« Reprise: Leopard vs. Vista on Security | Main | There's a Surge In Attempts to Compromise SSH Passwords »

May 12, 2008

An Interview With AOL's Chief Privacy Officer

I’m still digging out from my long weekend, but I see Kenneth Corbin, a colleague over at InternetNews.com has posted a lengthy interview with AOL’s chief privacy officer. One interesting excerpt:

“Q: So if legislation can’t keep up with the nuances of technological innovation, is there any room for some kind of a baseline privacy law on data collection?

“I think this is an area where we’re still trying to figure out exactly what people’s expectations are. I would often have debates with the guy who was the inventor of the Buddy List, and he always had different ideas about different promotional things that he wants to do, and I’d say ‘No! You can’t do this! You can’t do this! It’s got to be opt-in…’ And he’d say to me, ‘You know, if you were around when I did the Buddy List, you would have said ‘opt-in’. People downloading instant messaging software shouldn’t be able to see whether your friends are online.”

“And I probably would have been. Why should you — just because you know my screen name — be able to track whether I’m online or not? That’s outrageous! Opt people in. And he’s like, ‘That would have been the end of it, because the whole point of instant messaging is that I can ping you because I see that you’re online. There, you broke my product.’

“You can easily see a law that says you shouldn’t, by default, broadcast information about what you’re doing to all your social networking friends. Well, I kind of like that; I like being able to do it. If I wasn’t even aware of that business model when I was drafting legislation, who knows what I would have broken that people do indeed want and are now using to promote political candidates or using to fundraise or using to do all sorts of things?”

(Link)

Which reminds me …

When I worked at Indiana University the public VAX system had three personalities: You could use the limited menu system to do stuff like read your e-mail and other basic activities, you could edit a dot or config file of some kind and use the system from the command line, or you could opt for an unsanctioned third personality and install a collection of utilities that provided a bunch of functionality you might expect to turn up on a college campus.

The developer had painstakingly mapped the IP addresses of every public terminal on campus down to their room and position, and he had an idea of where a lot of staff terminals in non-public locations could be found. So you could use the utilities to pull up a directory of which utilities users were online in a given lab or room and get a map of where those users were seated. Then you could use the utilities to open a ‘talk’ session (or whatever it was called in VMS-land) with the user you’d mapped.

The map database was comprehensive, but it didn’t keep up with developments in the real world, so if a pair of machines were switched, or if a whole lab went in for servicing and got put back in different order, the map would break. The fallout from these breakages was mildly comical: I’d be sitting in some lab catching up on my mail and I’d get a talk banner on my terminal that read “That’s a sexy top you’re wearing … wanna meet?” or “You look really nice … I can tell because I’m looking at you RIGHT NOW.”

It was, after all, 1991, and a generation of maladjusted dorks had been raised on movies that suggested a mild display of super stalker powers via the computer would eventually lead them straight to Ally Sheedy’s heart.

Anyhow … the point:

Those utilities were really just a crude social overlay for a system that had all the bits and pieces it needed to do that kind of thing. To get them you needed to a. know about them, b. be willing to turn off the friendly and utilitarian menu system and c. run a script out of the maintainer’s account that installed the utilities in whatever passes for ~/.profile in VMS. And plenty of people did. They even did it knowing they were subjecting themselves to stuff like that terminal mapping app, which would probably go by “stalkr” if it were out and about on the campus network now.

The engineer in that excerpt above was, I suspect, dead wrong. Opt-in presence wouldn’t have “killed” IM because there really aren’t a lot of soft barriers like “click a box at install-time” or even “turn off the existing interface and install a new interface by running a shell script in some stranger’s VAX account” that will stop people from doing things like, you know, installing software that tells everyone on campus exactly where they’re sitting at any given moment they’re using a computer.

Posted by mhall at 5:36 PM | Add Comment