In a weird twist of political philosophy on privacy and liberty, I agree and disagree with them both.  However, I disagree not because Nicholas and Jim are wrong, but because I do not believe that we must accept the assumptions behind their arguments.  Their assumptions with respect to online privacy are rooted in the idea that the World Wide Web is a static state of affairs, that privacy can only be managed through settings at various websites.  As CLOUD has written and tweeted extensively over the past year, the World Wide Web is but one “view” into the Internet.  True privacy and security of the sort that tackles Facebook’s continued bouts with privacy problems and the challenges with patient data from EHRs will depend on a new language for the Internet, one built around people and not web pages.

One sentence in particular from Mr. Carr’s article jumped out at me.  ”Most of us view personalization and privacy as desirable things, and we understand that enjoying more of one means giving up some of the other.”  Based on the current paradigm of the web, that is true, but what if privacy were architected into the Internet?  Current mechanisms for “logging into” web sites or submitting data force this sort of false trade-off.  CLOUD believes that transparency and privacy can co-exist, but it requires a new perspective.  That perspective is ME 1.0, rather than just Web 2.0.  Quoting from Mr. Carr again, “This tradeoff has always been part of our lives as consumers and citizens. But now, thanks to the Net, we’re losing our ability to understand and control those tradeoffs.”  CLOUD’s goal through it contextual markup language (CTML) is make those tradeoffs clear and put control back in the hands of individuals.

The idea of ME 1.0 is described on our homepage.  This concept and the idea of separating WHO I Am and WHAT I Am are at the foundation of a new Internet.  The language that CLOUD is building is why I can agree and disagree with both Nicholas and Jim.  I agree with Nicholas that as individuals we must secure our privacy to secure our liberties, and I agree with Jim that we should “get smart and learn how to control personal information.”  CLOUD believes, however, that that control should be in our hands and not just at the mercy of others on the Web, be they Facebook, Google, your doctor or the government.

Share This Post

The following quote is at the very heart of the privacy issue:

The “summary” records contain basic medical information including illnesses, vaccination history, and could include medication patients have been given. Ages and addresses are also included. (emphasis added)

The issue with privacy on the Internet today is that the data silos into which our records are poured not only include What I Am™ but Who I Am™.  The combination of critical health information, in this case, along with personally identifying information is at the heart of the privacy issue.  If one can separate Who I Am™ from What I Am™, then the privacy issue begins to change, since the NHS database may have the What, but it won’t have the Who.  The patient, along with their doctor, are in charge of connecting Who to What.  No opting out… simply better control… and putting the ownership of the data into its rightful place, the individual.

Approaches, like OpenID, regretfully, are only a part of the solution to this EHR ownership issue. By facilitating “logging in” to web pages and making it  possible to more quickly take all of my information and put it into yet another web and data silo, they don’t change the privacy problem.  They accelerate it.  Their home page states this very clearly, “Log into 50,000 websites with a single username.” Even the OpenID Foundation accepts the world of web sites as a given: “OpenID is a safe, faster and easier way to log into websites.”  OpenID’s challenge is that it accepts the browser and web paradigm of the past 15 years and does not go to the heart of the Internet that was ushered in by Vint Cerf and Bob Kahn 40 years ago.

Katherine Murphy, of the Patients Association, quoted in the article, says it best: “The Health Service should not put in place bureaucratic obstacles to patient choice because they are worried about what patients might choose to do.”

CLOUD seeks to fix a broken Internet, so that patients can have that choice.

Share This Post

Although Google Buzz has fixed its highly visible privacy flaw that occurred at launch, this episode is another indication that privacy must be woven into the fabric of the Internet, rather than a term of service by vendors.  The challenge ahead of us is not just a technological one but a philosophical one.  At its heart, the question is “who owns ME?”  CLOUD’s goal is to build the technology architecture that makes it possible for us to have “Local Ownership and Use of Data.”

Peter at SWIFT does a brilliant job of explaining how and why this is different than the eID movement and how CLOUD can propel all of these efforts forward by ushering in a new era of ME 1.0.

Share This Post

Protecting privacy isn’t a challenge unique to Facebook. It was around long before the invention of HTML and Web sites 15 years ago, but those developments made the challenge acute. The pre-Web Internet was about connecting people directly, but the Web caused a reversion to publishing and broadcasting models. The Web and HTML have contributed to the growth of the Internet, but their main side effect has been to force us into silos to connect with each other. Facebook, with 350 million users, is one impressive silo, but more than 1.7 billion Internet users are spread among millions of other silos.

So, what does this mean for privacy? Today’s Web-based approaches to privacy require that my identity and facts about me — particularly “who I am” and “what I am” — share the same data silos, whether on Facebook, at Amazon, or in my local DMV’s e-renewal system. CLOUD’s take on the Express Scripts data breach expands on how privacy can be even more critical in the realm of health information than elsewhere.

CLOUD is creating standards to make privacy an architectural issue with a structure to benefit all Internet users — instead of making us dependent on the lowest common denominator of what particular Web sites happen to do with our information. By separating the “who” and “what” of identity into core components protected by a new contextual markup language, CLOUD plans to destroy our collective dependency on mass data aggregators like Facebook, not to mention schools, medical facilities, and businesses — and restore genuine privacy control to individuals.

CLOUD will continue to develop its new approach to the Internet in the new year. Please join the conversation!

Share This Post

SC Magazine | Chuck Miller | October 1, 2009

Last year’s data breach of St. Louis-based Express Scripts may be more serious than initially believed.

In November 2008, the major pharmacy benefit management firm said it received an anonymous letter that included the names, Social Security numbers, birth dates and, in some cases, prescription information of 75 members. The writer or writers threatened to release millions of more records if the business failed to pay an unspecified sum of money.

In the last two months, based on new information from the extortionists, Express Scripts began notifying more than 700,000 victims of their personal information may have been compromised.

CLOUD Take: It is interesting that a data breach that affected 700,000 people is perceived as a breach of Express Scripts.  Although the point of loss may have been systems at Express Scripts, there were 700,000 breaches, not one.Privacy and security are inextricably linked, and it is CLOUD’s Take that as long as information about “who I am” exists in the same databases as information about “what I am” the problem will continue.  Crafting a new language for the Internet that allows these to be separated will help both individuals and organizations, like Express Scripts.

After initially notifying only the 75 victims from last year, the company in August was told by the FBI that “…the perpetrator of the earlier action had recently forwarded a letter and data file to a law firm,” according to the company’s website.

Maria Palumbo, spokeswoman for Express Scripts, would not elaborate on the contents of the letter.

“The FBI is conducting the investigation that was opened last fall,” she told SCMagazineUS.com Thursday. “It is still ongoing.”

The website points out, however, that FBI special agents contacted Express Scripts immediately, and the news was not good.

“The data shows that the extortionist possesses additional member records from the same period of time as those identified in the 2008 extortion attempt,” according to the website. “Express Scripts is in the process of notifying these members.”

According to Palumbo, most of the 700,000 notifications were sent as a result of the August FBI action.

The data thieves still threaten to expose the Social Security numbers, addresses, birth dates and prescription information of millions of patients of the pharmacy benefit management firm unless the company pays an undisclosed sum in extortion money. The company has offered a $1 million reward for information leading to the arrest and conviction of the extortionists.

CLOUD Take: The $1M reward is a visible sign of the cost of this problem and likely doesn’t include the cost to the 700,000 individuals.  Although Express Scripts may be at the point of this needle, it is CLOUD’s perspective that it is the “data silo” problem and lack of other solutions that are the bigger problem. We wish Express Scripts the best of luck in its work with the FBI and its members to bring this situation to a successful conclusion.

Share This Post

By Ken Denmead

“It seems like every time I talk to people about privacy, there’s a feeling that younger users of online tools simply don’t care about the issue. Often, I am asked why privacy advocates like CDT push government and industry to protect privacy more robustly- when ‘no one cares’? In short, people seem to be asserting that digital natives like myself do not value privacy online. While this point is oft repeated, I think that this argument is flawed, and does not address the subtleties of privacy in the cloud, social networks, and other new online technologies. Simply put, these technologies are giving digital natives (really, all users) greater control over their information – and we use it.”

CLOUD Take: CLOUD, Inc. agrees with Heather West, policy analyst at the Center for Democracy & Technology, and writer of this guest post at Geek Dad.  The time for greater control of our information has arrived, and the locus of that control should not be at the website but instead at the user, the individual.

“Digital immigrants tend to think about privacy as the ability to conceal information from others. Digital natives instead share information within certain contexts, and with granular privacy controls on that information. And according to a new study on behavioral advertising, it is precisely the 18-24 year old age bracket that cares most about how information is used to make decisions about them to deliver news, advertisements, or discounts. In fact, one of the survey’s authors told the New York Times that it’s likely that young adults care more about their privacy and how companies use their information than expected.

Rather than an all-or-nothing public or private paradigm, we expect to be able to choose levels of privacy and levels of exposure to the public. Most teens restrict access to their online profiles and do not think that sharing their information with a specific set of people means that the information is in the public domain. This allows them to both gain the benefits of sharing and communicating online, but also protecting their privacy and remain empowered in their choices about their own information.”

CLOUD Take: The ability to not only choose levels of privacy but to retether components of one’s profile from across data silos in multiple web sites is the goal of CLOUD’s new contextual markup language.  Current approaches to logins, like OpenID, or data portability assume that data needs to be moved.  CLOUD assumes the user simply needs to be able to manage it better, with the granular level of control Ms. West mentions here.

“These expectations of granular control over information, both in the Pew studies on privacy controls and the more recent study on tailored content and advertising, seem to reflect the expectations of the Fair Information Practices (FIPs) that form the basis of most privacy law. These FIPs, first developed in 1973, represent a simple set of ideas about how information is used.”

Data from the survey and full article (highly recommended) can be found here.

Share This Post