Algorithmic Big Brother

There's a lot of FUD about internet companies harvesting personal data.

Don't get me wrong, I'm a privacy advocate: you should have the right to be as private as you like, and whatever data that is held about you by a third party should be disclosed to you, and accessible on request.

But let's not put the tin hats on every time we hear that Tech Firm X is harvesting your data. I'm sure they are, but ask yourself why. Google and Facebook aren't interested in my secrets. They are interested in

1. Selling my profile info to advertisers
2. Providing me a better service so that I keep coming back and they can satisfy (1).

You'll agree that point 2 is innocent/benign enough. If you have a fundamental problem with entities selling info to advertisers then stop buying things and stop using 'free' services. If you're not the paying customer, you're the product. Get used to it.

The issue, and where the media like to blur and sensationalise, is the definition of 'my profile info'. What info are they collating & selling, and what are they doing with it? This is where things get shady. The quick answer these firms all give, when asked, is a variant of point 2 above: that the data is used to offer better-targeted advertising and services to you the cust- consumer.

Right, but what data, exactly? And how are you packaging it up to the advertisers to whom you're selling it? The answer, in most cases, is that they are not selling the information like a secret service dossier - a big brown file on you. They are simply categorising you. The advertisers then say what categories they want to target, which could be broad (all females between 18 and 30) or very specific (chess players and sci fi fans in New York city under the age of 24). These firms then ensure you get hit by those adverts that match your category. They then track which ones you click and which you don't, and that gets reported back to the advertisers. In fact, in the case of social networks, these firms track every unsecured page that you browse and refine your categorisations accordingly.

Point is, the advertisers don't get the specific info about you. They get aggregated category data. Heineken don't know which beer I drink unless I tell them (by 'liking' or '+ing' a page of theirs); they just know that I'm in several of their key categories.

The categorising tech firms are as interested in me as a lawnmower is in grass. They don't have time/resources to compile a dossier on you or me. They have algorithms that profile us automatically and constantly, but primarily in order to meet the 2 commercial imperatives above.

So if you're worried about Google or Facebook or Apple prying into your private life, only the algorithms are watching.

Government agencies?  Different story: why would they be harvesting your data? Again, it's mostly algorithms, but there's no commercial imperative. So it's definitely personal and potentially nefarious. 

Beware Android users

The most sophisticated bug for a mobile phone ever has recently been found by Kaspersky Labs.


Not only can it do real damage (eg. sending SMS to premium rate numbers), it has no user interface, no indication of the privileges it has (circumventing all of Android's usual 'this app can..' lists) and cannot be removed from compromised devices!

The hackers found no less than 3 unknown critical vulnerabilities, one even obfuscating the code to prevent analysis.

Details here (Securelist.com).

Kaspersky have notified Google, but this could cast serious doubts on the enterprise use of Android.

Biometric security

Nearly 7 years ago all 23 chromosome pairs of the human genome were mapped, after over 10 years effort and billions of dollars spent.

Now, you can get your DNA mapped for about $5000-$10,000 and that's expected to drop to $1000 soon. And the data amounts to about 8.5GB - small enough to store on your phone. This is amazing science and bodes well for disease cures and longevity, but what about security and identity?

Right now, if I handed a thumbdrive to you with my personal genomic sequence on it, there's not much you could do with it, except take it to some clever people to find out what diseases I'm genetically prone to. But what about in the future? Science fiction writers like to rave about DNA fingerprinting: locks only unlocked by your DNA, or guns imprinted with your DNA so that only you can fire them. Crimes solved because the perp's DNA was found at the scene.

Now, what if you could use my DNA to grow a replica of my hand, my blood, my eye etc.- enough to trick the lock, or the gun, or the forensics team? How would I then prove I was me?

The worrying thing about DNA for identity is that you can't just reset it, like a password. It IS you. That 8.5GB dataset is your recipe. Maybe the boffins have thought of that, or maybe not? From a security access perspective it's no big deal: we've had multi-factor security for years, whereby access requires something you have (eg. a card), and something you know (eg. a PIN). But if someone takes your card, you can cancel it. If someone takes your DNA, what can you do?