Joe Mansfield at Peccavi has done a very cogent post where, though he agrees with my concerns, he criticizes me for picking almost exclusively on Google when there are lots of others who have been doing the same thing. He's right – I have been too narrowly focused.
Let me be clear: I have great respect for Google and many of its accomplishments. I have a disagreement with a particular Google team.
I find the Google Street View team's abuse of identifiers especially worrisome because they have not only been collecting info about WiFi access points, but the MAC addresses of peoples’ personal devices (laptops and phones).
This bothers me because I see it as dangerous. It's like going over to visit a neighbor and finding out he's been building a nuclear reactor in his basement.
I'm not an expert on the geolocation industry and I have no knowledge of whether this kind of end-user-device-snooping is commonplace. If it is, then let me know. Everything I have said about Google applies equally to any similar practitioners.
But let's get to Peccavi which makes the point better than I do:
I’ve been following Kim Cameron’s increasingly critical analysis of Google’s StreetView WiFi mapping data privacy debacle with some interest of late.
Some background might be in order for those interested in reading where he’s been coming from – start here and work forward. He’s been quite vocal and directed in his criticism and I have been surprised that his focus has been almost entirely on Google rather than on the underlying technical root cause. My initial view on the issue was that it was a stupid over-reaction to something that everyone has been doing for years, and that at least Google were being open about having logged too much data. I’m still of the opinion that the targeting of Google specifically is off base here, although I think Kim is right that there is a fundamental problem here.
Kim is probably the pre-eminent proponent and defender of strong authentication and privacy on the net at the moment. His Laws of Identity should be mandatory reading for anyone working with user data in any sort of context but especially for anyone working with online systems. He’s a hugely influential thought leader for doing the right thing and as a key technical leader within Microsoft he’s doing more than almost anyone else to lay the groundwork for a move away from our current reliance on insecure, privacy leaking methods of authentication. Let’s just say that I’m a fan.
For obvious reasons he has spotted the huge privacy problems associated with the practice of gathering WiFi SSID and MAC addresses and using them to create large scale geo-location databases. There are serious privacy issues here and despite my initial cynicism about this perhaps it’s a good thing that there has been a huge furore over what Google were doing.
Note that there were two issues in play here – the intentional data (the SSID’s, MAC addresses and geo-location info) and the unintentional data (actual user payloads). I’m only going to talk about the intentionally harvested data right now because that is the much trickier problem – few people would argue that having Google (or anyone) logging actual WiFi traffic from their homes is OK.
The problem that I see with Kim’s general position on this and the focus on Google’s activities alone is that he’s not seeing the wood for the trees. The problem of companies or individuals harvesting this data is minor compared to the problem that enables it. The technical standards that we all use to connect wirelessly with the endless array of devices that we all now have in our homes, use at work and carry on our person every day are promiscuous communicators of identifiers that can be easily and extensively misused. Even if Google are prevented by law from doing it, if the standards aren’t changed then someone else will…
I agree with almost every point made except, “The problem of companies or individuals harvesting this data is minor compared to the problem that enables it.” I would put it differently. I would say, “There are two problems. Both are bad.”
We're technologists so we immediately look to technology to prevent abuse. This is the right instinct for us to have. But societly can use disincentives too. I've come to believe that technology must belong to society as a whole. And we need a combination of technical solutions and those society can impose.
I actually think I see at least some of the woods as well as the trees. That is what the Fourth Law is all about. Of course I want to change the underlying technology as fast as we can.
But I don't think that will happen unless there is a MUCH greater understanding of the issues, and I've been trying with this set of posts to get them onto the table.
[More Peccavi here.]
