AOL Data Valdez and the Privacy Ceiling

[David Farber <dave () farber net>]

Begin forwarded message:

From: Janice Tsai <harraton () cmu edu>
Date: August 15, 2006 3:29:03 PM EDT
To: dave () farber net
Subject: AOL Data Valdez and the Privacy Ceiling

My collaborator Scott Craver posted a blog entry examining the AOL
"Data Valdez" incident in light of the "privacy ceiling."  It follows
up on another thread on Freedom to Tinker
(http://www.freedom-to-tinker.com/?p=1029) about what kind of incident
would become the next "Exxon Valdez of Privacy."

http://blog.xcott.com/?p=16

<snip>

In an upcoming paper for the ACM 2006 DRM workshop, Lorrie Cranor,
Janice Tsai and I propose an interesting concept called a "privacy
ceiling." This is an economic limit on privacy violation by companies,
owing to the liability of having too much information about (or
control over) users. If companies had the foresight, they would
recognize this limit and stay beneath it; but then, if companies
behaved as described in economics textbooks we wouldn't have Enron or
WorldCom either.

<snip>

Here are some other observations on this privacy leak:

<snip>

   * This privacy leak passes at least the gut test for a "Valdez"
event. There are numerous factors which determine how much public
outrage a disaster will generate. For privacy disasters, I feel a big
factor is the personal nature of the personal information. First
consider a company leaking your social security number. Now consider a
peeping tom concealing a camera in your bedroom. Both are privacy
violations, but in the latter case the violation is felt at a more
visceral level. Likewise consider someone reading your personnel
records, versus someone reading your medical records, versus someone
reading your diary.

<snip>

Janice Tsai


-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/