Too Few Fighting the Good Fight on Privacy

Network World — I'm constantly amazed by the brazenness of certain large companies and governments when it comes to abuse of privacy. The most egregious recent example: The Chinese government announced that starting July 1, it will require the installation of rootkit software on all PCs sold in China — ostensibly to prevent its citizens from visiting "objectionable" sites on the Web. (If you believe that, I have a Great Wall to sell you.)

The software is essentially spyware. As Charles Mok, chairman of the Hong Kong chapter of the Internet Society, told The New York Times: "It's like downloading spyware onto your computer, but the government is the spy."

But the Chinese are hardly alone. The U.S. government is planning to appoint a cybersecurity czar whose job will be to spy on electronic transmissions. That's not what the administration claims, of course. The cybersecurity effort "will not, I repeat will not, include monitoring private sector networks or Internet traffic," says President Obama.

Obama's Cybersecurity Initiative Wins Praise

Good luck with that, Mr. President. Since the express goal of the cybersecurity czar is, among other things, to "secure private-sector networks," it's not at all clear how this person will be able to avoid spying on citizens.

Reaction to these events is decidedly schizophrenic. Groups such as the Electronic Frontier Foundation (EFF) were quick to sue the carriers when, in the wake of 9/11, companies such as AT&T and Verizon purportedly spied on U.S. citizens and turned over data to the government without a subpoena. Yet the EFF hasn't yet responded to Google's ridiculous "privacy policy," which explicitly grants the company the right to rifle through all e-mails sent to a Google address and hand over personal information to any government agency (U.S. or otherwise) so long as the company has a "good faith" belief that such action is reasonably necessary (no subpoena needed, or even requested).  

While the EFF has expressed a lukewarm discomfort with the U.S. government's move to create a cybersecurity czar, the group is proposing to "start a discussion" — not a lawsuit. I guess spying is more OK when it's the Democrats who do it.

The bottom line? Privacy matters. IT practitioners should do what's in their power to ensure their organizations' data is protected. This includes:

* Explicitly asking for the privacy policies of all providers that might store or transport data. This includes not just carriers, but anyone offering cloud computing, software-as-a-service and enterprise search.

* Refusing to store data in countries with iffy privacy policies. In the Far East, pick Hong Kong over mainland China (its legal system is separate). In Europe, Germany is a good bet. And in North America, Canada is preferable to the United States.

*Voting with your feet. Use a company's privacy policy as a selection criterion. Personally, I've switched to Microsoft's Bing as a search engine, because Microsoft's privacy policy is marginally less onerous than Google's.