Head Of Computer Security Firm Says Anonymity Is The Enemy Of Privacy

from the you-lost-me dept

We’ve seen it argued that privacy is a bad thing. People like former DHS official Stewart Baker have argued that the privacy-protecting efforts of civil liberties activists are the reason we’re forced to be fondled and de-shod at TSA checkpoints. Not only that, he’s tried to blame the 9/11 attacks on “rise of civil libertarianism.” Unbelievably, we’ve also had a politician recently claim that your privacy isn’t violated if you don’t notice the violation.

We’ve also seen attacks on anonymity by (anonymous) police officers and a whole slew of pundits and politicians who believe the only thing online anonymity does is provide a shield for trolls, bullies and pirates to hide behind. Efforts have been made to outlaw online anonymity, but fortunately, very few laws have been passed.

Now, try wrapping your mind around this argument being made by Art Coviello, executive chairman of RSA Security and the head of EMC’s security division. According to him, anonymity and privacy are at odds with each other.

A dogmatic allegiance to anonymity is threatening privacy, according to Art Coviello, executive chairman of RSA.

Coviello cast anonymity as the “enemy of privacy” because it gives “free reign to our networks to adversaries” with “no risk of discovery or prosecution.”

On one hand, anonymity is slowing down the pursuit of online criminals. On the other hand, companies are increasingly wary of subjecting their employees to intrusive security software.

Customers are caught in a Catch-22. They’re afraid to deploy technology for fear of violating workers’ privacy” even though security intelligence tools are ultimately the best way to protect personal information, Coviello argued.

How Coviello arrives at the conclusion that anonymity is damaging privacy isn’t exactly clear. It may be the enemy to security (or at least, unhelpful to retributive actions), but the online anonymity shielding crooks doesn’t threaten users’ privacy, at least not directly. Indirectly it could, but it wouldn’t be anonymity’s “fault.” If Coviello wants attackers to be stripped of anonymity, there’s little doubt he’d like to see clients’ employees stripped of their privacy. Both would make his companies’ jobs easier. Attackers would be easily identified and clients would received (arguably) better protection (thanks to more, non-anonymized data gathering). Win-win for security. Not so much for those who cherish privacy and anonymity.

This isn’t exactly new ground for Coviello. He did some complaining about privacy at last year’s RSA conference as well.

RSA executive chairman Art Coviello has criticised privacy advocates for basing their arguments on “dangerous reasoning”, comments that have already earned him a tongue lashing from Big Brother Watch and the Open Rights Group.

Coviello, whilst noting the need for privacy, lambasted privacy groups’ “knee jerk” reactions to public and private sector attempts to improve people’s security, pointing to the “insanity” of the situation, in a keynote to open the RSA 2012 conference in London this morning.

In Coviello’s view, privacy advocates are over-reacting to measures designed to protect online identities, preferring to live in a world of danger: “Because privacy advocates don’t realise that safeguards can be implemented, they think we must expect reasonable danger to protect our freedoms,” Coviello said.

“But this is based on dangerous reasoning, a knee jerk reaction, without understanding the severity and scope of the problem.

“Where is it written that cyber criminals can steal our identities but any industry action to protect us invites cries of Big Brother.”

Not for nothing has someone noted that RSA is only a letter away from the United States’ most notorious intelligence agency.

Coviello’s arguments here aren’t that much different than the government’s opinions on the “liberty vs. security” balance. And like other defenders of intrusive programs, Coviello refers to the statements of critics as an “over-reaction.” But is it? He bristles at being compared to Big Brother but his thought processes roughly align with the government’s foremost proponents of intrusive programs. According to both, people just don’t understand how bad things actually are, and in our unenlightened state, we’re making the wrong choice between security and liberty.

Additionally, the “knee jerk reaction” he sees in privacy activists is, in reality, no different than the knee jerk reactions he fails to see in security and intelligence entities. While privacy activists are focused on retaining what’s remaining and make small pushes for more, security/intelligence agencies leverage every tragedy or attack to expand their scope and dial back privacy protections.

But where his argument against privacy (and anonymity) ultimately falls apart is in his belief that collecting and storing large amounts of private data is the best solution for all involved.

To “suggest the only way to protect against cyber crime is to sacrifice privacy and civil liberties is absurd,” Nick Pickles, director of privacy campaign group Big Brother Watch, told TechWeekEurope. “It is a simple fact that if data has not been collected, it cannot be stolen, lost or misused. The best safeguard for consumers and businesses is for data not to be collected unless it is absolutely essential, and then deleted as soon as it is no longer required.”

As for his complaints about anonymity? It’s pretty much all or nothing. You can’t whip up statutes and laws that allow anonymity and their privacy protections unless you’re a criminal. Either you take the good with the bad or you eliminate it for everybody. No one’s going to agree with that last one, so security groups and companies will just have to deal with the fact that their adversaries will be cloaking their identities. Cops may wish robbers wouldn’t wear masks when committing crime, but that’s the way it goes. You can’t ban the sale of masks simply because someone holds up a bank wearing one.

I’m sure he understands this, but he’s in a field where security is valued over privacy. But that’s the expected mindset for someone is his position. The problem is that those with his mindset expect others to come to the same conclusion — and when they don’t, they’re portrayed as part of the problem.

To be fair, Coviello at least had this to say about the jargon being deployed by government security officials and advisors.

“I absolutely hate the term ‘Cyber Pearl Harbor’,” he said. “I just think it’s a poor metaphor to describe the state we are really in. What do I do differently once I’ve heard it? And I’ve been hearing it for 10 years now. To trigger a physically destructive event solely from the internet might not be impossible, but it is still, as of today, highly unlikely.”

Coviello may not like this particular FUD, but claiming anonymity and privacy are standing in the way of security isn’t that far removed from the panicky assertions of the “cyber Pearl Harbor” types.

Filed Under: , , ,
Companies: emc, rsa

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Head Of Computer Security Firm Says Anonymity Is The Enemy Of Privacy”

Subscribe: RSS Leave a comment
pegr (profile) says:

Of course!

Of course he says things like this. His biggest customer is Uncle Sam, in spite of RSA FAILING at basic OPSEC by losing root key material for the MOST WIDELY USED two-factor authentication system in the world!

They should be tarred and feathered for their arrogant disregard for the security of their CUSTOMERS! I wouldn’t believe a word he said for the rest of his life.


out_of_the_blue says:

So? The new Google privacy policy is: You have no privacy."

Google CEO Schmidt Predicts End of Online Anonymity

“According to Schmidt, true transparency and anonymity on the Internet will become a thing of the past because of the need to combat criminal and ‘anti-social’ behavior.”


Excerpt from Schmidt’s book: ?Within search results, information tied to verified online profiles will be ranked higher than content without such verification, which will result in most users naturally clicking on the top (verified) results. The true cost of remaining anonymous, then, might be irrelevance.?

“But Schmidt doesn’t stop there. He essentially predicts that privacy will cease to exist online. Governments, he says, will find it “too risky” to have thousands of citizens “anonymous, untraceable and unverified” online, suggesting they will want to require verification of all online accounts at some level of government.”


Similar abound. So why don’t you EVER mention creepy Schmidt’s comments on same subject? When Schmidt is in position to make his predictions true?

Google defenders are much like NSA defenders: basically blind to privacy, just insist over objections to being spied on: “we’re only helping and you should be grateful!”.


out_of_the_blue says:

Here's a relevant item just popped up, though a bit "partisan" slant:

“The NSA affair has definitely spurred new thinking, but more needs to be done. Conservatives must begin to scrutinize the nexus between tech companies, such as Google, and the federal government. There is no longer a wall between the private sector and government surveillance.”


Seems to me like everyone but Techdirt worries about The Google…

Rikuo (profile) says:

Re: Here's a relevant item just popped up, though a bit "partisan" slant:

How many times do we have to say here: WE ARE NOT WORRIED ABOUT GOOGLE. If (and more than likely when, you’ll notice I’m not really disagreeing with you that the G is heading in that direction) they try and remove anonymity from their services, the vast majority of people will simply move to a different service. I’m already using DuckDuckGo for example.

No matter how much information Google has on you, they can’t do anything worse with it than sell ads. It’s government agencies, the men with guns, handcuffs, drones and jails, that we here on Techdirt and elsewhere are worried about.

John Fenderson (profile) says:

Re: Re: Here's a relevant item just popped up, though a bit "partisan" slant:

Well, I do “worry” about Google spying. But where I differ from Blue is that I think that governmental surveillance is a far larger and actually dangerous threat, and my reaction to my “worry” is not to just shake my fist and scream at everyone around me, but to actually avoid and block Google’s intrusiveness.

That, in my mind, is the huge difference: I can do something to stop Google from spying on me, so i don’t get enraged about it. I can’t do anything about the government spying, so it pisses me off.

Andrew F (profile) says:

How Coviello arrives at the conclusion that anonymity is damaging privacy isn’t exactly clear. It may be the enemy to security (or at least, unhelpful to retributive actions), but the online anonymity shielding crooks doesn’t threaten users’ privacy, at least not directly.

I don’t entirely agree with him, but the point he’s trying to make is pretty straight-forward actually: Anonymity decreases security. Without security, criminals (or the NSA) can break in and access your private information. That’s bad for privacy.


Re: A total fantasy.

Lack of anonymity doesn’t protect my private data. All this does is prevents me from shielding myself and my identity. The problem of protecting my privacy is much easier if I am not forceed to constantly leave breadcrumbs lying around.

No. Anonymity protects my privacy.

The problem with Coviello’s line of thinking is that he thinks all “real names” are actually valid. There’s really no reason to believe that. It’s pure fantasy.

If I say that I am Frank Abagnale, you have no reason to trust that any more than a pseudonym I’ve used for 20 years.

Andrew F (profile) says:

Re: Re: A total fantasy.

Again, I don’t entirely agree with his line of thinking, but it’s not about “real names”. Suppose, as a matter of network security, you were analyzing packets entering or leaving your network and comparing them against historical records of network data. This would enable you to detect security anomalies but also raises privacy concerns.

By way of analogy, it’s sort of like saying, “I want to be able to access my grandma’s e-mail to make sure she didn’t reply to some identity theft scam.” The goal isn’t to find real names, but to detect unusual behavior. Creepy and paternalistic? Yes. But not about real names per se.

Andrew F (profile) says:

Re: Re: Re:4 A total fantasy.

Yes, but it only needs to go one-way for the argument to work. If you want to maintain anonymity, you cannot adopt certain security measures like analyzing each packet going in and out of your network. Without adopting those measures, you may be at greater risk of having private information accessed by third parties. That’s the point being made by Art Coviello. If the right to anonymity trumps security, then other private information is at risk. Security analysis may be questionable, but the logical chain is fine.

Anonymous Coward says:

Re: Re: A total fantasy.

Well. The breadcrumbs will define your person more specifically than if people knew your name, address a.o. However, as long as none of the pi data are too obvious the commercial networks who use these informations probably won’t bother squeezing their data for it!

Protecting pi online is extremely hard already if the people researching you are thorough enough. Chaining of online aliases and pi is making Facebook/Google+ into an identity theft scam today.

That problem would get infinitely worse if anonymity was removed from the rest of the internet! Also protection of whistleblowers/other blackballable persons would be near impossible, keeping trade secrets off scrupulous traders before the stock market is informed would be much harder (Making illegal spying on people from large companies infinitely easier online and giving a massively profitable advantage for stock-traders using it!) and it might either keep many people from regularly using sites like this if they are in any way part of the art industries, government or their companies have ties with those or make them massively more popular as a counter-reaction to removing anonymity!

No, anonymity is a second layer of protection of privacy. Removing it would only make new vectors of attack on privacy, that much easier to pursue. The tradeoff is not worthwhile for many people.

Andrew F (profile) says:

Re: Re:

To act as devil’s advocate (or advocate) to the point made in my own post, the concern would be that excessive security measures ultimately decrease security (and privacy). If we’re using backdoors or analysis of centralized repositories of user data to detect attacks, not only are we hurting anonymity but we’re making our network less secure (and private) as well.

Anonymous Coward says:

Re: Re:

Security is not related to anonymity, but is related to the quality of software and how systems are set up. Lack of online anonymity increases the damage done by a security breach as people can be identified. Anti-social and trollish behaviour on-line is a different matter, and can ignore. Also unless government get involved, there is no way of ensuring that correct identities are used online, and government are already too dammed intrusive.

Wolfy says:

When I read ANY gov’t. officials’ take on the NSA, I feel like I’ve woken up in a world where “new-think” and “new-speak” has run rampant. Black is the new white, up is really down, and the bad guys are really the good guys.

My solution is to semantically invert the statements of the NSA supporters and I figure I ought to be close to being correct.

Anonymous Coward says:

Tell the people drafting these “free trade” agreements, to be less secretive.

Stop allowing corporations to hide behind “shell companies”.

Stop allowing corporations and individuals who donate to political races, to be anonymous.

After all the above issues are corrected, then we’ll start talking about deanonymizing average citizens.

ipgrunt (profile) says:

Coviello’s statements reek of law enforcement thinking, a mentality that believes freedom is a choice one makes to obey the law. People who think as he does put security cameras everywhere to catch anyone not conforming to society.

This is Big Brother thinking, and it is reinforced by this fallacy — why would you care when someone is monitoring your behavior if you aren’t doing anything wrong?

The old saw about preventing 9/11 — I write this all the time — Richard Clarke had the data on the terrorists in July of 2001, but couldn’t get an appointment with Condoleeza and W to report the info. 9/11 happened because the people in charge weren’t paying attention.

Of course Art believes anonymity to be an inconvenience to his job. He wants your name and your number in his log file. Whether or not he uses it, it is a comfort knowing it is there.

Call him a security worker, gatekeeper, or high-tech guard; he’s simply a regulator and not a “privacy consumer” (yes, I hate it too.) Privacy slows his process and makes things harder for him. He wants it easy. I can agree with him on one thing — I don’t like the phrase Cyber Pearl Harbor, either.

We may always need cops, but we should never let them make the laws.

jay says:

James Madison said ?If men were angels, no government would be necessary. If angels were to govern men, neither external nor internal controls on government’

Privacy is like this too. If we could fully trust businesses, government and others, perhaps we would not need anonymity that much. But we can’t, hence anonymity provides the ONLY tool to provide some degree of privacy without having to depend on others.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...