![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
A dissenting view on data security
Jan. 28th, 2008 01:41 pmLooking at the last year's flaps over data leaks, and the building of ever-larger databases, and the latest round of guidance and action here at work, it's clear to see that the IT consensus is that data is precious and must be secured. Cory "Zeppelin Blogger" Doctorow even compared data leaks to nuclear waste leaks in a piece he wrote for the Guardian.
I'm not so sure.
Data tends to leak. That's just an observation of its behaviour. IT is all about copying and transforming data, and very little about securing or deleting it: you have to make an effort to do those. So I think that securing data is a fool's errand. I don't think it's possible to reliably, securely tie down all the copies of data unless there are exceptional circumstances (such as you creating it on a tinfoil-hat OS and carrying the storage media physically with you and being able to fight off goons).
This observation is no more fatalistic than observing that the tides always come in is fatalistic. The current frenzied attempts to secure stuff (we're ordering a pile of fingerprint-locked USB sticks, for example) are a predictable response but, like banning shampoo on airlines, a flawed one. The avalanche has started: it's too late for the pebbles to vote.
So the next wave of killer security isn't going to be biometric scans of your perineal wrinkles stored on an orbital server. That's just another database in another location: No, the next big thing is going to be systems where it simply doesn't matter what gets out. I'm not sure what they will actually be, but that's the shape they will take.
And the cultural response will be significant too. With all sorts of your leaky information out there, everyone will be able to pick up on everyone else's foibles. Already we're seeing nonsense where students are being sent down for being boozehounds. That breaks when the person doing the sending-down is also exposed. There will be predictable horror at this panopticon of pecadilloes, and some people will retreat into caves - almost literally: doing cash-in-hand work to buy stuff at farmers' markets and avoiding the blanket CCTV coverage. But the mainstream will (with a few shocks and judders) move into a post-anonymity age.
Damn, I sound like a prophet of the Singularity.
I'm not so sure.
Data tends to leak. That's just an observation of its behaviour. IT is all about copying and transforming data, and very little about securing or deleting it: you have to make an effort to do those. So I think that securing data is a fool's errand. I don't think it's possible to reliably, securely tie down all the copies of data unless there are exceptional circumstances (such as you creating it on a tinfoil-hat OS and carrying the storage media physically with you and being able to fight off goons).
This observation is no more fatalistic than observing that the tides always come in is fatalistic. The current frenzied attempts to secure stuff (we're ordering a pile of fingerprint-locked USB sticks, for example) are a predictable response but, like banning shampoo on airlines, a flawed one. The avalanche has started: it's too late for the pebbles to vote.
So the next wave of killer security isn't going to be biometric scans of your perineal wrinkles stored on an orbital server. That's just another database in another location: No, the next big thing is going to be systems where it simply doesn't matter what gets out. I'm not sure what they will actually be, but that's the shape they will take.
And the cultural response will be significant too. With all sorts of your leaky information out there, everyone will be able to pick up on everyone else's foibles. Already we're seeing nonsense where students are being sent down for being boozehounds. That breaks when the person doing the sending-down is also exposed. There will be predictable horror at this panopticon of pecadilloes, and some people will retreat into caves - almost literally: doing cash-in-hand work to buy stuff at farmers' markets and avoiding the blanket CCTV coverage. But the mainstream will (with a few shocks and judders) move into a post-anonymity age.
Damn, I sound like a prophet of the Singularity.
