Wednesday Morning Rant

The risks associated with so-called "Big Data" - or AI, or data aggregation, or anything in that vein - are known to a point. The obvious risk - and the one most people immediately cite - is identity theft and the corresponding fraud potential associated with it. Because of this obvious risk, the response is the same every time there is a data breach: the company at the center of the breach offers to pay for credit monitoring for some amount of time. Another major risk, especially popular these days as the Flock camera argument heats up, is panopticism. These data collection services have created an electronic panopticon in which no man has privacy.

These risks are real, and they are made all the worse due to a pair of conditions: data aggregators are juicy targets, and aggregators and governments have no significant incentive to defend sensitive data. The first is obvious. These data are valuable, so the aggregators are constantly targeted for theft. As to the second, the regulatory and legal environment provides essentially no penalties for data breaches - neither for private enterprises, nor for governments. In the unusual circumstance where an actual hacker gets caught, he will be punished - but that is the point. The hacker is the one with major liability, not the organization doing the collection, retention and defense of valuable data. To the organization, there's no problem outside of a press release, some technology costs and bulk-rate credit monitoring if there's a breach. If it's particularly bad, there may be a symbolic slap-on-the-wrist regulatory penalty.

This absence of liability causes a lot of perverse incentives. When there is no meaningful downside to data collection, data collection will expand - and that is what has happened. Some laws like the EU's General Data Protection Regulation (GDPR) have a "data minimization" requirement (collect and retain only what you actually need to do your work), but such requirements are very difficult to police effectively. Extensive "everything we can get" data collection is now the norm, and risks are increasing radically. Any target is increasingly a juicy target, because the amount of data collection is always growing.

Recently, a major breach was disclosed through it's effects, as more than 153 million US driver licenses were made available for purchase. The source of this was likely one or more services providing ID verification through ID scanning. More disclosure keeps happening around the extent of data collection, from smart TVs to government surveillance through third parties, which follows increasingly-invasive data collection schemes implemented for years in other industries like telecom.

All of this data collection creates vast reservoirs of personal data, ranging from trivial to extremely dangerous, and none of it is - or possibly even can be effectively defended. Despite this, there's little downside for the organizations doing the collection. The deeper these reservoirs get, the more appealing a target the organization will be - but the organizational risks are more or less static and do not scale with the collection. All of this leads to one basic conclusion for any organization in the data-collection business: collect more.

Flock camera databases are creepy and many have serious and reasonable concerns with the constitutional legitimacy of the system, but the dystopian government panopticon is only one issue. The other is that such services are deep reservoirs, and thus valuable targets. When Flock inevitably gets hacked and vehicle, movement and other personal data are stolen and used by criminals or nation-state adversaries, Flock will not collapse under the liability. They will simply issue an apologetic press release that downplays the event, fire a VP, spend some money on security consultants and put up with some ribbing by peers at conferences. Substitute any organization name you'd like for "Flock," because it is only an example. It always plays out the same way.

Until liability is extended from the hacker to the collector or aggregator, I think that this problem will only get worse. To disincentivize arbitrary data collection and the "more, More, MORE" approach to data collection, there must be real and meaningful costs to screwing up and permitting breaches. Slaps on the wrist and temporary spikes in operational costs that can be written off as the cost of doing business are not adequate. The closest thing there is to hard liability for data breaches is HIPAA, which has civil and criminal penalties for inappropriate disclosure. Something similar may be called for more generally, so that failure to defend collected data results in meaningful - up to the point of destroying enterprise in extreme cases - liability exposure.

The deeper and broader the data reservoirs get, the more the disclosure problem will grow. A good approach to dealing with the problem may not necessarily be to limit the collection as the GDPR attempts to do - there are limitless potential uses or requirements for data to deliver whatever service is being delivered, and enforcement is extremely difficult - but to strictly and meaningfully punish inappropriate disclosure. If there is real liability, the collectors and aggregators will think twice about what they actually need - and the amount of risk they're comfortable with - when it comes to data collection, retention and access. The best way to improve overall security is to reduce the attack surface, and that means draining the reservoirs - and liability may be a good way to do it.

What do you think?

posted by Joe Mannix at 11:00 AM

| Access Comments