Featured Story

In this week’s feature, I’d like to discuss privacy today, and where it should go in the future.

In the 1970’s when computer networks were in their infancy, they were built across existing telephone networks. Telephones and computers at the time were similar. The phone sitting in your home didn’t do any of the routing when you dialed a phone number; this was handled by the telephone company’s switching equipment. Similarly, the computer terminal you sat in front of was used to access and manipulate mainframe computers; not do any of the processing on its own hardware. Errata Security

To further complicate things, there was no standard for communications between different types of computers. IBM systems couldn’t talk with DEC computers, and neither of those could communicate with Xerox systems. Fixing the problem wasn’t as simple as designing a new widget that made them all communicate. Architects of the early internet devised a 7-layer system known as the Open Systems Interconnect, or OSI, model. Wikipedia

At the bottom of OSI is layer 1, the physical layer. Layer 1 is the hardware; your cable modem, Wi-Fi router, network cards, and other physical equipment. Layer 2 is the data link layer, which takes the data from the network and breaks it up into smaller segments called frames for transmission. Layer 3 is the network layer, it moves the frames and keeps the different parts of data together. Layer 3 identifies that you requested a specific website and gets it to the computer you requested it on. Layer 4 is the transport layer, which keeps the data intact, checking for errors and congestion along the way, and resending when necessary. This layer is what tells Netflix that your network is slow and causes buffering. Layer 5 is the session layer which controls access and authentication. Layer 6 is the presentation layer which converts the data on your screen into the data that’s actually transmitted through the network; that picture of your cat becomes ones and zeroes here. Finally, layer 7 is the application layer, or what you work with on your screen; your email apps, web browsers, and chat apps.

The original network gurus, Bob Kahn, Vint Cerf, and others looked, discussed, and debated many different networking models before they laid out the foundations of this global network we use every day.

Just as the internet has continued to evolve and improve over the decades since its creation, so have web browsers. Tim Berners-Lee programmed the original web browser and in the mid-1990’s when the world wide web first became available commercially, browsers formatted text like a Microsoft word document. Now, web browsers can do things that were almost unthinkable 20 years ago. Each web page you load contains what’s called header information. These headers tell your browser what type of document you’re loading, give hints about the types of information contained inside, how it should be formatted, and defines how you interact with computers and people across the globe.

I know I said this would be about privacy, we’re getting there.

The current system for transmitting data was built at a time when computer networks were designed to transmit research articles. Only futurists dreamed of the ability to check whether I locked my front door in Orlando from the comfort of my Tokyo hotel room. But now nearly everyone on the planet is connected and soon, it would seem, everything will also be connected. Using a model that treats pictures of my breakfast the same as my social security number is silly.

Much like computer networks before the development of OSI, our current system for protecting personal information is broken. Our health data, passwords, email addresses, and social security numbers are still being treated like traffic on a network, rather than unique pieces of information that need securing.

Facebook’s much maligned Mark Zuckerberg announced that he would be pivoting Facebook to be more privacy oriented. But his concept relies on using the existing tools of the broken system that’s already in place. Wired

What we need is a ground up rebuild of the way data is handled so it can be properly classified, transmitted, stored, secured, and wiped. For lack of a better term, an open data interconnect model would need to be built with cooperation from governments, software companies, and hardware manufacturers. Using the header information model from web browsers would allow data to be classified, indicate use, how long it should be stored and by whom, and the source of the data without having to reveal the data within to malicious parties. Building this model on a multilayer system would help to ensure its integrity without locking data to a specific corporate or government standard.

In the ideal scenario, an open source standards body of government and non-government organizations would be convened to define this new data model to protect privacy and ensure standards are met and followed in all sectors.

Hardware manufacturers must close holes that allow attackers to access information stored in memory after applications are closed. If you’ll recall, I mentioned a vulnerability in password managers that allows passwords to be read from memory even after they’re closed. This simply shouldn’t happen, and is another artefact left from when computers were meant solely for large organizations and research institutions.

Software designers should be given a firm standard to be held to, not to make things more complicated, but to give them clear guidelines for how to build secure, functional applications that don’t result in weekly reports of data leaks and breaches.

Governments need to have tools to identify what data should be secured and how to enforce standards violations.

By identifying and classifying the various types of data and defining how, where, when, and for how long they’re transmitted, stored, and used we can work towards remediating the problem of data privacy that has crept up over the last decade.

Let’s move on to the Good News.