For as long as I follow discussions and event around the internet and similar technology (networked databases, datamining &ct) the topic of privacy has been quite dominant (especially here in Germany!). Privacy itself is not a new concept, we’ve had the option to put curtains in front of our windows for a while now, we could close our doors and we could decide who to share our holiday pictures with. We had a lot of privacy and whenever a government agency or other entity was stepping in to rob us of it, there were complaints, demonstrations and public disobedience.
Now with the Internet being very dominant in many of our lives, the discussion of privacy comes up almost weekly: Facebook, 4Square, Google Street View … we could go on for ages here and list all the different “Privacy Disasters” we’ve had in the last year or so. But lately I’ve come to the conclusion that it’s a battle that cannot be won. Why? Because we’ve said it for years now, just in a different context.
Let’s step away from privacy and look at a different topic: DRM. DRM stands for Digital Rights (some say Restriction) Management, DRM is what tries to make copying a DVD or a video game not simple, DRM is what locks you out of the music you bought when you buy a second computer. What DRM does is (quoting Cory Doctorow here) “trying to make bits harder to copy” and as Cory so precisely nails:
“There is no such thing as a copy-proof bit. There aren’t even copy-resistant bits. Copying is what bits are for. They will never, ever get any harder to copy.
If you want people to be able to listen to something at home, or watch something at home, you lose control over it. There are always ways to intercept data and copy it, even if you think it is encrypted, take a video file for example: Let’s say you encrypt it with a secret key so people can only play it after having contacted your servers and authenticated to get a key to unencrypt it. That’s safe, right? Except for the fact that at some point the data has to be decrypted to be playable on some sort of screen and at that point somebody can intercept it and save the unencrypted data. Even if you move the encryption to the TV, people will just start soldering a few contacts in and get the data some other way or they’ll use cameras to save the image. And yes, the quality suffers, but when I was young and we copied CDs for each other we used tapedecks and it was good enough. Quality loss will stop some people but not most of them.
So we just established that DRM does not work, right? It inconveniences only the “honest” people because the “dishonest” people rip the content out of its DRM-cell anyways (That’s why even people who buy a game use NoCD Cracks and other piracy-related technologies: They make using the product easier!). Now comes the problem: What we want as only privacy is just another layer of DRM, just that this time we are the guys asking for it.
Of course there always is the way of the luddite: We call all this fancy internet stuff crap and do not use it, we don’t publish our data here, we do not post our pictures, we just stay out of it. The problem is: When it comes to personal data you are not the only one that can enter it. If I put up a photo of me and a few friends on the internet and put a text with each person’s name next to it, all those people now have a part of “their” private data public (Remark: I don’t believe that you can own data, not even personal data). So keeping private data private means not just making sure that you are not leaking it, but also making sure nobody else leaks it. What happens if your bank has a data leak and your whole account data is online? There nothing you could have done, it’s not your fault but your data is public. And the net does not forget. The bits will have been copied and you will never get them back. All you can do is try staying ahead in the race and switch banks to get a new “private” account. Until that bank has a leak.
But most of us are no luddites: We enjoy putting stuff online. When me and Annette moved I took some pictures of our new house so I could send the link around to family and friends who don’t live in Oldenburg, I wanted to share something with others and the internet (and it’s great ability to copy bits!) made that easy for me. Now let’s make an experiment based on this.
People talking about “data ownership” would say that we need technology where we can say: “Only these 6 people can view these pictures.” This way we could use the internet to share data but keep privacy intact. Cool. So how do I make sure that one of those people does not save the image and uploads it on Facebook saying “Look what house my friend tante got!”? Do we really want to pretend that in this case where we want DRM for ourselves it would work?
“Privacy” as a concept has the same issues that “property” as a concept has when being transferred from the real into the online world: Property does not work because you can make indistinguishable copies without cost so the idea of scarcity that property is based on fails. Privacy is an idea based on control and especially on the internet where everything is virtual and easy to copy control is impossible.
Back in the days you had a photograph and would show it only to people you wanna show it to. I they tried making a photo of your photo you would see that and could intervene. A JPEG does not give you that control, if somebody except you has seen it you can assume the data to have leaked (at least you cannot guarantee that it didn’t if you didn’t turn the virtual data into a physical thing by forcing people to copy to your place and having them look at it on your screen).
DRM does not work. It does not work to make copying video games impossible, it does not work to keep movies from being copied online and it also does not work to keep your data private.
