Dr. Tom Keenan FCIPS, I.S.P., ProfessorDr. Tom Keenan FCIPS, I.S.P., ProfessorFaculty of Environmental Design & Dept. of Computer ScienceFaculty of Environmental Design & Dept. of Computer Science

University of CalgaryUniversity of Calgary

PrimeLife2010 Helsingborg, Sweden Aug. 2, 2010PrimeLife2010 Helsingborg, Sweden Aug. 2, 2010Copyright © 2010, T.P. KeenanCopyright © 2010, T.P. Keenan

      

 

              

Oops - We Didn’t Mean to Do That! – How Unintended Consequences Can Hijack

Good Privacy and Security Polices

Meet LUC -- The Law of Unintended Consequences

Paris, 1895

Engine Driver was trying to make up time

Brakes failed (foreseeable?)

Oops!

LUC in ActionLUC in Action

In 1997 Canada Imposed a Levy on Blank In 1997 Canada Imposed a Levy on Blank Recording Media such as cassette tapes Recording Media such as cassette tapes and CDsand CDs

Today 29 cents CAD is added to each Today 29 cents CAD is added to each blank CDblank CD

Goal was to compensate musicians for Goal was to compensate musicians for copies made of their workcopies made of their work

What Really HappenedWhat Really Happened

Mp3 player sales soared Mp3 player sales soared

(Technology Substitution)(Technology Substitution)

People started using DVDs which, People started using DVDs which, bizarrely, are not subject to the levy bizarrely, are not subject to the levy

(Law Lags Technology)(Law Lags Technology)

Canadians flocked to US stores Canadians flocked to US stores

(Materiality -- 29 cents often exceeded the (Materiality -- 29 cents often exceeded the cost of the disk)cost of the disk)

HIPAA Foul-upHIPAA Foul-up

US Health Information Privacy Law US Health Information Privacy Law (HIPPA, 1996) Allows Individuals to (HIPPA, 1996) Allows Individuals to Withhold Information from Health Care Withhold Information from Health Care Providers (very broad definition)Providers (very broad definition)

HIPPA is a Federal law and takes HIPPA is a Federal law and takes precedence over state lawsprecedence over state laws

Lawsuits are generally governed by state Lawsuits are generally governed by state lawslaws

ConsequenceConsequence

People have launched lawsuits against People have launched lawsuits against health care providershealth care providers

Then demanded that their info be Then demanded that their info be protectedprotected

Legal process impededLegal process impeded

(Scope conflict)(Scope conflict)

The The a:visiteda:visited exploit exploit

Browsers Generally Don’t Allow Sites You Browsers Generally Don’t Allow Sites You Visit to Access Your HistoryVisit to Access Your History

But They Do Provide render sites you have But They Do Provide render sites you have visited in a different colorvisited in a different color

A Malicious site can exploit this by playing a A Malicious site can exploit this by playing a list of urls (“history stealing”)list of urls (“history stealing”)

This May Uniquely Identify You (through This May Uniquely Identify You (through group memberships, ref: iSecLAB) group memberships, ref: iSecLAB)

(Inadvertent Functional Equiv.)(Inadvertent Functional Equiv.)

Facebook suicideFacebook suicide

According to the UK media, a 24 year old According to the UK media, a 24 year old teacher named Emma Jones committed teacher named Emma Jones committed suicide in February 2010 “'after (her) ex-suicide in February 2010 “'after (her) ex-boyfriend posted naked pictures of her on boyfriend posted naked pictures of her on Facebook” Facebook”

Was living in Abu Dhabi, feared legal Was living in Abu Dhabi, feared legal problemsproblems

(Pricing Failure)(Pricing Failure)

Future Technologies Not Yet Future Technologies Not Yet InventedInvented

““Beware of time-travelling robots from the Beware of time-travelling robots from the future” –Templeton, EFFfuture” –Templeton, EFF

fMRI – Functional Magnetic Resonance Imagery

TechnologyTechnology Will Will Be Mis-AppliedBe Mis-Applied

NY Times article during US Presidential NY Times article during US Presidential campaigncampaign

Tried to assess voter reactions to Tried to assess voter reactions to candidatescandidates

Hilary Clinton caused activity in the Hilary Clinton caused activity in the “disgust center”“disgust center”

The Experts Say that’s Junk Science

“As cognitive neuroscientists who use the same brain imaging technology, we know that it is not possible to definitively determine whether a person is anxious or feeling connected simply by looking at activity in a particular brain region. This is so because brain regions are typically engaged by many mental states, and thus a one-to-one mapping between a brain region and a mental state is not possible.”

Adam Aron, Ph.D. & 16 others, NY Times

To Recap Some LUC-y factorsTo Recap Some LUC-y factors

Technology SubstitutionTechnology Substitution

Law Lags TechnologyLaw Lags Technology

MaterialityMateriality

Scope ConflictScope Conflict

Inadvertent Functional EquivalenceInadvertent Functional Equivalence

Pricing FailurePricing Failure

Let’s Not Forget Let’s Not Forget Malicious/Opportunistic UsersMalicious/Opportunistic UsersNot all LUCs are innocentNot all LUCs are innocent

City of Calgary (and many other places) City of Calgary (and many other places) post property values onlinepost property values online

Led to snoopingLed to snooping

Entrepreneurs based businesses on it!Entrepreneurs based businesses on it!

And Definitely Don’t Forget Human Stupidity…

Does Unintended Mean Does Unintended Mean Unforseeable?Unforseeable?

-Unpredictable-Carries a massive impact-After the fact we concoct an explanation

Taleb calls these Black SwansTaleb calls these Black Swans

Success of GoogleSuccess of Google

9/11 Attacks9/11 Attacks

The Rise of HitlerThe Rise of Hitler

Fall of the Soviet UnionFall of the Soviet Union

Many things are forseeableMany things are forseeable

Strategic Foresight techniquesStrategic Foresight techniques

ScenariosScenarios

Constant revisiting, especially in the light Constant revisiting, especially in the light of new technologiesof new technologies

What Can We Do About LUC?What Can We Do About LUC?

Recognize that they are inevitableRecognize that they are inevitable

Understand that they span technical, Understand that they span technical, social, and even psychological dimensionssocial, and even psychological dimensions

Reason by analogy to help anticipate themReason by analogy to help anticipate them

Analytic tools such as EXAM, PONDER, Analytic tools such as EXAM, PONDER, OWL may help find conflictsOWL may help find conflicts

Scenarios may also have a placeScenarios may also have a place

Thank you!

Dr. Tom Keenan, FCIPS

keenan@ucalgary.ca

www.ucalgary.ca/evds

This image courtesy

Elise Pelchat

www.conceptsforall.uqam.ca