Daniel Ayala, Director, Global Information Security, ProQuest
Rocky River Public Library
18 April 2018
About me…
Security & Privacy are hard in the modern
world
Dilemma:
Data is being collected
everywhere, all the
time.
Source: https://www.domo.com/learn/data-never-sleeps-
Privacy is dead
But still not very
good in the US
NOT YET
But first, a question…
7
Increased
territorial scope
Consent
Breach notification
Right to Access
Right to be
Forgotten
Data Portability
Privacy by Design
Data Protection
Officers
General
Data
Protection
Regulation
4% of Global Revenue or €20M
8
whichever is greater
The cost of not dealing with GDPR
European Global
10
US ISP Browsing Data
Privacy Rollback
11
US Net Neutrality
Rollback
Latent Data Collection
Latent Data Collection
Latent Data Collection
Latent Data Collection
The Data Economy
If you are not paying for it you’re not the customer, the
product, you’re the product being sold.
-Andrew Lewis (blue_beetle)
Daniel’s new corollary:
Even if you are paying, unless
you read deeply between the
lines, you may still be the
product!
EXAMPLES!
Automobiles
Lightbulbs
Headphones
Facebook & Cambridge Analytica
Consumers are
starting to pay
attention to
privacy
19
P R I V A C Y
and so are
legislators!
Balance
20
Security &
Privacy Utility
The perfectly secure
computer?
The perfectly secure
computer!
Turned off.
Unplugged from network.
Locked in a safe.
Accessed by no one.
Fully Private
Fully Secure
Fully Open
Fully Collecting
Utility
Balance
???
Uninformed
What do I pick?
Huge utlity, huge data
disclosure
Fully Private
Fully Secure
Fully Open
Fully Collecting
Utility
Now add in transparency
Better informed
Still want utility
Might make better
choices
It’s clear what is collected
It’s clear what it is used for
It’s clear who they share it with
It’s clear how long they keep it
It’s presented so that average beings
can read it quickly and clearly
OMG!
I can use w/o sharing
everything?
I can decide what to
share?
Fully Private
Fully Secure
Fully Open
Fully Collecting
Now add in transparency It’s clear what is collected
It’s clear what it is used for
It’s clear who they share it with
It’s clear how long they keep it
It’s presented so that average beings
can read it quickly and clearly
and choice!
Utility
Fully Private
Fully Secure
Fully Open
Fully Collecting
Finally, add trust (but verify)
and accountability
I can trust because I’ve verified
They do what they say they do
More value, more control
Data security practises
Depersonalisation (and even better,
aggregation)
Retention (GET RID OF IT FAST!)
Use an identity that user’s care about
and protect
Utility
The Library
Libraries have
automated,
digitised, protected
and purged
29
30
IV. Libraries should cooperate with all
persons and groups concerned with
resisting abridgement of free
expression and free access to ideas.
When users recognize or fear that
their privacy or confidentiality is
compromised, true freedom of
inquiry no longer exists.
https://twitter.com/LindseySanford/status/986298371441741824
https://panopticlick.eff.org/
https://www.eff.org/privacybadger
https://myaccount.google.com/dashboard?pli=1
Firefox FocusBrave
Ublock Origin Firefox Lightbeam
https://urlscan.io/
Balance
41
Security &
Privacy Utility
References
• https://bit.ly/pragmaticprivacy
• https://iapp.org/news/a/explaining-the-gdpr-to-an-american/
• http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
• https://www.nytimes.com/2018/01/28/technology/europe-data-privacy-
rules.html
• https://www.domo.com/learn/data-never-sleeps-5
• https://www.teachprivacy.com
• https://bit.ly/pragmaticprivacy

Keeping it Private - A Discussion About Data and the Internet

Editor's Notes

  • #5 https://www.domo.com/learn/data-never-sleeps-5
  • #6 Clear the myth: Privacy is dead Good news: It’s not dead yet. EU is driving a new way of thinking Bad news: Still not great in the USA
  • #7 So how do we get there? How many of you are familiar with something called GDPR? Show of hands. Very curious as there are those of us with our heads so deep into it that I want to know what the general sense of this is in the USA
  • #10 https://www.nytimes.com/2018/01/28/technology/europe-data-privacy-rules.html https://techcrunch.com/2018/01/24/facebook-to-roll-out-global-privacy-settings-hub-thanks-to-gdpr/
  • #18 GM Onstar – Continued to capture data about car customers even if they were not OnStar customers, unless they figured it out and opted out. (2011) Bose – Was sending song data along with other usage info back to Bose – had no way to opt out (auto opted-in). Now is a slider, have to know to opt-out. Already collected song data, not purged IoT Lightbulbs (and everything else IoT)
  • #20 PEW Research did a study last year in which they declared that 62% of those surveyed said they trust Facebook “not at all” or “not very much” based on the lack of clarity of exactly how their personal data is being used.  Granted Facebook collects a ton and is pretty vague about what they do with it - but it means that people are starting to be curious about how data is being used, and are needing more information.  The same goes with security - there is so much to know, so much to find, and librarians are the perfect people to become well-versed in these topics..
  • #30 http://www.ala.org/advocacy/intfreedom/librarybill
  • #32 http://www.ala.org/advocacy/intfreedom/librarybill/interpretations/privacy
  • #33 http://www.ala.org/advocacy/intfreedom/librarybill/interpretations/privacy