Privacy and Personal Information in a Rapidly Changing World of Learning

SpacesPrivacy today? Not! Who, what, when, where

and why? / H. Morrow Long

2

What Privacy Isn’t

1. Security. We can have security with out Privacy (but it is hard to have the reverse).

2. Secrecy. Keeping secrets (e.g. trade secrets) is different from Privacy.

3. Regainable. Once lost it cannot be found.4. Permanent. It is often ephemeral.5. Absolute. Privacy fluctuates and varies.

(Credit 1-3 : Bob Blakley's presentation from Digital ID World 2006)

3

Who has Privacy? Does anyone care?

• “You have zero privacy anyway, get over it.” – Scott McNealy, 1999

http://www.wired.com/politics/law/news/1999/01/17538

4

Who has Privacy?

• Wikipedia has an 1840 word privacy policy (http://en.wikipedia.org/wiki/Wikipedia:Privacy_policy)

• Google has a 1940 word privacy policy:(http://www.google.com/privacypolicy.html)and a simplified 652 word ‘Highlights’ web page on their Privacy policy (http://www.google.com/privacy.html)

5

Who has Privacy? Personal Information Privacy is changing

• Today information is aggregated by a number of credit bureaus and enterprises.

• Organizations are losing personal info at an increasing rate.

• Legislation and Regulation are moving in: GLBA, SOX, HIPAA, FCRA, CA SB 1386.

• Search engines make it trivial to find public information (& satellite maps) on anyone.

6

Who has Privacy?

• Most online learning spaces have both public areas ( blogs, vblogs, wikis and/or discussion boards ) and private areas (assignment submission & feedback, grades, correspondence / journal notes with intructor,

7

What is Privacy? Who cares?

• Different generations appear to have different ideas and concerns (or lack thereof) regarding privacy.

• Older adults (senior citizens) can be very wary of the Internet and web-based technology

• Many younger adults and teens appear to be unconcerned about privacy -- posting embarassing pictures and details on the web.

8

What is Privacy? Who cares? Strangers invade my space unbeckoned

QuickTime™ and aTIFF (LZW) decompressorare needed to see this picture.

QuickTime™ and aTIFF (LZW) decompressorare needed to see this picture.

9

What is Privacy? Who cares? People post embarassing photos of themselves.

10

What is Privacy? Who cares? People post embarassing photos of themselves.

11

Who doesn’t have “Privacy” -- both and on-campus and online students these days...

• On-campus students are logged swiping into buildings/gates, video recorded as they move about campus and entered into audit trails as they login and read e-mail.

• Online students give away the times they start their assignments late, the amount of time they spend on assignments, and their classroom participation can be quantified!

12

Data Breaches Chronology - Privacy Rights Web Site

http://www.privacyrights.org/ar/ChronDataBreaches.htm

13

Data Breaches in Higher Ed

Higher Ed institutions may be represented in data breaches disproportionately as they are :

• More open and provide Internet access to their campus networks (and thereforeto many of their information systems).

• Much more likely to disclose breaches and report them to the public even when not required to do so.

14

Data Breaches in Higher Ed - Ohio Univ.Ohio University I:

On Friday, April 21, the FBI advised the Technology Transfer Department at Ohio University's Innovation Center that a server containing office files had been compromised. Data on the server included e-mails, patent and intellectual property files, and 35 Social Security numbers associated with parking passes.

Ohio University II: 300,000 alums and friends. 137,000 have their SSNs exposed. Exposure was under way for over a year before detection.

Ohio University III:Names, birth dates, Social Security numbers and medical information for 60,000 people were accessed in records at the school's Hudson Health Center, …

15

Security Breach Report for 2007-02-12Johns Hopkins University loses Employee And Patient

InfoJohns Hopkins University revealed that personal information on about 135,000 employees and patients has gone missing. The information on the university payroll tapes included Social Security numbers and, in some cases, bank account information for present employees.

East Carolina University Posts Personal Info on WebsiteRU security breach info linked to child health care

Radford University is sending notification letters to parents encouraging them to place fraud alerts on their children’s credit reports. A virus was found …

16

UCLA BreachDecember 12, 2006 - UCLA announced that a “computer hacker” illegally accessed a UCLA database and UCLA began notifying approximately 800,000 people whose names and certain personal information were in the database.

Source: www.identitytheft.ucla.edu

17

UCLA Breach

This database contained certain personal information, including Social Security numbers, dates of birth and home addresses, regarding current and some former UCLA students, faculty and staff, some student applicants and some parents of students or applicants who had applied for financial aid.

18

UCLA Breach

SSN #s for 28,600 people in the database were illegally retrieved.

UCLA began notifying them on Jan. 10, 2007. Those affected were:

• 18,500 UCLA student financial aid applicants from 2002 through 2006.

• 10,100 former employees who separated from UCLA, the University of California Office of the President and UC Merced between 1995 and 2003

19

What is Privacy? Who cares?

“If you tell your secrets to the wind, you should not blame the wind for telling them to the trees” Kalil Gibran.

• Many will give up their privacy for a free gift, a job, other incentives, or to socialize (MySpace).

• Some believe that privacy and security are in conflict and are exclusive believing therefore we should give up privacy for security - Post 9/11 Bush administration eavesdropping, etc.

20

When is Privacy a concern? Mid-age bulge: mid-age learners prefer online courses.

QuickTime™ and aTIFF (Uncompressed) decompressor

are needed to see this picture.

(Credit: Eduventures 2005)

21

Where is Privacy? A safe space, closed place?

I’m “shadowing” a class via Blackboard -- when students in the class found out they had a lot of questions for me -- mostly WRT privacy and, explicitly -- what I could see.– They saw the name of the professor and knew

the other students in the class. But they were taken aback somewhat when they found out that I was able to read their discussion posts and blogs. I could not read their private notes.

22

How is Privacy taken away? When others threaten the right to be left alone.

• Two women at the Yale Law School were harassed on website “AutoAdmit”. They both felt threatened and that their law firm employment prospects were hurt.

• A new female professor at Yale had a bogus FaceBook account created in her name and filled with nasty jokes. She only found about it months later. Many other similar cases involving websites….

23

How is Privacy taken away? When others threaten the right to be left alone.

• Many Wikis started out allowing anonymous posting. Abuse and spam have caused most to require registration and some to publically log IP addresses.

• Wikipedia uses a modified model - allow anonymous entries/contributions/edits with the IP # logged publically or authenticated login providing greater privileges.

24

How is Privacy taken away? When others threaten the right to be left alone. ID Theft.

• One student created a URL using a website which created an animation using the other student’s name.

• J. vs. J. - one student’s mail bombing campaign against another’s identity in an escalating war.

• Prof. Q. - sophisticated impersonation attack (and smear campaign) in Internet mailing lists and e-mail to University colleagues and officials.

25

Harassment Example:

Hello Julie and Bill,

I can't believe you two are talking again and even have the nerve tosee one another. What Julie you haven't informed Bill that he is boring &that is why you did not pursue him like Steve? Or is he that pathetic &

youThat desparate? By the way Bill nice pic on your lab website, ever heardof the Atkins diet? Probably both of you don't even realize who I am

sinceyou are both so self absorbed. Have a nice life.=======================================================

=

26

     In the end Einstein is right... I was recently watching a program over the mind boggling ideas and beautiful minds of imaginations that were expressing their ghastly views of the way the UNIVERSE works... Almost as if they thought for even a moment(does not really exist) they thought that with squiggly lines they were answering the mysteries of God with their god like intellects... What prompted me to write this evening, I don't usually write anything except for brief reminders on scrap paper, but I had to comment when they said that "It is dangerous to mix the ideas of physics with philosophy"... Physics came from philosophy, everything came from philosophy. To go no further with this foolish babel, I would like to give a few of my own theories or "Dangerous Philosophy"... Pure Matter - Matter without the presence of energy.Pure Energy - Energy without the presence of matter.Pure Matter = Pure GravityPure Gravity = Pure EnergyThus:Pure Matter = Pure EnergyThey are EqualThere you have it, your mysterious "Black Hole"... Simple in all its philosophical beauty...Man has or never will see Pure Matter or Pure Energy, the destruction of the atom does not release Pure Energy, only a little energy. As we all know, if you get too close to a black hole, "Pure Matter" you will disappear... Or should I say, the matter and energy that make you up as they are working together in harmony, not by chance, will be turned into two separate things... Pure Energy and Pure Matter... This goes on and on until there is only one "Black Hole" or should I say Pure Matter and of course Pure Energy and when the entire universe is in two perfectly equal parts (PE and PM) they will once again unite to do it all over again. Wow how fun and simple it all really is...Please feel free to write me back and express your thoughts on my theories.Sincerely,Jake Rachal Pure MatterPure EnergyPure GravityPure Density PS.  There are no worm holes, and parallel universes... These fictional dreams are only people bored and small minds reaching for divinity, that they will never reach... Not because it can not be imagined but because it is not possible to understand something that if it understood, the balance of all would be thrown off by the fact that those particles of understanding the secrets would destroy physical reality.... Give up the childish fantasies that you have toiled so long for... Simplicity IS the answer.Besides, I thought that every physisist is at the point where all they need is a new theory?  HERE IT IS.

27

Oh my gosh, I can't believe it is really you.The good thing is that now I know where you are but you have no idea who I am!!!

Anyhow, just want to say hi, and I am really glad that you have such an excellent achievement! A DIRECTOR!!!! Way to go, girl.

All right. time for me to hiberate again. Talk to you 10 years from now.I miss you.

28

I SAW YOU AT THE NEW HAVEN TRAIN STATION THE OTHER DAY. WHERE WERE YOU GOING, BOSTON OR NEW YORK? IVE GOT MY EYE ON YOU, BUT ONLY ONE- AS THEOTHER DOSENT WORK.

29

When evaluating privacy safeguards in systems and setting privacy policies -- should we take a risk management approach?

• Use risk models to look at the risks to privacy in databases? In online learning environments? In blogs, discussion boards, assigment submission, grades, online tests, portfolios, etc?

30

People are often wildly bad at evaluating the risks in every day life.

"More people are killed every year by pigs than by sharks, which shows you how good we are at evaluating risk.” -- Security guru Bruce Schneier

31

Questions?