Head Of Computer Security Firm Says Anonymity Is The Enemy Of Privacy

Say That Again

from the you-lost-me dept

We’ve seen it argued that privacy is a bad thing. People like former DHS official Stewart Baker have argued that the privacy-protecting efforts of civil liberties activists are the reason we’re forced to be fondled and de-shod at TSA checkpoints. Not only that, he’s tried to blame the 9/11 attacks on “rise of civil libertarianism.” Unbelievably, we’ve also had a politician recently claim that your privacy isn’t violated if you don’t notice the violation.

We’ve also seen attacks on anonymity by (anonymous) police officers and a whole slew of pundits and politicians who believe the only thing online anonymity does is provide a shield for trolls, bullies and pirates to hide behind. Efforts have been made to outlaw online anonymity, but fortunately, very few laws have been passed.

Now, try wrapping your mind around this argument being made by Art Coviello, executive chairman of RSA Security and the head of EMC’s security division. According to him, anonymity and privacy are at odds with each other.

A dogmatic allegiance to anonymity is threatening privacy, according to Art Coviello, executive chairman of RSA.

Coviello cast anonymity as the “enemy of privacy” because it gives “free reign to our networks to adversaries” with “no risk of discovery or prosecution.”

On one hand, anonymity is slowing down the pursuit of online criminals. On the other hand, companies are increasingly wary of subjecting their employees to intrusive security software.

Customers are caught in a Catch-22. They’re afraid to deploy technology for fear of violating workers’ privacy” even though security intelligence tools are ultimately the best way to protect personal information, Coviello argued.

How Coviello arrives at the conclusion that anonymity is damaging privacy isn’t exactly clear. It may be the enemy to security (or at least, unhelpful to retributive actions), but the online anonymity shielding crooks doesn’t threaten users’ privacy, at least not directly. Indirectly it could, but it wouldn’t be anonymity’s “fault.” If Coviello wants attackers to be stripped of anonymity, there’s little doubt he’d like to see clients’ employees stripped of their privacy. Both would make his companies’ jobs easier. Attackers would be easily identified and clients would received (arguably) better protection (thanks to more, non-anonymized data gathering). Win-win for security. Not so much for those who cherish privacy and anonymity.

This isn’t exactly new ground for Coviello. He did some complaining about privacy at last year’s RSA conference as well.

RSA executive chairman Art Coviello has criticised privacy advocates for basing their arguments on “dangerous reasoning”, comments that have already earned him a tongue lashing from Big Brother Watch and the Open Rights Group.

Coviello, whilst noting the need for privacy, lambasted privacy groups’ “knee jerk” reactions to public and private sector attempts to improve people’s security, pointing to the “insanity” of the situation, in a keynote to open the RSA 2012 conference in London this morning.

In Coviello’s view, privacy advocates are over-reacting to measures designed to protect online identities, preferring to live in a world of danger: “Because privacy advocates don’t realise that safeguards can be implemented, they think we must expect reasonable danger to protect our freedoms,” Coviello said.

“But this is based on dangerous reasoning, a knee jerk reaction, without understanding the severity and scope of the problem.

“Where is it written that cyber criminals can steal our identities but any industry action to protect us invites cries of Big Brother.”

Not for nothing has someone noted that RSA is only a letter away from the United States’ most notorious intelligence agency.

Coviello’s arguments here aren’t that much different than the government’s opinions on the “liberty vs. security” balance. And like other defenders of intrusive programs, Coviello refers to the statements of critics as an “over-reaction.” But is it? He bristles at being compared to Big Brother but his thought processes roughly align with the government’s foremost proponents of intrusive programs. According to both, people just don’t understand how bad things actually are, and in our unenlightened state, we’re making the wrong choice between security and liberty.

Additionally, the “knee jerk reaction” he sees in privacy activists is, in reality, no different than the knee jerk reactions he fails to see in security and intelligence entities. While privacy activists are focused on retaining what’s remaining and make small pushes for more, security/intelligence agencies leverage every tragedy or attack to expand their scope and dial back privacy protections.

But where his argument against privacy (and anonymity) ultimately falls apart is in his belief that collecting and storing large amounts of private data is the best solution for all involved.

To “suggest the only way to protect against cyber crime is to sacrifice privacy and civil liberties is absurd,” Nick Pickles, director of privacy campaign group Big Brother Watch, told TechWeekEurope. “It is a simple fact that if data has not been collected, it cannot be stolen, lost or misused. The best safeguard for consumers and businesses is for data not to be collected unless it is absolutely essential, and then deleted as soon as it is no longer required.”

As for his complaints about anonymity? It’s pretty much all or nothing. You can’t whip up statutes and laws that allow anonymity and their privacy protections unless you’re a criminal. Either you take the good with the bad or you eliminate it for everybody. No one’s going to agree with that last one, so security groups and companies will just have to deal with the fact that their adversaries will be cloaking their identities. Cops may wish robbers wouldn’t wear masks when committing crime, but that’s the way it goes. You can’t ban the sale of masks simply because someone holds up a bank wearing one.

I’m sure he understands this, but he’s in a field where security is valued over privacy. But that’s the expected mindset for someone is his position. The problem is that those with his mindset expect others to come to the same conclusion — and when they don’t, they’re portrayed as part of the problem.

To be fair, Coviello at least had this to say about the jargon being deployed by government security officials and advisors.

“I absolutely hate the term ‘Cyber Pearl Harbor’,” he said. “I just think it’s a poor metaphor to describe the state we are really in. What do I do differently once I’ve heard it? And I’ve been hearing it for 10 years now. To trigger a physically destructive event solely from the internet might not be impossible, but it is still, as of today, highly unlikely.”

Coviello may not like this particular FUD, but claiming anonymity and privacy are standing in the way of security isn’t that far removed from the panicky assertions of the “cyber Pearl Harbor” types.

Filed Under: anonymity, art coviello, privacy, security
Companies: emc, rsa