On internet privacy, be very afraid

Gazette: Should they be stopped?
Schneier: That’s a philosophical question. Personally, I think that in many cases the answer is yes. It’s a question of how much manipulation we allow in our society. Right now, the answer is basically anything goes. It wasn’t always this way. In the 1970s, Congress passed a law to make a particular form of subliminal advertising illegal because it was believed to be morally wrong. That advertising technique is child’s play compared to the kind of personalized manipulation that companies do today. The legal question is whether this kind of cyber-manipulation is an unfair and deceptive business practice, and, if so, can the Federal Trade Commission step in and prohibit a lot of these practices.

Gazette: Why doesn’t the commission do that? Why is this intrusion happening, and nobody does anything about it?
Schneier: We’re living in a world of low government effectiveness, and there the prevailing neo-liberal idea is that companies should be free to do what they want. Our system is optimized for companies that do everything that is legal to maximize profits, with little nod to morality. Shoshana Zuboff, professor at the Harvard Business School, invented the term “surveillance capitalism” to describe what’s happening. It’s very profitable, and it feeds off the natural property of computers to produce data about what they are doing. For example, cellphones need to know where everyone is so they can deliver phone calls. As a result, they are ubiquitous surveillance devices beyond the wildest dreams of Cold War East Germany.

Gazette: But Google and Facebook face more restrictions in Europe than in the United States. Why is that?
Schneier: Europe has more stringent privacy regulations than the United States. In general, Americans tend to mistrust government and trust corporations. Europeans tend to trust government and mistrust corporations. The result is that there are more controls over government surveillance in the U.S. than in Europe. On the other hand, Europe constrains its corporations to a much greater degree than the U.S. does. U.S. law has a hands-off way of treating internet companies. Computerized systems, for example, are exempt from many normal product-liability laws. This was originally done out of the fear of stifling innovation.

Gazette: It seems that U.S. customers are resigned to the idea of giving up their privacy in exchange for using Google and Facebook for free. What’s your view on this?
Schneier: The survey data is mixed. Consumers are concerned about their privacy and don’t like companies knowing their intimate secrets. But they feel powerless and are often resigned to the privacy invasions because they don’t have any real choice. People need to own credit cards, carry cellphones, and have email addresses and social media accounts. That’s what it takes to be a fully functioning human being in the early 21st century. This is why we need the government to step in.

Gazette: You’re one of the most well-known cybersecurity experts in the world. What do you do to protect your privacy online?
Schneier: I don’t have any secret techniques. I do the same things everyone else does, and I make the same tradeoffs that everybody else does. I bank online. I shop online. I carry a cellphone, and it’s always turned on. I use credit cards and have airline frequent flier accounts. Perhaps the weirdest thing about my internet behavior is that I’m not on any social media platforms. That might make me a freak, but honestly it’s good for my productivity. In general, security experts aren’t paranoid; we just have a better understanding of the trade-offs we’re doing. Like everybody else, we regularly give up privacy for convenience. We just do it knowingly and consciously.

Gazette: What else do you do to protect your privacy online? Do you use encryption for your email?
Schneier: I have come to the conclusion that email is fundamentally insecurable. If I want to have a secure online conversation, I use an encrypted chat application like Signal. By and large, email security is out of our control. For example, I don’t use Gmail because I don’t want Google having all my email. But last time I checked, Google has half of my email because you all use Gmail.

Gazette: What does Google know about you?
Schneier: Google’s not saying because they know it would freak people out. But think about it, Google knows quite a lot about all of us. No one ever lies to a search engine. I used to say that Google knows more about me than my wife does, but that doesn’t go far enough. Google knows me even better, because Google has perfect memory in a way that people don’t.

Gazette: Is Google the “Big Brother?”
Schneier: “Big Brother” in the Orwellian sense meant big government. That’s not Google, and that’s not even the NSA. What we have is many “Little Brothers”: Google, Facebook, Verizon, etc. They have enormous amounts of data on everybody, and they want to monetize it. They don’t want to respect your privacy.

Gazette: In your book “Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World,” you recommend a few strategies for people to protect their privacy online. Which one is the most effective?
Schneier: Unfortunately, we live in a world where most of our data is out of our control. It’s in the cloud, stored by companies that may not have our best interests at heart. So, while there are technical strategies people can employ to protect their privacy, they’re mostly around the edges. The best recommendation I have for people is to get involved in the political process. The best thing we can do as consumers and citizens is to make this a political issue. Force our legislators to change the rules.

Opting out doesn’t work. It’s nonsense to tell people not to carry a credit card or not to have an email address. And “buyer beware” is putting too much onus on the individual. People don’t test their food for pathogens or their airlines for safety. The government does it. But the government has failed in protecting consumers from internet companies and social media giants. But this will come around. The only effective way to control big corporations is through big government. My hope is that technologists also get involved in the political process — in government, in think-tanks, universities, and so on. That’s where the real change will happen. I tend to be short-term pessimistic and long-term optimistic. I don’t think this will do society in. This is not the first time we’ve seen technological changes that threaten to undermine society, and it won’t be the last.

This interview is published courtesy of the Harvard Gazette, Harvard University’s official newspaper.