Click. Connect. Learn.

All posts in Privacy

Mountain Lion, Closed Systems, Privacy, and Device Churn

Some interesting dates from the not-so-distant past:

December, 2009: "Apple has said it rejects 10 percent of submissions for being 'inappropriate,' in some cases because they try to steal personal data".

November, 2011: Apple kicks a security researcher out of its developer program for developing a proof of concept that shows how to exploit a security hole. The best part: the researcher had reported the flaw three weeks earlier.

February, 2012: An approved app, available in the App Store, is caught uploading entire address books (aka, stealing personal data), without user consent or knowledge. This app was never pulled from the App store, and an updated (non-address stealing version) is still available.

Rotten Apple

Apple has done a great job of pairing marketing hype with security through obscurity. Apple has created the appearance of a secure system (trust us! we're the gatekeepers!) but the holes in this system keep reappearing. I'm not saying that other systems are any more or less secure; however, other systems don't attempt to parlay a walled ecosystem into the equivalent of a secure environment. There have been instances of security fixes being delayed as a result of Apple's review process, resulting in users having no alternative to compromised apps, and no knowledge of the compromise.

However, despite these issues, Apple supporters - and especially Apple supporters within education - go to great lengths to describe how satisfied they are with their Apple purchases, and how they are not bothered by the increasingly intertwined way that the Apple ecosystem shuts out alternatives. Concerns about student privacy, and how iTunes accounts are effectively required to use iPads and other Mac products, have died down. People seem to have accepted that school in the 21st century requires paying companies to take over your personal data and usage patterns, and mine them for information.

But really, how many people who have gone deep into Apple could express anything but satisfaction, or even intense excitement? What are the alternatives?

Can you imagine a tech director walking into their boss and saying, "Well, this Apple hardware and software was okay, but with a little hindsight they aren't really necessary for learning, and there are other options that look promising, and might even be cheaper. I'd like to explore some other avenues. Oh, and one last thing: sorry about the several hundred thousand/millions we've spent on that hardware and software, and sorry that a good percentage of our faculty and student creative output is locked into apps that don't work on anything else but Apple stuff."

Of course people that have gone all in with Apple will be delighted with the results. The alternative is admitting that resources were squandered on something that was untested, and proved to be not as awesome as the sales teams/fanboys promised. People who have gone heavily into Apple need for Apple to be the best thing ever, as that reinforces their "vision."

So, when I read about the release of Mountain Lion, and how this is a move to annual release cycles of OS upgrades, and how people will now get the chance to upgrade every year (as opposed to having to upgrade every year), it's a move that makes sense for the direction Apple is heading: toward a fully closed ecosystem where people are pushed into frequent upgrade paths leading to increased device churn.

And learning? No problem. There's got to be an app for that.

But the one thing that doesn't surprise me is the name: Mountain Lion. Mountain lions love sheep.

Image Credit: "Rotten Apple" taken by Vince Wingate, published under an Attribution Share-Alike license.

Social Media and Cooperative Surveillance

So the Bruins won the Super Bowl. Or something like that.

And in the aftermath, people rioted in Vancouver. And in those riots, pictures and videos were taken.

And some people took it upon themselves to identify the rioters.

Stanley Cup

And after the aftermath - with nearly 170 people treated in hospitals, volunteers cleaning up the city, people began to ask questions about surveillance and the role of social media.

In the comments of her post linked above, Alexandra Samuel extends her original thoughts to include the "slippery slope" argument:

I don't see how we can claim to be uncomfortable with mass surveillance -- to fear Big Brother -- but then make exceptions when it's convenient, or feels important. This is a slippery slope and we can't draw too many simple lines -- even a line based on exposing illegal behaviour (as opposed to legal but controversial). Remember that there are places where it's illegal to smoke dope, or criticize the government, or hold hands with someone who is the same gender as you. Do we accept social media surveillance in those contexts?

To start, it's worth pointing out that most slippery slope arguments aren't worth the air required to set them loose. A "slippery slope" argument assumes that we live in a world with moral absolutes, and that making a "wrong" choice plunges us into the abyss of uncertainty and ambiguity.

But with that said, to all those who argue that using social media to identify rioters to the state are engaging in community surveillance/crowdsourcing big brother/engaging in nefarious deeds to further the expansion of the omnipresent nanny state: you are late to the game. That ship has sailed. People are reporting on one another, and have been for years, well before the advent of the social web. Perversely enough, people using Facebook are complicit in building their own Panopticon. And, in using sites like Facebook - where people throw their contact information, their interests, the places they like to go, the people they like and dislike, things they buy, games they play (and how they play them), what they look like, what their friends look like, etc, etc - people leave a broad data trail. Even rough data shows a lot about individuals; more sophisticated datasets allow for more sophisticated predictions.

It would be interesting to look at what could be discerned from a person's datastream on Facebook, combined with the data accessible via the phones and laptops we use, and how close that woud come to supporting the data needed to make the Information Awareness Office a reality.

But to return to the argument of what constitutes an appropriate use for social media, and what level of privacy is reasonable to expect: we need to ground these conversations within the historical reality that people have been disagreeing, behaving badly, attempting to avoid responsibility - and then talking about it - for centuries (as an aside, Augustine would have had an AWESOME twitter feed). Social media just lets us get the word out faster.

And, if you are now concerned about privacy, and the relationship between surveillance, privacy, and the state, there is one thing you can do right now to make it better: stop using Facebook, Foursquare, Twitter, etc, as outreach and communication tools. To use social media is to participate in a continuous act of cooperative surveillance: sometimes we're watching ourselves, sometimes we're watching others, sometimes we're being watched, but the difference between sharing and observing is largely a matter of the side of the window you're on.

For the many self-proclaimed "social media consultants": stop advocating an expanded use of Facebook, Twitter, etc, to the detriment of an organization's primary web site. If you have engaged in such unseemly behavior in the past, it's never too late to admit your mistakes. Just stop repeating them. And if you have been working in social media for more than 15 minutes and are actually surprised by privacy implications, you can always go back to selling cars.

Seriously, though, if you are giving advice to an organization that does social justice work, be very careful of the relationships you encourage them to foster on external social sites. Given Facebook's unclear direction in China, the ease in which apps can access and store user data, the way bugs leak private data, and Facebook's own hamfisted "privacy" efforts (from Beacon to facial recognition and everything in between), encouraging social justice-oriented groups to work on Facebook could be putting people at unnecessary risk.

As we talk about privacy and surveillance, we need to remember that a key difference between a surveillance tool and a tool for individual or collective empowerment is who controls the data, and how that data is used.

Image Credit: "Patrice Bergeron" taken by slidingsideways, published under an Attribution Non-Commercial No Derivatives license.

Google and Data Collection

Last May, Google announced that it had accidentally collected personally identifiable information as part of capturing data for the Street View functionality of Google Maps.

A look at the technical aspects of what was collected, and why, tends to support Google's explanation that this was accidental, and not anywhere near as big a deal as people wanted it to be.

New Camera

Please don't misunderstand - Google has plenty of issues with user privacy, and the ramifications for student privacy as more K-12 schools transition to Google Apps are mind-boggling. But, the kerfuffle over data collected for Street View is overblown.

Moreover, Google appears to be taking steps to mitigate this, and they are candid about their role in the failure, and clear about the steps they are taking to improve it. Other companies with widespread privacy issues (cough cough Facebook cough cough) could learn from how Google is handling this.

Image Credit: Photo "New 'Camera'" taken by Sherman Tan, published under an Attribution license.

Bad Execution As A Feature

A great new feature that comes with the Facebook Groups: any friend can add you to any group, without your permission.

And, it's really easy to impersonate someone!

So, I wonder how long it will take for a teacher to get in trouble for belonging to a group they were added to by a "friend."

I don't know how many more times I'll need to say this, but I'll add this additional time to the pile of others: Facebook is a business, and Facebook only cares about your interests up to the point where they can study them and profit from access to them. That is why they allow you to "connect" with things. Any benefit you receive is purely incidental.

Have Fun Explaining This To Parents As Your School Transitions To Google Apps

While this is likely an isolated incident, it certainly raises questions about what happens to a student's personal information (also known as their thoughts, and portions of the intellectual explorations that make up their life) when it is sent to a large company. In this case, an engineer at Google was allegedly fired for accessing the accounts of minors:

In other cases involving teens of both sexes, Barksdale exhibited a similar pattern of aggressively violating others' privacy, according to our source. He accessed contact lists and chat transcripts, and in one case quoted from an IM that he'd looked up behind the person's back. (He later apologized to one for retrieving the information without her knowledge.) In another incident, Barksdale unblocked himself from a Gtalk buddy list even though the teen in question had taken steps to cut communications with the Google engineer.

So, as schools make decisions to outsource essential services to external companies (aka the cloud), it's worth remembering that there are people working around the clock to keep the cloud running. Most of these people do the right thing all of the time, but for schools rolling these services out (and requiring students to use them as part of their school work) what recourse would you have if your student's privacy was violated? More to the point, how would you know? Is there even any guarantee that you would be told?

At what point does convenience trump the ability to guarantee your students and your parents that you have taken reasonable steps to ensure the privacy and integrity of work done within your school?

Syndicate content