Prof. Panos Ipeirotis

Search and the New Economy

Privacy on the Web

What is privacy?

without your consentnot to be observed

Three Aspects of Privacy

• Citizen and Government• Privacy vs. Security

• Citizen and Corporations• Privacy vs. Personalization, Better products

• Citizen and Society• Privacy vs. Free Speech

FYI: Privacy-related laws

• CAN-Spam Act 2003: Prevents unsolicited emails• Fair and Accurate Credit 2003: Identity theft, no complete credit

card number on receipts, right to get free credit reports• Sarbanes-Oxley 2002: Record transactions in a company to prevent

illegal activity and make managers responsible for outgoing information• Homeland Security Act 2002: Government can mine data about

individuals, including web and emails• USA Patriot Act 2001 & 2003: Law enforcement agencies have

access to ALL databases for terrorist investigations (credit card transactions, video & library rentals, telephone calls, etc.)

• Freedom of Information Act 1998: Citizens can access government information when they want (+over the Internet)

Are there laws that regulate privacy-related issues?

Nothing to hide?

• What is the “nothing to hide” argument?• How is it used to argue for limited privacy rights?• What counter-arguments are there?

The Dog Poop Girl

• Entered subway, dog pooped• Girl rudely denied to clean after her dog• Used an offered napkin to clean the dog,

but not the floor

• Photo taken using a cell phone• Posted on a blog, national story soon after• Big blog story in US as well• Identified and shamed• Dropped out of the university

8

Discussion questions

• Did she deserve privacy?

• Should we have silenced her critics?

• What about free speech?

Gossip and Shaming

• Gossip and shaming existed for ever

• Social norms that penalize unacceptable social behavior

• Social norms regulate everyday life, law is (and should be) last resort

What is different in an online world?

Privacy and Context

• Situational context → Information relevant to a the situation

• Personal context → Information about the person

Online we often lose situational and personal context

Persistence

• Information on the Internet persists (see Web Archive)

• “Persisting” information gave birth to privacy discussions– Newspapers– “Instant” photography

• Allows reconstruction of events long after events are over and/or forgotten

Persistence of Information, Story 1 “What you write stay around forever”

• Michael, now 34 years old

• Convicted as a juvenile, 17 years old• Wrote articles in specialized journals about the experience

• Today:– Cannot find a job (employees Googled him?)– Cannot date (after 2nd date, he is being Googled)– Rarely gets the chance to explain

• Should he be able to get a second chance?• Should information be deleted after some time?

Persistence of Information, Story 2 “What you write stay around forever”

Today I missed my Japanese class again, since I have gotten a bad throat. I only went to the class once this week, so I am probably so far behind now. I will catch up in the summer tho so no worries hehe. Anyway today has been weird, at 3 some guy ringed the bell. I went down and recognized it was my sister's former boyfriend. He told me he wants to get his fishing poles back. I told him to wait downstair while I get them for him. While I was searching them, he is already in the house. He is still here right now, smoking, walking all around the house with his shoes on which btw I just washed the floor 2 days ago! Hopefully he will leave soon, oh yeah working on the jap report as we speak!

Posted 5/12/2005 5:05 PM

Sharon and Simon Ng were found murdered a few hours later.

Jin Lin (ex-boyfriend) confronted and confessed, based on the blog entry

Persistence of Information, Story 3 “What you write stay around forever”

Congrats on the CFA. I'm sure you're about to make VP any day now.

I'm busy doing jack shit. Went to a nice 2hr sushi lunch today at Sushi Zen. Nice place. Spent the rest of the day typing emails and bullshitting with people. Unfortunately, I actually have work to do — I'm on some corp finance deal, under the global head of corp finance, which means I should really peruse these materials and not be a fuckup...

So yeah, Corporate Love hasn't worn off yet... But just give me time..

JLB--Jonas L. Blank, Summer Associate, Skadden, Arps, Slate, Meagher & Flom, LLP4 Times Square, New York, NY 10036-6522

Email intended for a close friend. Sent to the 40 people in the firm

Including 20 partners.

Information and Reputation

• Gossip and diffusion of information traditionally helped define the reputation of people.

• We consider a good thing to have reputation systems for businesses and for products.

• We do not expect that information to fade. Instead we decide ourselves whether to discount the information.

"A man‘s character is what he is; a man's reputation is what others imagine him to be"

Should personal reputation be treated similarly to commercial?Should we have the right to control our reputation?

Is Reputation a Form of Property?

• We defined property as something that we can control…which is what we want to have with reputation

• Can we control use of our reputation by others?• Should we be able to control what (good or bad) things

others say about us?

Defamation lawsuit threats common against review websites

Reputation as a Form of (Shared) Property

• Our reputation consists of two things:– True facts – False information

• Should we be able to hide true facts?• Should we be able to clean falsehoods?

My take: Higher information transparency, not lower

However, blindly allowing information transparency is strange!

Multifaceted Reputation

• What we perceive as reputation is not just personal information presented publicly

• We get a sense of privacy breach when information is used by unintended recipients

• Each has multiple aspects of personality (and reputation)– As academic– As professional– Across relatives and family– As Amazon reviewer– As restaurant tipper

Multifaceted Reputation

• Reputation should be controlled at the level of each facet– Academics (should) care only about academic reputation– Amazon reviewers (should) care only about quality of reviews

• We choose to reveal different facets of reputation

• Making associations across different reputation aspects is a mistake– 19th century: people with cancer are sinners

Second Chances

• If our reputation stays around eternally, will we have second chances?

• Even today, in many areas, we do not get second chances

• Technically, companies should erase information logs after some time (data retention policies)– Similar to bankruptcy and credit policies

• But often, we need to preserve the records; can we selectively decide what to keep?

Legal Protection (?)

• Law of defamation– Libel (written)– Slander (oral)

The "defamator" is at fault when:– Knows the truth– Harms the reputation of the other person

• Law of privacy– Intrusion upon seclusion (information gathering)– Public disclosure of private facts (dissemination of truth)

• Highly offensive• Not of legitimate concern to the public

– False light (similar to defamation, dissemination of lies)– Appropriation (use of likeliness for commercial purpose)

Adverse Effects of Lawsuits

Abuses:• Too easy to win, and can attack free speech• Too difficult to win, and become useless

Also:• Attract attention to the defamation itself!• “Do not date him girl”

– “He has STD and dated multiple people at a time”– “He wears dirty clothes all the time… he is hot… he has hookups in

every zip code”

• Even after winning a lawsuit, you lose• Ability to sue anonymously?

Anonymity

• Is anonymity a good way to ensure privacy today?

• Common to use pen names in the past to express “unpopular views”

Anonymity and Accountability, Example 1:

• John Seigenthaler (American journalist and political figure)• In his Wikipedia entry:

• Seigenthaler could sue and get details but did not want to• 210.28.111.120 Nashville Company Brian Chase (by Daniel Brandt)

• Should Brian Chase be held liable for his (anonymous) actions?

John Seigenthaler Sr. was the assistant to Attorney General Robert Kennedy in the early 1960s. For a short time, he was thought to have been directly involved in the Kennedy assassinations of both John, and his brother, Bobby. Nothing was ever proven.

John Seigenthaler moved to the Soviet Union in 1972, and returned to the United States in 1984.

He started one of the country's largest public relations firms shortly thereafter.

Anonymity and Accountability, Example 2:

• Lori Drew has a daughter, friend of Megan Meier– Lori’s daughter and Megan “stop being friends”

• Lori Drew, mother, creates online persona Josh Evans– Josh flirts online with Megan Meier, friend of Lori’s daughter– Josh “dumps online” Megan Meier, because “she he is bad to her friends”

• Megan Meier commits suicide shortly after

• Should Lori be held accountable?• Online vigilantes have threatened and attacked Lori’s house

Should we Hold Content Hosts Liable?

• In anonymous defamation cases, should we hold liable the content hosts?

• Section 230 provides immunity to content hosts (e.g., comments in blogs)

• Unclear connection to DMCA (need to take down “violations”)

Privacy: A Technical Proposal

• Copyright and privacy, two sides of the same coin!– Copyright: Ownership (control) of “creations of mind”– Privacy: Ownership (control) of data generated by individuals

• APML XML: Attention Profile Markup Language

• Use APML for sharing preferences and private data

• Match with DRM and watermarks to control distribution– DRM: Who has access, on what, for how long– Watermark: Trace leaks of information