It is great to see that the Information Privacy Commissioner of Ontario, Canada, Dr. Ann Cavoukian, has recently published a paper that shows support for tools that help people take more control of their personal data.
This paper is a major endorsement for the emerging solutions that are embedding privacy by design into their personal and business services.
Rather than say any more, I encourage you to have a look at the commissioners' video and to then have a read of the report. You will see the passion and direction that is coming from one of the worlds leading professionals in this area.
The paper has had contributions from several of the member companies of the Personal Data Ecosystem of which PIM Ltd. is a member.
Showing posts with label privacy. Show all posts
Showing posts with label privacy. Show all posts
Saturday, November 3, 2012
Monday, August 29, 2011
What are some simple ways to protect your Identity?
In some ways it is obvious, Identity theft is more likely to occur if you make it easy for someone to take and use your identity information.
Here are a few things you can do to help prevent that happening.
1. If you are asked for your Identity information, ask why they are asking for it and what they will do with it.
2. Keep documents that are used to establish your identity (e.g. Birth Certificates or Passports) in a very safe place. Ideally in a physical safe if you have one.
3. Do not write down PIN Numbers or passwords. If you cannot remember them all then make use of software like myINFOSAFE to store then and keep them safe but accessible.
4. Identity crime does not always result from information that is stolen, but from information that you publish on the internet. It is best not to publish information like your birth date on the internet. Often organisations will user date of birth as one of the verification questions when identifying you and if people can find this out they can easily impersonate you).
5. Be suspicious of any unexpected events (Letters from Creditors, bank transactions you cannot remember making) that could be a result of identity crime.
6. If you have sensitive information on your mobile phone, keep it password protected. It can be inconvenient we know but there is often a significant amount of information on phones that help people steal your identity.
7. Remove all personal information from personal computers before you dispose of them.
8. Make sure you properly dispose (shred or burn) of bank statements, electricity bills, and any piece of correspondence with your name or address on it. These documents should never be put in public recycling bins. Consider getting your statements provided online - it is good for you and the environment as well.
9. Passwords are often sent to you via email when you sign up for new services. Go to your email and search all folders, including your deleted items, for the word “Password”. Check all the emails that are returned and make sure you transfer all the information into myINFOSAFE, or a similar digital safe, to ensure no one with access to your PC could find your passwords.
10. If you believe you are the victim of identity crime, contact the police.
We will be publishing a free guide to preventing Identity theft on our website soon. If you have any other ideas or thoughts that we should include then please let us know.
Here are a few things you can do to help prevent that happening.
1. If you are asked for your Identity information, ask why they are asking for it and what they will do with it.
2. Keep documents that are used to establish your identity (e.g. Birth Certificates or Passports) in a very safe place. Ideally in a physical safe if you have one.
3. Do not write down PIN Numbers or passwords. If you cannot remember them all then make use of software like myINFOSAFE to store then and keep them safe but accessible.
4. Identity crime does not always result from information that is stolen, but from information that you publish on the internet. It is best not to publish information like your birth date on the internet. Often organisations will user date of birth as one of the verification questions when identifying you and if people can find this out they can easily impersonate you).
5. Be suspicious of any unexpected events (Letters from Creditors, bank transactions you cannot remember making) that could be a result of identity crime.
6. If you have sensitive information on your mobile phone, keep it password protected. It can be inconvenient we know but there is often a significant amount of information on phones that help people steal your identity.
7. Remove all personal information from personal computers before you dispose of them.
8. Make sure you properly dispose (shred or burn) of bank statements, electricity bills, and any piece of correspondence with your name or address on it. These documents should never be put in public recycling bins. Consider getting your statements provided online - it is good for you and the environment as well.
9. Passwords are often sent to you via email when you sign up for new services. Go to your email and search all folders, including your deleted items, for the word “Password”. Check all the emails that are returned and make sure you transfer all the information into myINFOSAFE, or a similar digital safe, to ensure no one with access to your PC could find your passwords.
10. If you believe you are the victim of identity crime, contact the police.
We will be publishing a free guide to preventing Identity theft on our website soon. If you have any other ideas or thoughts that we should include then please let us know.
Tuesday, August 9, 2011
Is your Personal Information Worth Anything?
A recent World Economic Forum (WEF) report titled Personal Data: The Emergence of a New Asset Class proposes that your personal information is very valuable. In fact it quotes Meglea Kuneva, the European Consumer Commissioner as saying “Personal data is the new oil of the internet and the new currency of the digital world”.
Clearly Google and Facebook understand this as they make their money of the personal information you enter into their services. They analyse and mine this information and gain the vast majority of their revenue from helping advertisers match their messages to people interested in their products and services. In turn these revenues are driving the high valuations of these companies and making their shareholders rich from your information.
People are starting to realise not only the value that is being derived from their information, but the issues with privacy related to their information being on the internet. One of the reactions we have seen as a result, is a significant number of people deciding to stop using social media sites like Facebook (In the USA alone 6 Million Facebook users cancelled their accounts in May this year).
So if our information is an asset how do we get value from it? There is no silver bullet here and this will take a lot of thinking from individuals, governments and private companies to find the right mix of controls and incentives to find a new balance.
The WEF report proposes a vision of the future as follows:
• Individuals can have greater control over their personal data, digital identity and online privacy, and they would be better compensated for providing others with access to their personal data.
• Disparate silos of personal data held in corporations and government agencies will be more easily exchanged to increase utility and trust among people, private firms and the public sector.
• Governments need to maintain stability, security and individual rights will meet in a more flexible, holistic and adaptive manner.
What is clear to me is that there needs to be change from how things work today and there will be solutions that emerge in the market that will contribute to the new models going forward. Clearly the Personal Data Ecosystem Consortium (PDEC), of which I am part of, will be one pare of the solution.
For those interested in this area click here to visit the PDEC Website. The WEF report can be downloaded from the "About" page on this website.
Clearly Google and Facebook understand this as they make their money of the personal information you enter into their services. They analyse and mine this information and gain the vast majority of their revenue from helping advertisers match their messages to people interested in their products and services. In turn these revenues are driving the high valuations of these companies and making their shareholders rich from your information.
People are starting to realise not only the value that is being derived from their information, but the issues with privacy related to their information being on the internet. One of the reactions we have seen as a result, is a significant number of people deciding to stop using social media sites like Facebook (In the USA alone 6 Million Facebook users cancelled their accounts in May this year).
So if our information is an asset how do we get value from it? There is no silver bullet here and this will take a lot of thinking from individuals, governments and private companies to find the right mix of controls and incentives to find a new balance.
The WEF report proposes a vision of the future as follows:
• Individuals can have greater control over their personal data, digital identity and online privacy, and they would be better compensated for providing others with access to their personal data.
• Disparate silos of personal data held in corporations and government agencies will be more easily exchanged to increase utility and trust among people, private firms and the public sector.
• Governments need to maintain stability, security and individual rights will meet in a more flexible, holistic and adaptive manner.
What is clear to me is that there needs to be change from how things work today and there will be solutions that emerge in the market that will contribute to the new models going forward. Clearly the Personal Data Ecosystem Consortium (PDEC), of which I am part of, will be one pare of the solution.
For those interested in this area click here to visit the PDEC Website. The WEF report can be downloaded from the "About" page on this website.
Monday, July 11, 2011
Who is Shaping the Internet?
Internet New Zealand recently ran a three day Net Hui (conference) in Auckland to discuss key issues around the internet. Over 500 people from all walks of life attended the event, making it a rich environment to hear a wide range of views and perspectives.
There were lively discussions on topics ranging from copyright law, access and diversity, digital citizenship, human rights, the future of digital content, who controls or governs the internet, censorship, and much more.
I could not possibly cover all the issues or ideas discussed and would encourage you to go to the Hui website (http://nethui.org.nz/ ) where you can still access the discussion forums and notes from each session. You can also view YouTube videos from some of the major sessions including the well received key note speaker, Professor Lawrence Lessig. ( http://www.youtube.com/NetHuiNZ )
The key things that hit me personally from the conference were:
1. The internet is changing the world we are living in. We all know the internet is a powerful tool and that more and more people are using it, but at the Hui, I heard real examples about how the internet is revolutionising business models (e.g. the media industry), empowering people to learn about the world in which they live, and even helping bring change in governments.
2. Privacy and security issues are clearly mainstream. The truth is out about how Facebook and Google earn their money, and it is from our personal Information. With hundreds of millions of people using such services, people are becoming aware of the need to control and protect their personal information and manage it in a way that helps them derive value from it, not others.
3. There is a need for continued education regarding the internet. It was a clear reminder that the average internet user is not a very sophisticated user, but is someone who is using email, social networking, searching for information and maybe buying and selling online. While the internet needs to be simple for all to use, some of the issues and challenges the internet presents are not that simple. There is a need for ongoing discussion and education about the internet so that it continues to be a system that helps us live the lives we want to lead not hinder it.
Well done Internet New Zealand for hosting such an event and bringing discussion on these issues into the public arena. The internet is here to stay and we all need to shape its future together so that it helps us live our lives in the way we want to.
There were lively discussions on topics ranging from copyright law, access and diversity, digital citizenship, human rights, the future of digital content, who controls or governs the internet, censorship, and much more.
I could not possibly cover all the issues or ideas discussed and would encourage you to go to the Hui website (http://nethui.org.nz/ ) where you can still access the discussion forums and notes from each session. You can also view YouTube videos from some of the major sessions including the well received key note speaker, Professor Lawrence Lessig. ( http://www.youtube.com/NetHuiNZ )
The key things that hit me personally from the conference were:
1. The internet is changing the world we are living in. We all know the internet is a powerful tool and that more and more people are using it, but at the Hui, I heard real examples about how the internet is revolutionising business models (e.g. the media industry), empowering people to learn about the world in which they live, and even helping bring change in governments.
2. Privacy and security issues are clearly mainstream. The truth is out about how Facebook and Google earn their money, and it is from our personal Information. With hundreds of millions of people using such services, people are becoming aware of the need to control and protect their personal information and manage it in a way that helps them derive value from it, not others.
3. There is a need for continued education regarding the internet. It was a clear reminder that the average internet user is not a very sophisticated user, but is someone who is using email, social networking, searching for information and maybe buying and selling online. While the internet needs to be simple for all to use, some of the issues and challenges the internet presents are not that simple. There is a need for ongoing discussion and education about the internet so that it continues to be a system that helps us live the lives we want to lead not hinder it.
Well done Internet New Zealand for hosting such an event and bringing discussion on these issues into the public arena. The internet is here to stay and we all need to shape its future together so that it helps us live our lives in the way we want to.
Monday, June 13, 2011
Privacy of Personal Information
How private is information you post on the internet? Is it more secure than if you store that information on your PC?
The reality is that information can be very secure or very insecure on both platforms.
In regards to the Web, I found a helpful view in David Siegel's book "PULL". He states that there are three basic levels to the Web and area findable by public search engines like Google and Bing.
The Public Web which we normally see when searching and browsing for information online.
The Deep Web which includes large data repositories that public search engines usually do not see. E.g. Craigslist, Grainger etc.
The Private Web which we can only get access to if we qualify or have access rights. E.g. Corporate intranets or subscription based services. Again, this information is not searchable by public search engines.
So your data is more secure in the private web than the public web, but, in all these systems there are people that have the ability to access your information if they wish to. There is always a systems administrator or similar with super admin rights to each database and can just about always get to see what data is stored anywhere.
On your PC you may think your data is safe, but there are two main ways that people can gain access to information on your PC.
Remotely - If your PC is connected to the internet, even if you have firewall protection or security software, there are ways that people can gain access to your PC and search your information.
Physically - If someone gains physical access to your PC, and even if your PC is password protected, people who know how can access your PC and search your information. This can also be that case if they get hold of any of your back up devices for your PC.
On either platform the best way to ensure that your data is not compromised is to have it encrypted with a strong cryptographic key that is kept confidential (and separated from any systems administrator). This way, even if information is found it cannot be read or understood as all the information is encoded using this key.
The cracking of a strong encryption key of about 192 or 256 bits is considered infeasible.
So, be careful what you do with your information. If you want it shared then that is fine. If you want it safe and protected, encrypt it – end of story.
The reality is that information can be very secure or very insecure on both platforms.
In regards to the Web, I found a helpful view in David Siegel's book "PULL". He states that there are three basic levels to the Web and area findable by public search engines like Google and Bing.
The Public Web which we normally see when searching and browsing for information online.
The Deep Web which includes large data repositories that public search engines usually do not see. E.g. Craigslist, Grainger etc.
The Private Web which we can only get access to if we qualify or have access rights. E.g. Corporate intranets or subscription based services. Again, this information is not searchable by public search engines.
So your data is more secure in the private web than the public web, but, in all these systems there are people that have the ability to access your information if they wish to. There is always a systems administrator or similar with super admin rights to each database and can just about always get to see what data is stored anywhere.
On your PC you may think your data is safe, but there are two main ways that people can gain access to information on your PC.
Remotely - If your PC is connected to the internet, even if you have firewall protection or security software, there are ways that people can gain access to your PC and search your information.
Physically - If someone gains physical access to your PC, and even if your PC is password protected, people who know how can access your PC and search your information. This can also be that case if they get hold of any of your back up devices for your PC.
On either platform the best way to ensure that your data is not compromised is to have it encrypted with a strong cryptographic key that is kept confidential (and separated from any systems administrator). This way, even if information is found it cannot be read or understood as all the information is encoded using this key.
The cracking of a strong encryption key of about 192 or 256 bits is considered infeasible.
So, be careful what you do with your information. If you want it shared then that is fine. If you want it safe and protected, encrypt it – end of story.
Monday, May 30, 2011
Linkability?
So you post some information on your website, your blog, or post some pictures on the internet for friends to see. What happens to it then? Can this information be copied, re-used, modified? Yes it can. This is less than ideal as you soon lose control of your information and it is off into cyberspace somewhere for who knows what purpose.
Some would say this is no different to talking to someone and them talking to someone else and soon you do not know who is talking about you. This is OK if it is about things you are happy for people to talk about, in fact this can often be beneficial. But what if you share something personal with someone in confidence and others get to know. You feel your confidence and trust in that person has been breached and this is not OK.
How can we set up similar confidence rules for information we share on the internet to protect ourselves from the openness of the internet when we need it?
Some would say that if you do not want your personal information spread on the internet, then do not put it up there. That may be right sometimes (e.g. just do not put those pictures from the office party up on Facebook). Others will say, make sure you submit such information in password protected areas. But what is stopping other members copying that info and distributing it outside of the protected area.
There are times you need to share information on a confidential matter and discuss it with people you trust. Due to geographical location or the need for input from multiple people, the internet is often the best mechanism in which to do this.
So, in the mean time, you are left with using a search engine to see what is being said about you on the internet and how information about you is being treated, then trying to correct it. Perhaps what we need is some mechanism to link (Linkability?) us to our information or protect sensitive information we do post or submit to the internet. Is there such a mechanism?
Look forward to learning about what views people have in this regard and what initiatives are underway to move us forward in this area.
Saturday, January 8, 2011
How private is our personal information?
We have all heard about Wikileaks. I noticed this article today that made me think about all personal information stored on the web in cloud based solutions that you may think is private and secure but can be clearly accessed under legal process as required.
http://nz.news.yahoo.com/a/-/world/8615201/u-s-orders-twitter-to-hand-over-wikileaks-records/
We considering this as part of the design of myINFOSAFE. If we were ever asked to provide details of account codes and encryption keys for customers by the court, we would have to do this. But we could not provide any of the customers personal information stored in myINFOSAFE as we do not have access to it as it is stored locally on the users PC and is protected by a password that we do not know. (assuming the user has changed it from the default). The customer has control of their information and they can protect it, back it up or delete it in any way they want.
It makes you think that while there are many benefits of cloud based systems there are weaknesses that you need to be aware of in relation to your personal information.
Look forward to some discussion on this please.
http://nz.news.yahoo.com/a/-/world/8615201/u-s-orders-twitter-to-hand-over-wikileaks-records/
We considering this as part of the design of myINFOSAFE. If we were ever asked to provide details of account codes and encryption keys for customers by the court, we would have to do this. But we could not provide any of the customers personal information stored in myINFOSAFE as we do not have access to it as it is stored locally on the users PC and is protected by a password that we do not know. (assuming the user has changed it from the default). The customer has control of their information and they can protect it, back it up or delete it in any way they want.
It makes you think that while there are many benefits of cloud based systems there are weaknesses that you need to be aware of in relation to your personal information.
Look forward to some discussion on this please.
Subscribe to:
Posts (Atom)