Week 12 Takeaways

 Week 12 focused on the three levels of internet protection:

Strong Protection

1. Password hygiene

2. Best practices for Authentication (2FA, Better Security Questions, etc.)

3. Self censorship and restraint

4. Be careful with use of social media

Stronger Protection

1. Keep all data encrypted

2. Use VPNs and virus protection

3. Wipe hard drives when done

4. Protect your communications 

5. Use Temp emails

Strongest

1. Cover cameras

2. The rest is so crazy, if you really cared you’d probably know all of them by now anyway

Quesiton of the Week No. 12

 Do you agree with the following statement? “Privacy as we know it is essentially dead and we must learn to live in a totally transparent world where every aspect of our lives, except for our unexpressed thoughts, are an open book.”

Transparency vs Privacy in the US

The Current State of Transparency vs Privacy in the US

Most Americans* are concerned about their personal privacy and believe that it has worsened over the past five years (Pew Research). And this concern is understandable. Today, people are more interconnected than ever to potential privacy risks, ranging from their smartphone to their smart thermostat (New York Times). For instance, in January (2023), T-Mobile announced a data breach of 37 million active users (National Cyber Security Alliance).  Unfortunately, massive data breaches like T-Mobile is fairly common, giving Americans good reason to be wary of privacy related issues.

At the same time, Americans are more likely to lean towards data collection in specific cases of national security (Pew Research).

Pew Research

In this case, Americans justify a reduced sense of privacy and greater transparency for physical and national security. This suggests that Americans view individual privacy rights as important until a significant threat exists. 

However, when we shift away from privacy and transparency of the individual, towards government privacy and transparency, we witness a distinct tension. I think the tension exists between transparency and privacy because it is reflective of the tension between individual rights and government involvement. This has been a historic issue since the draft of America's first laws emerged. How much should a government intervene with individuals due to a matter of security, administration and overall societal benefit? Governments have legitimate concerns to maintain some level of intrusiveness over their constituents. Further, governments have legitimate reasons to keep documents, plans, etc. private from the public. 

But many argue that a well run democracy is one that is transparent (White House, Former President Obama). So, how do we reconcile both government concern with transparency vs privacy and individual rights for privacy?

The prompt has asked me to predict our world in 20 years in terms of privacy and transparency. At best, I think I can predict future issues and some preventive measures which I've laid out below:

Issue 1: The Intersection Between Privacy and Civil Rights

Privacy and Civil Rights is a concern globally but has significant cases in the US. In the 1950s and 1960s, the federal government surveilled Black Americans who fought against structural racism (Lai & Tanner, 2022). The US government used the FBI's counterintelligence program to target Dr. Martin Luther King, Jr. and members of the Black Panther Party (Lai & Tanner, 2022).

Current day issues include access to abortion and reproductive healthcare. Samantha Lai and Brooke Tanner, researchers at Brookings found that "judges have based past convictions of abortion seekers on evidence collected from people’s location data, text messages, and online activity" (Lai & Tanner, 2022). In 2017, a Mississippi woman's online search for abortion drugs were submitted and used as evidence in a trial on the death of her fetus (Washington Post, 2022). Other current day civil rights issues include the LGBTQ+ community, activists, and policing. 

Issue 2: The Global Conundrum: Balancing State Responsibility and Human Rights  

Most states (talking about countries now, not US states) are members of the United Nations. Implied in their signature, and hopeful ratification of treaties (makes treaties legally binding), is a commitment to transparency. An essential component of UN member states is transparency. It's part of the UN's good governance policy (OHCHR). Without it, policing and reports are limited. However, states obviously have an obligation to their constituents and may have legitimate reasons for tighter privacy. In the future, I see more ethical and legal situations regarding privacy and transparency on the global stage (Draper, 2012). 

Issue 3: In an Age of Technology: Genetic Transparency and Privacy

With the exponential rise of genetic technology, the medical and legal community are quickly having to adapt and form privacy and transparency measures (Dreyer, 2016). The GENA (Genetic Information Nondiscrimination Act, 2008) was the first significant US measure to address genetic related privacy concerns. But the field of genomics and genetic research has taken off so fast and been applied so liberally to all fields, privacy and ethical issues are becoming a major concern (Tyranny of the Gene, James Tabery). Using genetic testing for embryos to identify the most "viable" (likeliness for disease and more often Polygenic Risk Scores which are probabilistic) has become a hot topic for ethics and privacy. Lastly, there's ideas in the academic field for genetic testing to assign "pathways" for school children (Shero, 2021). ie. A child shows a "genetic propensity" for math and is placed in Honors Math. 

Preventive Measures

• Robust Data Collection and Sharing Rights
• Currently in the US privacy and data collection rights are fragmented across states. Having federal laws would ease operational concerns for companies and, if well drafted, protect consumers.
• Opt-in Consent
• The UK GDPR requires positive opt-in consent for all organizations (Information Commissioner's Office). The US could adopt a similar policy.
• Non-discrimination Act
• A company should not discriminate against a user exercising their privacy rights. For instance, a company can't block information from a user that exercises their privacy rights. 

Obviously it's difficult to predict the future but I don't think (and truly hope) that personal privacy will be a thing of the past. More likely, there will be pulls on the metaphorical balance of transparency vs privacy. Some policies and social movements will lead towards more privacy and vice versa. Overall, I doubt neither transparency nor privacy rights will disappear. 

I'd love to hear what you all think. In 20 years, what will the world look like in terms of privacy and transparency? Will personal privacy become obsolete in the face of advancing technology?

*(not sure how diverse or representative the study sample was)

Week 11 Takeaways

 Weekly Takeaways - (Sorry these are late, I completely spaced on it with closing weekend of my show, hopefully these are helpful!)

• The Surface Web -  all of the links that are easily accessible via search engines; it’s all the information you can search

• The Deep Web - more private links that are not super accessible via search engines; you have to go through other means to get it; password protected sites are all “deep web” (i.e Netflix, Bank Account, Email, Corporate/Government Documents, Educational Sites, etc)

• The Dark Web - Encrypted, underground, secret information that’s a part of the deep web; you have to really be looking for it in order to find it; TOR search engine developed by government to allow for anonymous searches that can be used to reach it; there are illegal activities that happen on here, but some of it is harmless

• Virtual Currencies are becoming more and more popular are a form of payment; started more as a mean to pay for illegal activity online but now can be used for other payments such as rent; you need higher security if you use it because there are many risks involved in the use of them such as price fluctuations, losing the private key or password, cyber risks, and insolvency of the exchange

Question of the Week No. 11

 Should accessing and using the Dark Web be criminalized?

Psudo-anonymity, Bitcoin, and regulation

What's a cryptocurrency anyway?

Cryptocurrency is a categorical term referencing online currency that utilized blockchain technology. In short, a blockchain is a type of database which is distributed and stored across the internet, such that anyone with an internet connection can both see and submit changes to the database. However, this does not mean that the changes are automatically accepted by the blockchain when they are submitted. Instead the chain "verifies" the change, utilizing algebraic cryptography. Once a change has been verified, it is encrypted and amended to the end of the chain. 

But how are changes or transactions actually verified? This is where the first major split in how cryptocurrency works occurs. Private blockchains rely on a trusted corporation, not necessarily a business but rather a group of individuals, to be the arbitrators of transactions. Public blockchains instead rely one of two systems, proof of work, and proof of stake. Bitcoin operates under proof of work, every time a transaction is submitted work must be done to verify the transaction in the form of a cryptographic question. The first wallet that solves the question is rewarded with some amount of tokens, and the transaction is verified. Proof of work is incredibly harmful to the environment, as the system is designed to waste electricity and degrade components to ensure that the cryptography is secure. Proof of stake seeks to answer this concern by instead asking inverters in the coin to deposit their coins into a shared pool in exchange for a chance to earn tokens as a reward. The more coins and the longer they are stored in the shared pool yield greater chances at being chosen to validate a transaction and receive tokens.

Now that our transaction is verified, the wallet addresses of the sender and recipient added to the end of the ledger of transactions, and crypto-graphically secured using the public key so that it can never be altered. This is what gives crypto its transparency, each transaction can be seen by anyone at any time. You don't need to hold any coins to see these transactions either, as long as you are familiar with the code (or utilizing a tool that someone else made) you can see them for yourself. However, only the wallet addresses are visible, meaning that if someone does not have their name attached to the wallet address the trail ends there, giving us anonymity.

Why regulate crypto?

 So now that we know how crypto works, why does it matter if it is decentralized or pseudo-anonymous? In short, the nature of crypto makes its economic landscape rife with crime and scams. These are not limited to bad actors either, major exchanges and "legitimate" investors have been charged with fraud, from exchanges misleading customers, to money laundering busts, if there is one thing crypto has show itself to be useful for its the facilitation of financial crime. The anonymity of crypto means that once the money is gone, it is almost impossible to track down, often sent from wallet to wallet until the degrees of separation between the victim and the perpetrators are insurmountable. Due to the fact that all transactions are final, once you get your mark you don't need to worry about a card charge-back, that money is staying in your wallet until you decide to do something with it. Phishing is also incredibly common with crypto, if you get access to a simple phrase of 13 randomly generated words you can access someones wallet and do what you wish with their currency. When purchasing something online with crypto, you are at the mercy of the vendor when it comes to refunds or warranties. If you send them money and do not receive the services promised there is nothing that the government or your bank can do for you. 

Crypto is also often the currency of choice for hackers and other dark web actors. A transaction through a bank is harder to get access to, after all those are often not public, however, every bank account is under someones name, and even through the use of pseudonyms it is very difficult to fully cover your tracks and ensure that any online transactions do not come back to you. With crypto, your wallet is not attached to your real life person in any way, meaning that when the F.B.I. comes knocking all they have is a user 's wallet number, and unless they somehow access your wallet the user's personal computer and verify that the number they have and the one stored on your computer match, there is effectively no way to trace the user of the wallet.

However, there is a way to link a user to a wallet, and most U.S. exchanges require you to link your real name and social security number to your wallet in order to comply with U.S. regulatory policy. This means that anyone attempting to use crypto as a legitimate investment or currency in the U.S., or with businesses who operate in the US, your purchase history is almost entirely transparent. Anyone could see any transactions I make using my wallet, and because the exchanges have to remain transparent about who they do business with, my name is also linked to this wallet.

How can you regulate crypto?

The fact that all of these checks occur online and are done using public computers, the blockchain is considered decentralized, meaning that no individual could make a change unless they purchased over half the coins. This fact also makes regulation of who can send and receive bitcoin almost impossible, you cannot block a transaction, and you cannot reverse a transaction. However, at the end of the day a bitcoin is only a piece of code that says you owe one bitcoin. To utilize it in the real world you either need to find a vendor that accepts bitcoin, or it needs to be exchanged for fiat (state backed) currency, both of which can be regulated. 

Due to the fact that it is impossible to stop a bitcoin from being sent, the bulk of the regulation efforts coming out of the United States lie with intermediaries. By punishing real corporations and exchanges that are known to associate with and facilitate criminals the number of avenues to offload ill-gotten crypto into fiat shrink, and it offloads the responsibility of verification to the exchanges. This strategy has proven to be more effective than trying to regulate the crypto itself, as exchanges can only stay in business as long as they continue to de-anonymize their users enough to verify that their crypto was acquired through legitimate means. 

This means that those who use crypto for illicit purposes, whether that be scams, drug trafficking, or money laundering have a hard time finding anyone willing to turn their currency into any form of fiat, and in turn increase the costs of doing business. Keeping up with the rapidly growing list of wallets connected with illiterate activities, and the list of exchanges found to be associated with them has been difficult, but effective in stemming the the number of fiscal crimes facilitated by crypto.

 But what do I think?

Most of this post has been spent on explaining the specifics of crypto and its regulation. I think the current strategy of letting exchanges regulate themselves under threat of being cut off has been effective, not only has the cumulative revenue from scams been reduced dramatically, but the number of deposits made have similarly dropped. 

On individual privacy, crypto almost seems to be the worst of both worlds. Users who have nothing to hide have the least privacy, while those who seek to act maliciously are able to easily conceal their identity and dealings. While the lack of privacy for those who are following the law could in part be attributed to the regulatory efforts of the U.S. government, many exchanges who do no business in the United States also require you to submit personal information to use them. The fact of the matter is that most finical institutions want to know who they are doing business with, and so the privacy aspect of crypto is moot for most users. 

While I certainly could set up a private wallet, somehow obtain crypto without the use of my credit card (which, of course, has my name on it), and then find an online storefront that will accept the crypto without a name, and get the good delivered to me without using my address. After all this, I still need to trust that this store will not simply take my money and run, because if they do there is nothing I can do about it. For the average user this process is so cumbersome (I have to make another account for each step, remember my wallet, double and triple check that the address I've typed in is the correct one, offer blood sacrifice, wait for the full moon, find 3 gold coins, etc.) and the number of things I could actually buy without giving any personal information are so small that realistically there's no way to use bitcoin in your day to day life while remaining truly anonymous. 

If I use my credit card to buy crypto, it is no longer anonymous. If I have something sent to my house it is no longer anonymous. Even digital goods will not remain anonymous if they are sent to my personal email, as whoever I buy from still knows that the wallet address 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa belongs to Jake Larsen because Jake's email address received the game key that the address paid for.

Unless of course, I scammed 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa and had them pay for my new game.

 

References used

 

Wolff, Josephine. “The Competing Priorities Facing U.S. Crypto Regulations .” Brookings, Brookings, 13 Jan. 2023, https://www.brookings.edu/techstream/the-competing-priorities-facing-u-s-crypto-regulations-bitcoin-ethereum/.

“What Is Blockchain?” McKinsey & Company, 5 Dec. 2022, https://www.mckinsey.com/featured-insights/mckinsey-explainers/what-is-blockchain.

Major, Jordan. “Cryptocurrency Scam Revenue Falls 65% in a Year, New Data Shows.” Finbold, 16 Aug. 2022, https://finbold.com/cryptocurrency-scam-revenue-falls-65-in-a-year-new-data-shows/.

Week Ten Takeaways

National DNA Registry

• DNA samples vs. DNA profiles: profile is only for identification (string of twenty-six numbers in a specific order) whereas samples (blood, spit, hair, etc...) are biological pieces that can degrade over time and reveal more information
• Collection of a DNA sample NOT a violation of the Fourth Amendment if taken after commitment of a serious crime
• Maryland vs. King: home invasion rape case where semen left at scene was entered in database in 2003, King arrested in 2009 on different assault charges which matched the DNA 
• Taking of a DNA sample deemed equivalent of taking a fingerprint
• DNA sample is a search, but not an unreasonable one
• Public safety outweighs privacy
• Utah's legislation: collection of a DNA sample mandatory for all persons arrested for a felony

Affirmative Blog Post

1. National DNA database would help be beneficial to law enforcement and help fight crime
2. Reduce racial discrimination in DNA database 
1. Law enforcement database currently overwhelming people of color
3. Assist genetic research

Negative Blog Post

1. National DNA registry would be too privacy invasive
1. Violation of the Fourth Amendment
2. Danger of unauthorized access to the database 
3. Too high a risk of errors and misuse/discrimination

Question of the Week

• Majority of class against healthcare providers being able to share patient with other healthcare providers without patient consent 
• Important questions to be addressed for this issue: 
• Definition of healthcare providers: doctors, nurses, specialists, physical therapists, insurance employees
• Type of consent used: express vs implied, informed or not, consent for each specific individual receiving information or for groups
• Purpose of the sharing: research, billing, care of patient
• HIPAA generally prohibits the sharing of personal health information without consent of the patient 

Utah's Genetic Information Privacy Act

• Protects genetic information of Utah residents collected genetic testing companies, such 23andMe
• Companies cannot give consumer genetic information to insurance companies or potential employers
• Requires consumer's express, informed consent for collection and disclosure of their genetic data 
• Consumers have right to request company deletes their genetic data
• No private right of action: attorney general has right to enforce act but not consumer 
• $2500 fine for each violation 

Question of the Week No. 10

 Healthcare providers are moving to a system of electronic health records where an individual’s entire medical history, diagnoses, treatments, medications and other health information are maintained in a digital form. 

In order to provide better and more timely health care to individuals, should physicians and other healthcare providers be able to freely access and share this information with each other without a patient’s consent?