The Privacy Devil and the Art of Misdirection

Ian Reid
7 min readAug 25, 2015

People often ask me why I don’t use Facebook or other Social Media. Hell, my kids ask me why I don’t use Facebook, or Twitter, or Instagram, or whatever. At this point I don’t know if my extended family even knows if I’m alive anymore.

“He’s not on Facebook? Did he die?”
“Hey guys! Over here, I live across the road!”
“Yeah, I think he died. Let’s check Facebook for an Obit…”

This seems doubly ironic to them as I am a software engineer by trade, spend a lot of my time talking about social media, and often regale them with stories of yore, when the Internet was young, and how I participated in, and ran fledgling online communities before they were even really a ‘thing’.

And if you want to get really nerdy, I was an old school hand, participating in the early excitement of young virtual worlds such as early MUDs, Ultima Online (remember when British got ganked? Hilarious!), Everquest…

I believe a solid argument can be made, that these fledgling, often awkward communities lay what would be the foundation for our social media juggernauts ten years later (which in turn can be linked further back to BBS/AOL/CompuServe/etc).

So what happened? Where did my online social experience, and the mass-market social experience diverge?

The truth is, I was a fairly early Facebook user. I perused MySpace. I had an early LinkedIn account (reluctantly still do for professional reasons). I tried these out, in contrast to the IRC channels, and the phpBB forums I had already established relationships in.

My first experience with Facebook was an odd one: “AYE CAPTAIN THERE BE REAL PEOPLE HERE”.

It was clear Facebook was going to be massive. It elegantly bridged the gap between the abstract nature of the internet (everybody starts anonymous), to the far more tangible space of how humans perceive relationships (hi Dad!).

Yet, at the same time, it really unsettled me. If you asked me at the time, I wouldn’t have been able to precisely pinpoint what I didn’t like.

But my social media life was short lived.

I would sign up for a new social service, participate half heartedly, and then remove myself entirely from its presence as best as I possibly could within three to six months.

So what was it?

Over time, as I became a more knowledgeable software engineer, and increased the number of social relationships around me (wife/kids/etc) it became clear to me.

At a fundamental level I was deeply concerned with the ownership model of these social networks. Early social networks were excited simply to create relationships between individuals. They placed no construct on the nature of those relationships, or how individuals chose to express themselves.

While they were owned, and not private (nothing in databases were really protected, as private forums and private messages were stored in plaintext), they were also decentralized by nature, and administrators had not really grasped the financial opportunity present in profiling/selling their users.

By the nature of spreading the data around, in disconnected spaces, capacity for profiling and surveillance was inherently limited.

Modern Social Networks replaced this wholesale through the convenience of being able to make “real world” connections very easily. Obviously this was a huge benefit in regards to snowballing the network to global success, but it also presented some insidious downsides.

These downsides are often wrapped up under a singular banner: privacy.

This makes a lot of sense, as privacy by definition represents the capacity to be free from observation.

What has happened though has been interesting. While the conversation around privacy has increased, it has also been subject to a massive amount of misdirection, which has resulted in an incredibly misunderstood topic for the common user.

Misdirection 1: Private from Other Users

Privacy has stopped relating to the capacity to be free from observation, and has been maneuvered towards whether or not companies who collect your personal data, are using it appropriately. This includes whether they are sharing it with other members of the service, or whether they are selling you wholesale to the highest bidder.

This is a stroke of genius for large “Freemium” style firms that rely on data mining, data collection, and personal information for their value, as it encourages users to feel safe as long as they “aren’t evil”.

Where we used to have a word that described our capacity to walk around our house with no pants on without being spied on (privacy!), it now refers to our capacity to walk around our house with no pants on while being fully observed, analyzed, tracked, and dissected, as long as we trust you to not show pictures of us to anybody we don’t like (privacy?).

And we can see just how aggressive this has become with recent technology such as the Samsung Smart TVs, or the new Spotify changes, where the technology we have purchased and paid for is being leveraged against our wishes (or against most individuals limited understanding).

But hey, as long as you don’t show my neighbours what I look like with no pants on, no harm, no foul, right?

Misdirection 2: For Our Benefit

Which leads us to the next major misdirection, the fallacy that this is for our benefit.

Most of the language expressing these violations of our privacy is laid out in the privacy policy itself. These violations are expressed in the place that was originally intended to describe how we were protected. Instead now, they detail exactly how they will monitor and observe us (for our own benefit of course).

If we look up privacy policy on Wikipedia it states the following:

“It fulfills a legal requirement to protect a customer or client’s privacy.”

Now let’s summarize Spotify’s updated privacy policy (taken from their policy):

We may collect information stored on your mobile device, such as contacts, photos, or media files

We may also collect information about your location

We may also collect sensor data (e.g., data about the speed of your movements, such as whether you are running, walking, or in transit)

How exactly does this protect a customer, or client’s privacy?

The sad part is, it doesn’t matter. It’s a losing discussion because we lost the discussion when large organizations redefined what privacy actually means.

In doing so, they have managed to convince users that privacy still exists, as long as it is for our benefit (from Spotify):

We may use the information we collect, including your personal information, to: (i) provide, personalise, and improve your experience with the Service and products and services made available through the Service

If it is for our benefit, it must infer that the services couldn’t exist, provide the features, or be effective in the same manner without profiling us.

Does this make any sense?

Misdirection 3: Personal Data is all that Matters

Which leads us to the greatest misdirection of all. Privacy policies, and privacy statements from companies nearly all focus on the context of individual data and information.

Pretty much, that as long as they anonymize the data, and pool it into larger data sets, it’s not a problem. We shouldn’t worry. They can do as they please (after all they own it, in exchange for allowing us to use their service).

This is what actually scares me.

Kieran Healy (Associate Professor of Sociology at Duke University) posted a fairly technical blog post in 2013, showing how the tiniest bit of anonymized metadata could be used to profile an individual (in the example presented, Paul Revere).

At the end of it, in character, he leaves with a chilling warning:

“But I say again, if a mere scribe such as I — one who knows nearly nothing — can use the very simplest of these methods to pick the name of a traitor like Paul Revere from those of two hundred and fifty four other men, using nothing but a list of memberships and a portable calculating engine, then just think what weapons we might wield in the defense of liberty one or two centuries from now.”

The reality is this; with the amount of data collected by major social networks, the capacity for profiling, not just members, but non members as well (think of anybody you have ever mentioned, or anybody you have ever tagged in a photo, or any comment that has referenced you or your family) to be wielded at the discretion of the data owner (Facebook, Twitter, Spotify, etc), on behalf of whoever they see fit (Government, Individual Interest, Personal Beliefs) provides a power of the magnitude as of yet unseen by any single organization in history.When people ask me why I don’t use Social Networks in their current form I respond with a question: “why would anybody in their right mind use them?”

To paraphrase Charles Baudelaire (or Keyser Soze):

“The greatest trick the devil ever pulled was convincing the world he did not exist”

While we are all arguing about whether or not companies are showing our data to people we don’t like, or selling our data to advertisers, or using it to give us better widgets, we have conveniently forgotten to realize that we’ve created one of the largest, most powerful social weapons in history, and we happily handed it over to handful of completely self-motivated companies.

But hey, as long as nobody pulls the trigger, no harm no foul right?

--

--