Watermarking: Threat to Privacy?

Recently, a mini-firestorm has erupted over the possibility that the recording industry will add watermarks to music files (e.g., articles here, here, and here). The idea behind the watermarks is that they will allow copyright holders to see where files on peer to peer networks came from and file lawsuits accordingly. Whether such tracking would actually allow the RIAA to file suits without being embarassed (e.g., as described in this article, which eventually led to a charge of malicious prosecution) is an open question. However, what I would like to address is not whether the watermarks will help in prosecution of copyright infringers, but what they will do for individual privacy. In a wired.com article on the subject, Evan Hill, CTO of Activated Content, a company that provides watermarking solutions to Universal, Sony/BMG and other labels is quoted as calling watermarks which uniquely identify each file purchased by each user a "privacy nightmare." While there are certainly concerns about watermarking, I don't think those concerns are really that significant. The reason for this is that problems with watermarking are really only a symptom of a larger issue: users being forced to sacrifice their privacy in order to participate in the modern economy. I've blogged previously (see post here) about the threat posed to privacy by the routine enforcement of clickwrap licenses where service providers can basically dictate terms because users either don't or can't understand what they're agreeing to. Similarly, in the case of music distribution, service providers (i.e., record companies) can basically dictate terms to users, because people won't bother to read the licenses provided with the songs and, even if they did, they wouldn't have any choice about accepting them because the record labels have government enforced copyrights (assuming the consumers care about buying licensed copies of the songs, of course). In both cases though, the problem isn't the watermarks (or the clickwraps) it's the economy, and the legal system which allows those tools to be used in ways that strip users of their privacy.

How Much Does a Mega-Breach Cost?

According to this article from Computerworld TJX has announced that the costs of a massive 45 million+ record data breach could reach over $150,000,000. While certainly a significant amount of money (I know my net worth doesn't even approach $150,000,000) the figure given by TJX is actually significantly less than I would have expected. When taking into account the magnitude of the breach, the per record cost given by TJX is only about $3.30. That's orders of magnitude lower than the $182/record average cost given by the Ponemon institute described in this article. While it's possible that larger breaches have lower cost/record numbers (something like buying in bulk), my guess is that $150,000,000 is something of a lowball estimate. However, even at $3.30/record, a breach like the one which hit TJX isn't cheap, and even the $150,000,000 figure is likely to spur some long overdue emphasis on information security.

Focus on Data Retention, Storage and Destruction

Merchants with customers in Minnesota have another reason to step up their efforts to comply with the PCI Data Security Standards. A new Minnesota law, the first of its kind, imposes strict liability on merchants for costs incurred by financial institutions associated with a card security breach. Effective August 1, 2007, the Plastic Card Security Act bill requires that merchants with Minnesota residents as customers must have implemented Requirement 3 of the PCI security requirements. Requirement 3 prohibits storage of "sensitive authentication data," which includes magnetic stripe data, card validation codes, PINs, and encrypted PIN blocks. The law requires destruction of all such data immediately following a transaction. The provisions imposing strict liability take effect August 1, 2008. Similar bills are pending in the legislatures of California, Texas, Illinois, Connecticut and Massachusetts, and could very well be the next wave of data security legislation. Meanwhile, other efforts are underway to assist companies who must store sensitive business data. Computerworld reports on software that is being developed which takes critical data and cuts it up into anywhere from four to 128 "slices" that can be sent and stored securely in one or more locations. Computerworld Such software would be helpful for companies who need to better secure remote users, or for banking companies where long-time and easily retrievable storage of customer data is essential to their business. Clearly, recognition that proper data retention,storage and destruction is key to prevention of security breaches is finally getting its due.

Search Engines and Privacy

CNET has an interesting article comparing the privacy policies of major search engines. According to that article Ask has the best privacy practices while Yahoo had the worst. One apparent weakness in the article was its focus on the companies' use of data (e.g., how long is it kept; do the companies rely on behavioral targeting of ads). While a company's use of data is clearly a major privacy concern, I would also be interested to see a survey which included information on how protective the companies were of the data that they do have. For example, Google actively fought the government when subpoenas were issued requesting information on searches performed by Google users (see this article (have to scroll down) for more information). To my mind, that should give the search engine giant a bump, especially given how eager most companies seem to be to hand over any and all customer information to the government (e.g., AT&T, whose behavior resulted in a lawsuit by the EFF as described here.

However, in spite of its inadequacies, the article still contained useful information. One interesting point is the discussion in the article of the effect of regulation on search engine privacy policies. For example, the article cited efforts by a group of European bureaucrats called the Article 29 Working Party as being a contributing factor in adoption of time limits for data retention by search engine providers. If there really is a causal connection, it would be a good example of how globalization can actually benefit consumer rights, since Americans would essentially be reaping the privacy benefits of regulatory pressures experienced by companies doing business in Europe.

Texas Attorney General Takes Action Against ID Theft

Texas Attorney General Greg Abbott has been actively enforcing his state's data privacy and security laws. In April, 2007, he filed lawsuits against two companies alleging that their disposal of customers' personal information into trash dumpsters was a violation of Texas law which requires the companies to establish reasonable security disposal procedures with respect to such information. Earlier this year he filed two other cases alleging similar violations of Texas statutes. And most recently, he has filed suit against Lifetime Fitness, a Minnesota company with several Dallas area locations. Bizjournals This suit also alleges a failure to protect customers' personal information by disposing of personal identifying information in easily accessible trash cans behind the businesses. The Texas laws the companies are alleged to have violated are the Texas Deceptive Trade Practices Act and the 2005 Identity Theft Enforcement and Protection Act, which requires proper destruction of clients' sensitive personal information. In a statement, Abbott said "Identity theft is one of the fastest growing crimes in the United States. Texans expect their personal information to remain confidential." While it is too early to predict the outcome of these cases, if successful, the companies could face civil penalties of up to $50,000 per violation. It is also an indication that state attorneys general have new ammunition in their efforts to guard against identity theft, and Texas, New York and others are prepared to use it. With identity theft crimes on the rise, companies and employers are well-advised to be vigilant in their protection of personal information of their customers and employees.

Privacy and Contract Revisited

Two weeks ago today, I wrote that individual privacy was basically dead (original post here). I wrote this in response to an article which discussed the terms of service for the new iPhone, and I pointed out that, since courts routinely enforce clickwrap licenses that are never read or understood by consumers, there was nothing in the world to prevent businesses from writing provisions into those contracts which basically stripped consumers of their privacy. Happily, I may have written too soon.

Since my original post, Wired.com has reported on two court decisions which, contrary to the general practice, have ruled against businesses on the enforceability of clickwrap licenses (stories on the subject are here and here). Does this mean that end user license agreements won't be the death of privacy? It's too early to tell - the cases reported on by Wired weren't directly concerned with privacy, and they might be an aberration rather than a sign of an emerging trend against click licenses. However, it is possible that my conclusion that privacy would be effectively destroyed by EULAs was premature. I hope it was, as that was one circumstance where I would much rather be wrong than right.

States Legislate Security Freeze Options

Just as state legislatures have grown impatient with waiting for Congress to enact data breach notification legislation, so too have they become frustrated with Congress' inaction to grant consumers a security freeze option. Also known as a "credit freeze", a "security freeze" lets a consumer stop the disclosure of his credit information by a credit bureau. The result of a freeze is that neither the consumer nor anyone else can open an account in the consumer's name. This option is a key measure to guard against identity theft if a consumer suspects that his personal information has been stolen or compromised. But the option is unavailable without state law authorization. According to the World Privacy Forum, by September, 2007, 27 states will have made the option of a security freeze available to residents of their respective states, and by 2008, that number jumps to 34. A few of the states make the security freeze available only to those who have been previous victims of identity theft, but most have no such prerequisite. World Privacy Forum. Several of the bills that have been introduced in Congress also include security freeze options, and several of the Senate bills have been approved by either the Judiciary or Commerce Committees. In the meantime, consumers in at least 27 states have one more weapon to combat identity theft.