Slashdot Log In
Privacy Policies Only as Good as the People Enforcing Them
Posted by
ScuttleMonkey
on Wed Jul 02, 2008 12:02 PM
from the fear-the-market-droids dept.
from the fear-the-market-droids dept.
Techdirt is reporting that while we all know privacy policies may not matter much in the grand scheme of things, a recent study shows that it may be even worse than originally surmised. It seems that the real issue is with who has access to personal data and what they are able to do with it. "of course, it's not just the people reading the policies that don't seem to understand them -- it's those in charge of living up to and enforcing the policies. A new study surveyed a bunch of executives, including both marketing execs and those in charge of enforcing the privacy policy, and quickly discovered that marketers have a very different concept of 'privacy' than privacy officers. Not surprisingly, they don't see anything wrong with sharing all sorts of data that seems to horrify privacy officers."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
s/News/Not News/ (Score:5, Informative)
What Privacy Policy? [forbes.com]
Survey statistics from the real article:
Those numbers just back up what we all believed anyway, right? I mean, is this really news? Or just news with different numbers?
Re:s/News/Not News/ (Score:5, Funny)
Parent
Re:s/News/Not News/ (Score:4, Insightful)
It's in the nature of what they do. They trade in the awareness and perceptions of other people. A marketer that wanted to preserve consumers privacy and individual choice would be like a surgeon that was afraid of blood and was squeamish about cutting into somebody. A marketers job is to tell you how to think, what to want, and what ideals to have. They respect you like a puppeteer respects a puppet.
I've always found the marketer/news media duality more entertaining than the marketer/privacy policy duality. Journalists will swear that they aren't trying to influence people. They are just reporting the facts. But the ad sales departments sell commercial slots for those same programs with the pitch about how many millions of viewers can be influenced.
Parent
Re: (Score:3, Interesting)
A marketers job is to tell you how to think, what to want, and what ideals to have. They respect you like a puppeteer respects a puppet.
How quaint, when I took marketing it was composed of 3 P's, Product, Price, and Placement and consisted of figuring out what the customer wanted, how much he wanted to pay and where he wanted to purchase; adding the forth P, Promotion really inverted things. Seems a 3P marketer wants his offices next door to the R&D department to make it as easy as possible to get poten
Re: (Score:3, Insightful)
Things changed when companies stopped selling a product, and started selling customers to each other.
Re: (Score:3, Insightful)
Although I am not a privacy advocate I do advocate for truth. If companies are sharing data while deceiving customers then prison is the place for these executives.
I am convinced that our justice system has become little more than a racial and social system that is clearly devoted to crushing the lower classes. That is why we are bombarded with white collar crime and these people rarely are punished.
Ummm.... Duh... (Score:5, Insightful)
The strength of a chain is only that of it's weakest link. We recently had a proposal to implement NAC and they're constantly tightening policies. Most solutions however are easily circumvented and rendered incapacitated by only one person or device.
As usual, the problem with computer and/or network security is not necessarily the computer (unless you're running Windows) but the people sitting in front of it.
Re: (Score:2)
As usual, the problem with computer and/or network security is not necessarily the computer (unless you're running Windows) but the people sitting in front of it.
Which is why we need robots!
What other areas does this apply to? (Score:5, Interesting)
Re: (Score:2, Insightful)
Re: (Score:2)
Thank you, oh, master of the obvious! (Score:3, Insightful)
Privacy only as good as the people taked to enforce it? And how is this news, hmmmm?
I mean, I once heard of a farmer who gave the keys to the henhouse to a fox. And, guess what? The next day: no more chicken! What a surprise!
In other news, people with matches put more things on fire, and war is dangerous business for just about everyone, including puppies and cute little kids.
Re: (Score:2)
I mean, I once heard of a farmer who gave the keys to the henhouse to a fox. And, guess what? The next day: no more chicken! What a surprise!
That's a pretty damn talented fox!
Any policy... (Score:4, Insightful)
Any policy is only as good as the people enforcing them.
See: US Constitution, Antitrust Law, the Tax Code
Re:Any policy... (Score:5, Informative)
Parent
Re: (Score:2)
So very true. So what's that say about the education and capability of our body politic?
Re: (Score:2)
To summarize the summary: People are a problem.
Most privacy policies are worthless anyway. (Score:5, Interesting)
Seriously. Google the phrase "except as allowed by law", you will find tons of privacy policies that look like this "BlahCo does not share your data except as allowed by law".
Oh great! They won't break the law. That's comforting. Thanks for spending money telling me how you won't do anything to break the law. You'll just distribute my info to anyone to whom it is legal to do so.
How about "BlahCo will not share your data except as REQUIRED by law." Oh no, that would stop their marketing efforts....
Re:Most privacy policies are worthless anyway. (Score:5, Interesting)
A few years ago, congress passed a law requiring companies to disclose their privacy policies to their customers. That's when we started getting those dense little privacy notices stuffed into our credit card bills and splashed onto web signup pages.
Someone went through and *read* one of those things (from a major brand, I forget who) and worked out the actual content of it. What it came down to was
"If you don't check the box [on the signup page], we will do whatever we like with your personal information.
"If you do check the box, we will do whatever we like with your personal information, but we won't break the law."
Parent
Don't forget the caveats... (Score:2)
It's perfectly legal, but what if they change the terms for say, one hour, sell their entire customer database, then change it back? Unless you're refreshing that page 24-7, you will be screwed. Remember when Yahoo did this? [slashdot.org]
Until... (Score:2)
Until it changes without notice to read "we'll do whatever we want" and they still have all your data you gave them under the previous policy.
So even a great policy doesn't really mean jack, if you don't trust the people and the company. And not just now, you have to trust everybody who might ever have access to that data in the future!
Always the case? (Score:2, Insightful)
Aren't any policies or laws only as good as the people enforcing them?
Some companies, such as Deniro just plain lie. (Score:5, Interesting)
There are some companies, that just plain lie. In one such instance, Deniro Marketing, they were provided a unique e-mail address, and now that e-mail address is getting spam for drugs, enhancement products, stock tips, etc.
I have had other companies (versuslaw.com) try to claim that "you must have been infected with a virus that distributed your address book." Of course, I run OS/2 and Post Road Mailer. Nobody writes virii for OS/2 and Post Road Mailer does not run scripts or anything else. Of course, I had another company blame it on their fulfillment people.
Re: (Score:2)
Could be a dictionary attack.
Re: (Score:2)
Or someone who had your address in their address book got pwned
Re: (Score:2)
Could check that by having some honeypot addresses that are just never shared but should get hit by dictionary attacks more frequently than the uniques.
Dictionary attacks aren't all that common. (Score:2)
Not for spam delivery. Spam bounces, yes, but even that's rare.
The vast majority of the no-such-account spam to my mail server is to fragments of Usenet user IDs, old accounts, and so on. The only cluster of dictionary attacks are bounces from spam with my domain forged as the sender... and most of that is things like "DeloresrecessPayton" and "tanyaarentcouch", not credible user names. The top non-real accounts it's hitting are "pklss05", "zurw9t5", and "v72u6d1"... of the couple of thousand spams a day th
Ameritrade (Score:5, Interesting)
A classic example of this is Ameritrade.
I set up an account with them, using a single-purpose email address, amtdcrowell06 at lightandmatter.com. Notice the amtd on the front, which was a unique prefix I chose just for use with them. I started getting spam like crazy. Strangely enough, the spam was all about stocks -- pump-and-dump stuff. Ameritrade tried to blame it on a virus, which wasn't very plausible, since I was running FreeBSD, postfix, and mutt. They tried to blame it on a brute force or dictionary attack, which also wasn't very plausible -- the prefix doesn't really consist of dictionary words, and 13 characters, consisting of a mixture of letters and digits, gives a total of 10^20 possible addresses that would have had to be checked by brute force. I wouldn't have minded if it was a myspace account or something, but these were people who had large amounts of my money. I migrated my account to scottrade. Years later the news broke that ameritrade had leaked tons of email addresses. They blamed it on some unknown insider. Since people had been telling them about the problem for years, you'd think they'd have clued in a lot earlier. It's amazing how bad an internet-based company can be at the internet thing. If any slashdotters are using ameritrade, you might want to think about switching to some other company. (Ameritrade's web interface also had some functionality that didn't work properly in Firefox on Linux.) You can transfer your portfolio from one company to another without having to pay capital gains, and without incurring transaction costs.
Parent
Re: (Score:3, Informative)
Well, let's say you're going to switch to scottrade, which is what I did. Basically all you do is call up scottrade and tell them what you want to do. They'll guide you through the process of transferring your positions from ameritrade to them -- they're motivated to help you complete the process, because they want you as a customer. It was pretty easy when I did it. The only minor has
Policy != same interpretations (Score:4, Insightful)
There is a thick gray line for what falls under protecting privacy and sharing critical information.
Giving an email adress for some may not seem like critical information that will violate a persons privacy, while to others it would be like a crime against humanity and all that is decent. Or you can go more to the middle, like the information that TiVo collects, while it is not accoated to any particular person however their viewing habits are monitored and tracked and used for advertisers, to but a little green thumb next to stuff you may be interested in. Or to see that you actually do watch that show that in public your vietemently deny ever seeing. Perhaps it could go one step further of using your system ID left join to user names of system IDs name and adresses.... All information falls on the sliding scale. If you are a good data miner and have the access you can figure out most anything.
Eg. a normal Slashdot post. you have the user name. Then you can see all the posts the person posts in the past. For example you can probably search all my posts and find my Real Name and my Current address. As looking at pages I have linked to areas of interests I talked about with some authority on, or if I had a home page setup people would see my home page... Then you may cross reference my login name with other sites and see other interests I may have or it could be someone else with the same handle however it could be a clue, further on. Then finding my name and location my may find where they work and most likely their resume if they are looking for a job......
Now I would prefer that you didn't do such as I would feel it would be a violation of my privacy. However there is a lot of information that can be gathered from a person today.
I'm not surprised... (Score:5, Insightful)
Marketers are rewarded for increasing sales / revenue / market share and so would view anything that can do that as a good thing to do.
Privacy officers, OTOH, are trying to protect customer data and so have a different outlook and reward structure.
My point - this is why strategies (Financial / Customer / Process) need to be articulated at the C level and reviewed and outcomes monitored on a regular basis - so everyone is on the same page.
What really bothered me was this:
And in 2005, data broker Choicepoint sold more than 145,000 individuals' personal data to Nigerian scammers it believed were legitimate marketers.
In another ongoing case, Ponemon founder Larry Ponemon says he is consulting with a major financial institution currently being investigated by several states' attorneys general in a major data breach attributed to an e-mail marketing partner. The company, Ponemon says, gave data from six million customer accounts to a marketing firm in Southeast Asia, where it was eventually posted to a Central Asian site dealing in black-market credit card numbers.
As criminals grow in sophistication and are able to co-opt crocked government officials you'll probably see more off this - why phish when you can buy the data you need outright?
Setup a shell company, buy the data you want and go to town (and anywhere else you want) on somebody else's dime. Off course, as corporate losses mount from such fraud the corporations will push for tighter controls simply because it starts to hit them in the wallet.
I had someone charge airline tickets on my card - I had flight numbers, ticket numbers and names and could not get the airline to cancel the tickets; even after I told them it was fraud and the charges were disputed. Right now fraud is just a cost of doing business I guess.
Privacy (Score:2)
Just like the cake ... it is a lie
Just like a spoon ... there is no privacy
Let just microchip everyone with the Mark of the Beast and be done with it already. Sheesh.
The survey doesn't even touch the hidden sharing (Score:2, Interesting)
In other news... (Score:3)
Weather due to change within 24 hours! Sun expected to rise in east!! Horny dolphins shock whale-watchers with aquatic orgy!!!
@Slashdot editors: Slow news day?
This pretty much says it for me: (Score:4, Interesting)
From the TechDirt discussion:
If corporate Amerika treated my "intellectual 'property'" (i.e. my personal identity, beginning with my email address, which I'll point out that they pay me NOthing for, but rather obtain by extortion: "you must surrender an email addres to register to use this website"!) as MY PRIVATE PROPERTY, maybe I would feel more inclined to treat their "intellectual 'property'" (i.e. music and movies _I_'ve paid money to them to use!) with a little bit more respect.
As it stands now, what's good for the goose is good for the gander, and just as they see nothing wrong with sharing "my" email address with their "coroporate partners and marketing associates", I find nothing wrong with sharing "their" music and movies with my family and friends.
Stuff that matters? (Score:2)
Is this a subtle way of announcing that Fark ran out of Obvious tags?
I love it when your scientific (Score:2)
Oh! I love it when you talk all statistical and scientific to me! Giving me the hope of REAL data... but alas you dash my hopes...
Maintain Your Privacy First (Score:3, Interesting)
Gotta Love the Double Standard . . . (Score:5, Interesting)
. . . in this little gem from the Forbes article:
Translation:
New Democratic Party of Canada (Score:3, Interesting)
I knew this a while ago. In a fit of stupidity, several years ago, I decided to join Canada's NDP, and I was dumb enough to give them my email address. What ensued has been very educational about the position privacy concerns really occupy in Canada. Not only do they use a huge variety of spam-filter evasion techniques on their missives, but they blatantly ignore their own privacy policy, to the point of ridiculing their own members when they ask about it. Now, I shouldn't have expected a lot from a political party, but it seems interesting that the people who demand that others obey privacy rules (to the point of creating laws to compel people to do so) would have such a disdain for them. If they won't follow it, what possible incentive does anyone else have to waste any effort doing so?
Re: (Score:2, Interesting)
> A system is only as good as the people that control it.
A system that needs people to control it is destined to fail. A system that controls itself is robust.
the system in question is composed of people (Score:2)
who is modding this crap as interesting?
Who do you think? (Score:3, Funny)
who is modding this crap as interesting?
It's those damn moderator-robots, of course!
(Which I'm told are the robust, self-controlled pinnacles of Slashdot moderating who will never fail us.)
Re: (Score:2)
A system that needs people to control it is destined to fail. A system that controls itself is robust.
Unless you've secretly developed strong AI, there's always people at the helm somewhere. If they aren't the controls someone implemented those controls. Someone designed those controls. In anything but the simplest systems only people are able to spot people that circumvent the controls and improve them. Whoever checks that everything is controlled could slip something past the entire control system. Then you need watchers, and who watches the watchers? And even when the system is supposed to control itself
Re: (Score:2)
> the system is supposed to control itself like say the division of power in government
That is exactly the sort of system I'm talking about. Other self-controlling systems include market economies, and Nature.
> there's always people in the system trying to unravel it.
Just because humans want to (and do) subvert such systems doesn't mean all systems are actively managed. Nor does it mean that actively managed systems are comparably robust to self-correcting systems.
For example, Republicans and Democr
Re: (Score:2)
Whatever, HAL.
A system that controls itself is only as robust as the initial designers made it.
A process that needs people to take action is destined to have problems. A system that consists of actions taken by people cannot control itself, and is destined to have problems.
Re:Oh wow this isn't obvious (Score:5, Insightful)
The best systems are the ones that take advantage of people's laziness to help them. If it required filling out a form in order to give out any information on a customer I bet you'd see far less information being given out. On the other hand, if you can give out the information easily, you're more likely to give it out freely.
The more it costs people (in time) to give out your information, the safer your information is.
Parent
Re:Oh wow this isn't obvious (Score:4, Funny)
I can't let you do that, Dave.
Parent
Re:In related news (Score:5, Insightful)
Shit stinks
When my oldest daughter was born, the first time I changed her diaper I said "Wow! A miracle baby! My kid's shit don't stink!
Two weeks later I almost gagged changing her, I was ready to call the EPA. Later I found that no newborn's shit stinks. It only stinks after the baby has bred bacteria in its bowels.
Shit does not, in fact, stink. Bacteria stinks. You might actually need to run a scientific experiment to determine this statement's validity.
The article would be a lot more newsworthy is the researchers had found surprising data rather than what everyone expected.
Parent
Re: (Score:2)