Words Matter: Privacy, Security, and Related Terms

1
Words MatterPrivacy, Security, and Related Terms

• Jim Horning
• Chief Scientist
• Information Systems Security Operation
• SPARTA, Inc.
• ISIPS, May 12, 2008

2
The Genesis of This Talk

• From Horning, Jim
• Sent Thursday, February 28, 2008 647 PM
• To Paul Kantor
• one thing bothers me It seems to me that you
  have conflated some concepts that it is helpful
  to keep distinct
• In particular, free speech and privacy are
  not equivalent
• Security is a much broader concept than
  intelligence collection and processing
• From Paul Kantor
• Sent Friday, February 29, 2008 808 AM
• To Horning, Jim
• Would you be willing to give a talk on the
  importance and difficulty of making these
  distinctions, at the Conference?

3
Privacy and Free Speechare Not Equivalent

• Free speech is primarily concerned with public
  behavior, privacy, with information about
  non-public behavior.
• The right of free speech was explicitly
  recognized in the Constitution. A constitutional
  right to privacy is only implicit, and was not
  made explicit by the courts until the 20th
  Century.
• One could imagine complete freedom of speech even
  in David Brin's privacy-free transparent
  society (http//www.davidbrin.com/transparent.htm
  l).
• One could also imagine a society with very strong
  privacy protection and no freedom of speech
  whatsoever.
• Libel is one of the areas in which these two
  ideals tend to come into rather direct conflict.
• There is also a question about the right to
  anonymous communication, which some feel is
  inherent in the right of free speech, but many do
  not.

4
Security is Broader ThanIntelligence
Collection and Analysis

• Even within national/homeland security,
  intelligence is only one of a wide range of
  activities supporting security.
• There is also proactive/defensive side to
  national/homeland security, that we probably
  wont be saying much about here.
• Even within intelligence, there is recognition
  that collection and analysis are part of a larger
  cycle that includes direction, interpretation,
  dissemination, andultimatelyreaction.

5
A Verbal Paradox

• Difficult trade-offs must be made
  betweenprivacy and security.
• Governments have cited compelling national
  security needs for seeking to violate
  privacy. 2005 Hard Problems List
• vs.
• Security is necessary for privacy, and vice
  versa.
• Private credentials are essential for
  authentication at a distance.
• Information stored in insecure systems is
  inherently non-private.
• Both true, but in different contexts and with
  somewhat different meanings of privacy and
  security.

6
Privacy and Security

• Both words have a variety of meanings.
• Often, computer security means something like
• Reasonable assurance that the complete
  systemwill function (only) as required and
  intended.
• Often, privacy means something like
• The system does not release personal
  informationto unauthorized entities.
• But not always. Different assumed meaningscan
  interfere with communication andlead to
  unfruitful arguments and invalid conclusions.

7
Definitions Security and Privacy

• security noun. LME.
• ORIGIN Old French Modern French sécurité or
  Latin securitas, formed as secure adjective see
  -ity.
• ? I 1 The condition of being protected from or
  not exposed to danger safety spec. the
  condition of being protected from espionage,
  attack, or theft. Also, the condition of being
  kept in safe custody. LME. ? b The provision or
  exercise of measures to ensure such safety. Also
  (S-), a government department or other
  organization responsible for ensuring security.
  M20.
• 2 Freedom from care, anxiety, or apprehension a
  feeling of safety or freedom from danger.
  Formerly also, overconfidence, carelessness. LME.
• 3 Freedom from doubt confidence, assurance. Now
  chiefly spec., well-founded confidence,
  certainty. L16.
• 4 The quality of being securely fixed or
  attached, stability. rare. M19.
• ? II 5 Property etc. deposited or pledged by or
  on behalf of a person as a guarantee of the
  fulfilment of an obligation (as an appearance in
  court or the payment of a debt) and liable to
  forfeit in the event of default. Freq. in enter
  security, enter into security, give security,
  give in security. Cf. surety noun 1. LME.
• 6 A thing which protects or makes safe a thing or
  person a protection, a guard, a defence. Freq.
  foll. by against, from. L16.
• 7 A person who stands surety for another. L16.
• 8 Grounds for regarding something as secure,
  safe, or certain an assurance, a guarantee. E17.
• 9 A document held by a creditor as guarantee of
  his or her right to payment a certificate
  attesting ownership of stock, shares, etc. the
  financial asset represented by such a document.
  Also (US), such a document issued to investors to
  finance a business venture. Usu. in pl. L17.
• 10 A means of securing or fixing something in
  position. L18M19.

• privacy noun. LME.
• ORIGIN from private adjective -cy.
• 1 The state or condition of being withdrawn from
  the society of others or from public attention
  freedom from disturbance or intrusion seclusion.
  LME. ? b In pl. Private or retired places places
  of retreat. Now rare. L17.
• 2 Absence or avoidance of publicity or display
  secrecy. L16.
• 3 A private or personal matter a secret. Now
  rare. L16.
• 4 The state of being privy to something, privity.
  rare. E18.
• Shorter Oxford English Dictionary

8
Constellations of Concepts

• Security1 computer security, network security,
  information security, security classifications,
  communication security, operational security,
  physical security
• Security2 national security, homeland security,
  intelligence collection, intelligence analysis,
  intelligence dissemination, publication,
  surveillance, interception of communications,
  datamining,
• Security3-n job security, Social Security,
  financial security (retirement), financial
  securities (Wall Street),
• Privacy, secret communication, anonymity, trade
  secrets, witness protection,
• Civil liberties freedom of speech, freedom of
  association, freedom from arbitrary search,
  protection from self-incrimination, protection of
  sources,

9
Constellations of Concepts

• Security1 computer security, network security,
  information security, security classifications,
  communication security, operational security,
  physical security
• Security2 national security, homeland security,
  intelligence collection, intelligence analysis,
  intelligence dissemination, publication,
  surveillance, interception of communications,
  datamining,
• Security3-n job security, Social Security,
  financial security (retirement), financial
  securities (Wall Street),
• Privacy, secret communication, anonymity, trade
  secrets, witness protection,
• Civil liberties freedom of speech, freedom of
  association, freedom from arbitrary search,
  protection from self-incrimination, protection of
  sources,

10
Interdisciplinary Studiesin Information Privacy
and Security

• Multiple disciplines.
• Each with specialized concepts and vocabularies.
• Multiple meanings of privacy.
• Defaults change depending on discipline and
  context.
• Multiple meanings of security.
• Defaults change depending on discipline and
  context.
• What kind of privacy are you relating to what
  kind of security using the perspectives of what
  disciplines?

11
Questions Characterizing Security1

• What accesses/actions are being restricted?
• To what resources/information?
• Who1 is being restricted?
• For what reason?
• Who is enforcing the restriction?
• By what means?
• For whose benefit?
• On what authority?
• 1 I use the generic who to refer to
  organizations as well as people.

12
Questions Characterizing Security2

• What accesses/actions are being sought?
• To what resources/information?
• By whom?
• By what means?
• For what reason?
• At whose direction?
• With what authority?

13
Questions Characterizing Privacy1 Protection

• What information flow is being blocked?
• About whom?
• From whom?
• By whom?
• By what means?
• For what reason?
• With what authority?
• 1 I use the generic privacy to include
  organizational intellectual property.

14
Some Interactions

• Security1 is fundamental to enforcing Privacy.
• Security2 is potentially invasive of Privacy.
• Privacy of certain information is necessary for
  Security1.
• E.g., Protection of authenticating information.
• Privacy of certain information is necessary for
  Security2.
• E.g., Protection of the identities of
  informants.
• Protection of detailed intelligence
  results.

15

• Theres glory for you!
• I dont know what you mean by glory,
  Alice said.
• Humpty Dumpty smiled contemptuously.
• Of course you donttill I tell you. I meant
• theres a nice knock-down argument for you!
• But glory doesnt mean a nice knock-down
  argument,
• Alice objected.
• When I use a word, Humpty Dumpty said in a
  rather
• scornful tone, it means just what I choose it to
  mean
• neither more nor less.
• The question is, said Alice, whether you
  can
• make words mean so many different things.
• The question is, said Humpty Dumpty,
• which is to be masterthats all.
• Lewis Carroll, Through the Looking Glass

16

• Theres ANK-DA for Alice (AL)!
• What Humpty Dumpty (HD) means by ANK-DA,
• is not known by AL, AL said.
• HD smiled contemptuously. Of course the
  meaning isnt
• known by ALtill AL is told by HD. HD meant
  theres a nice
• knock-down argument for AL!
• But ANK-DA doesnt mean a nice
  knock-down
• argument, AL objected.
• When a word (W) is used by HD, HD said in
  a rather
• scornful tone, what is meant by W is just what
  HD has chosen
• W to meanneither more nor less.
• Whether Ws can be made to mean so many
  different things
• by HD is the question, said AL.
• Which of HD or W is to be master is the
  questionthats
• all, said HD.
• Sonnets from the Pentagonese

17
To Dig Deeper

• Engaging Privacy and Information Technology in a
  Digital Age,James Waldo, Herbert S. Lin, and
  Lynette I. Millett, eds.,National Academies
  Press, 2007.
• Toward a Safer and More Secure Cyberspace,Seymour
  E. Goodman and Herbert S. Lin, eds.,National
  Academies Press, 2007.
• IDs Not That Easy Questions About Nationwide
  Identity Systems,Stephen T. Kent and Lynette I.
  Millett, eds.,National Academies Press, 2002.
• Trust in Cyberspace,Fred B. Schneider,
  ed.,National Academies Press, 1999.
• Nothing is as simple as we hope it will be,
  (blog) Security. http//horning.blogspot.com/se
  arch/label/Security
• Nothing is as simple as we hope it will be,
  (blog) Privacy. http//horning.blogspot.com/sea
  rch/label/Privacy