Navigating Between Security and Privacy

Much has been made over the last several years on the interrelated topics of personal security and personal privacy. A lot of the discussion around security has surfaced in response to the seminal terrorist attack in 2001, while privacy was borne of the growing masses of databases that contained the aggregate of our lives in their tables. "No one's life, liberty, and pursuit of happiness is safe while Congress is in session," noted Mark Twain, and in the intervening 100 years or so the threat became not only Congress, but also any e-commerce vendor with a credit card database.

The problem is that security and privacy are at opposite ends of the same continuum. While it is unlikely we can have absolute security from those with nefarious motives, we can get close, but only if we are willing to surrender all information about ourselves. That information will enable those who are responsible for our security to know where we are, what kind of threat we might be under, and how it might be mitigated.

It is that same information that interferes with our privacy. Knowing where we are, what actions we are taking, and who we are taking them with makes it possible to better protect us, but at the cost of the loss of that privacy. And the biggest problem is that we cannot individually choose where we want to camp out on this continuum. The choice is as a society, because anything less than full participation results in incomplete information and a security hole.

So as a society we choose sacrificing some privacy to obtain better, but still imperfect security. My airline reports my commercial flight movements to the federal government, for example. This typically occurs well after the fact of travel, so it only means that the government possessed a record of my past travel, rather than a realtime tracking of my movements, which would be much more invasive. But that information can be used in other ways.

"Who will watch the watchers?" is a reasonable question. In the past, we were able to rely on government inefficiencies to protect our privacy. But government is becoming less inefficient; in fact, many of us are helping that process through our application development, deployment, and management efforts. So my airline travel record over the last year can be matched up with the old arrest warrant for draft dodging, for which I never bothered to apply for a pardon. (Before you drop a dime on me, this is only hypothetical; I was too young forVietnam service, and in fact served in a later era.)

We could rely on inefficiencies and gaps in data to compartmentalize our information and prevent correlations such as this, but those times, if they still exist today, will not for much longer. Our lives are more open to the various government agencies, not necessarily because they collect much more data, but because software makes it possible to share it.

I am comfortable with compromises (see my previous posting, "TANSTAAFL"), but individual preferences don't count here. I have to participate in the same systems that everyone else does. Although I know the statistical probabilities are small, I accept that my next air trip could coincide with a terrorist incident. And I might be willing to give up something to lessen those odds still more. But what would I be willing to trade for that extra protection? I might also be willing to increase those odds to protect my identity and credit history. But how much? That's the part none of us is sure of.

Where do you stand on the continuum between security and privacy, and why?

Posted by Peter Varhol on 12/06/2004