations in various venues.
I have been privileged to be around technology and inter-networking for some time. Certainly, I worked on academic networks before we had the benefits of interconnections among schools, colleges and universities. Those of you who have come of age in a connected world probably can't imagine the excitement of watching a short message traverse the interconnected systems from Palo Alto, California to Winnepeg, Manitoba, via a network that used large mainframes to route messages across the country to Ithaca, New York, and then up across the US/Canadian border and back across Canada. We have certainly come a long way since then.
I have also worked in the private sector and with legislators and agency staff, both in the US and in several other countries. In those diverse environments, by and large one thing stands out: most people want to have a safe, sane environment where converse and commerce flow freely.
In general, I want to discuss how we as responsible network citizens can achieve that environment or at least some sort of reasonable balance of needs and desires. My own agenda then, is to work towards maintaining civil rights, towards participation by all, and towards good policy that we may try to influence (for the good, naturally) the directions we take in digital expression.
The American Heritage Dictionary defines civil rights as
"the rights belonging to an individual by virtue of citizenship, especially the fundamental freedoms and privileges guaranteed by the 13th and 14th Amendments to the U.S. Constitution and by subsequent acts of Congress, including civil liberties, due process, equal protection of the laws, and freedom from discrimination"
Of course, not all network citizens are also citizens of the United States. However, it is hard for us who have lived and learned under the protection of the US Constitution to give up the ideas that we were taught explicitly and culturally to be fundamental. (Certainly, it is also difficult for others to understand why we culturally-isolationist Americans cannot understand the fundamental tenets of others.) So, let us take as our hypothesis that due process, equal protection, and freedom from discrimination are good things and that we would like to exist in a networked world where they are considered a basis for judging the acts of ourselves and others.
In addition, the term "civil rights" says (to me, anyway) that we should make an effort to be civil. This is not to say we should always agree with one another. But we do have the right and responsibility to speak for our beliefs and tenets as well as the responsibility to let others speak for theirs. It is very human, of course, to want to wreak verbal or physical violence upon those who clearly "don't see the light." In the "olden days", (which in network terms I define as before the rise of the web and the interconnection of the proprietary networks like AOL and Prodigy with the Internet) people who used newsgroups and mailing lists generally knew one another. That meant that "flame wars" -- where one person denounced the ideas or expressions of another person -- were done in an atmosphere where one could understand if the flame-e was having a bad day or that the flame-r hadn't read the email before hitting "send". We tended to dismiss the attacks themselves or to understand that they were an attack on an idea, not an attack on a person.
It is remarkably easy to harass another person via website, via denial-of-service attack, or via sending a virus. You certainly do not need to know the other person. You just need to know where they "hang out" in the network. I read a newspaper article recently talking about "cyber-bullies" moving from the playground to the online world. Young people are exercising their right to make fun of another young person who is different. How sad. Such behavior raises so many questions, among them: "what is acceptable behavior?" and "who is the playground supervisor?" I think then that we need to take care, each of us, to move our civil-ization there, too.
Then there are rights. Whose prevail? It is my right to speak -- but you should have the right not to listen. If you don't like my speech, are you allowed to shout or to block my speech? Am I allowed to amplify my speech so that I can speak louder than your block? When those rights are at odds, who decides? If we take it to the courts, who chooses the venue? Is the matter civil or criminal? Which court might have jurisdiction? These matters, like in the "real world" will be debated, in the courts and out, for the foreseeable future.
I was once privileged to take my two children along with two exchange students to hear an argument before the US Supreme Court. The case was an interesting and seemingly simple one – of course, if it had been that simple, it wouldn't have been being adjudicated in the Supreme Court. As I remember the circumstance, the case went like this: A "known" drug-dealer had been being watched by law enforcement personnel. He left a residence carrying a brown paper bag. He placed the bag in the back seat of an automobile, got in, and drove away. The police stopped him for a minor traffic violation. The officer asked permission to look in the car. The suspect (who knows what he was thinking) said "yes". The officer opened the back door and looked in the paper bag, which to no one's surprise, contained drugs. The suspect was arrested.
What was the point of law which raised this case to the Supreme Court? The case revolved around the Fourth Amendment:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
The question was "is permission to look in the car" the same as "permission to look in a brown paper bag?" It didn't take too many questions from the Justices to understand that a court decision is about drawing a line in the sand. On one side of the line, the action is okay. It may or may not be nice or desirable or profitable or pleasant, but it is legal. On the other side, the action is not okay. Was the bag part of the car? If you said yes, would you have answered differently if the bag was transparent? If it were a briefcase? If it were a woman's purse? If it were in the front seat rather than the back seat? By the way, since one of the things I do not remember about this case is its name, I have no idea how the justices ruled.
But these types of questions remain and now we need to think about our online environment as well as the offline. Where are the lines we want to draw today? What protections do we have from unreasonable search and seizure? Do online personalities have the same protections as those in the real world (that is, who is a person)? What is the responsibility of the individual? The marketer? The service provider? The software coder? The web hoster? The corporation that employs any and all of the above? Where is the wall of my castle? How can we pull up the drawbridge over the moat? Is there a moat or do we need to build one? Can we build sufficient protections that provide privacy for ourselves and yet help find the bad guys? Are those protections enshrined in law? Do they need to be?
I hope to use this column to explore the way we think about privacy and information security and see if we can, at the very least, get a few good questions on the table. We may or may not find any good answers.
Keaton Nguyen - The Agency of Keitai
Glee Cady - Slouching Towards Balance
Leonard D. DuBoff - Protecting Your Intellectual Property
Kevin Kawamoto - Learning About Health Care Policy: Part 1
Mark Szymanski - Funding for Character Education
Chris Pruett - Horror as a Catalyst for Change
John Sandford's The Hanged Man's Song
Simon Johnson's Keep Your Kids Safe on the Internet
The Berglund Center TransPacific International Classroom Project as an Example of...