<story><title>VPNs are not the solution to a policy problem</title><url>https://asininetech.com/2017/03/28/vpns-are-not-the-solution-to-a-policy-problem/</url></story><parent_chain><item><author>nikcub</author><text>There are a few schools of thought on where responsibility should lie in protecting user privacy. The first that it is a role of government and policy - in the same way the government sets standards for automobile and road safety they can set and enforce policies for user privacy.&lt;p&gt;The second school of thought is individual responsibility. Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.&lt;p&gt;The third would be a hybrid approach - that there is a role for the government to play in setting up a universal minimum level of privacy protection while users also have a role to play in their own protection. This is most akin to how healthcare works - i&amp;#x27;m guaranteed treatment in an emergency room but I also might choose to keep myself healthy with diet, exercise etc.&lt;p&gt;I personally believe in user responsibility for personal privacy and security, where you can&amp;#x27;t and shouldn&amp;#x27;t depend on policy to protect you and that all users should be aware of the issues and actively educated on how to protect themselves. For a few reasons:&lt;p&gt;1. Policy is not universal. Some countries may have extensive and rigorous user privacy protections but that doesn&amp;#x27;t apply to users everywhere. While user privacy protections are strong in Europe, and consumers have access to recourse if they&amp;#x27;re privacy rights have been violated, that same advice doesn&amp;#x27;t apply to the majority of internet users, most of whom are residents of a nation or jurisdiction where there is no strong protection or user recourse.&lt;p&gt;2. Governments are a major party in privacy violations and are conflicted, so they can&amp;#x27;t be expected to behave in the interest of users. The most recent campaigns to roll out encrypted communications and connections in apps was prompted by the US government intercepting internal Google data. The government will almost always be incentivized to lower barriers to ease intelligence gathering and in most of the world government surveillance trumps individual rights.&lt;p&gt;3. Similarly, government can&amp;#x27;t be trusted. This is the point Ed Snowden made when he argued for individual and tech solutions to privacy over government policy[0]. Snowden cites the difference in Obama&amp;#x27;s campaign promises and what he delivered[1], and this isn&amp;#x27;t unique to Obama - the FCC ISP privacy rules being blocked this week is yet another example of how easily and quickly policy can be undone, while the mass surveillance Snowden disclosed is an example of how public policy and private actions can be different.&lt;p&gt;4. Tech solutions to privacy doesn&amp;#x27;t imply individual responsibility. We can, and do have, tech solutions that are universal - such as the campaign to roll out encrypted communications and connections with Whisper and LetsEncrypt.&lt;p&gt;5. Policing government policy is labour intensive and difficult. It relies on privacy researchers - usually individuals - to track what companies are doing with user data. With more data being shared between companies it is even more difficult to apply individual oversight to how policies are being enforced. See Natasha Singer&amp;#x27;s reporting in the NYTimes on data brokers[2]&lt;p&gt;6. There are usually very minor enforcement penalties for companies that violate user privacy policy. The FCC tracking opt-in rules were prompted by some ISPs adding tracking headers or cookies to user traffic. AT&amp;amp;T and Verizon were adding tracking cookies to user traffic and it took two years to notice, and there were zero implications for both companies[3] other than the new FCC rules which are now dead.&lt;p&gt;7. Even in the perfect world of good policy, good application of policy and good enforcement you still have more data than ever being stolen and leaked online. You only have to look yourself up on haveibeenpwnd or a similar database to find that for a lot of people, all of their PII has already leaked[4]&lt;p&gt;It is very clear to me that technology solutions have the primary role in protecting user privacy. Policy isn&amp;#x27;t a waste of time but it can&amp;#x27;t be relied upon. The question is how user privacy protection is packaged for a mass-audience. User privacy requires an equivalent of  what &amp;#x27;use WhatsApp, use Signal&amp;#x27; is for user security, what &amp;#x27;install antivirus, don&amp;#x27;t click on attachments&amp;#x27; used to be for user security and the growing popularity and awareness of ad blockers.&lt;p&gt;I&amp;#x27;m not sure what that will be or what it will look like, but warning people away from VPN&amp;#x27;s probably isn&amp;#x27;t going to help. Chances are that some form of VPN connection will become part of the standard solution (along with HTTPS&amp;#x2F;encrypted comms everywhere) now that the reality of ISPs and users not sharing privacy interests is here and many are aware of it.&lt;p&gt;Theres a great market opportunity here - perhaps not for VPNs as a product but VPN as a technology.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.wired.com&amp;#x2F;2016&amp;#x2F;11&amp;#x2F;despite-trump-fears-snowden-sees-hopeful-future&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.wired.com&amp;#x2F;2016&amp;#x2F;11&amp;#x2F;despite-trump-fears-snowden-se...&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.forbes.com&amp;#x2F;sites&amp;#x2F;thomasbrewster&amp;#x2F;2016&amp;#x2F;11&amp;#x2F;10&amp;#x2F;edward-snowden-pardon-president-donald-trump-pardon&amp;#x2F;#a6ea4b21357f&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.forbes.com&amp;#x2F;sites&amp;#x2F;thomasbrewster&amp;#x2F;2016&amp;#x2F;11&amp;#x2F;10&amp;#x2F;edwar...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.nytimes.com&amp;#x2F;2013&amp;#x2F;09&amp;#x2F;01&amp;#x2F;business&amp;#x2F;a-data-broker-offers-a-peek-behind-the-curtain.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.nytimes.com&amp;#x2F;2013&amp;#x2F;09&amp;#x2F;01&amp;#x2F;business&amp;#x2F;a-data-broker-off...&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.techdirt.com&amp;#x2F;articles&amp;#x2F;20150115&amp;#x2F;07074929705&amp;#x2F;remember-that-undeletable-super-cookie-verizon-claimed-wouldnt-be-abused-yeah-well-funny-story.shtml&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.techdirt.com&amp;#x2F;articles&amp;#x2F;20150115&amp;#x2F;07074929705&amp;#x2F;remem...&lt;/a&gt;&lt;p&gt;[4] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;haveibeenpwned.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;haveibeenpwned.com&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>igk</author><text>&amp;gt; The second school of thought is individual responsibility. Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.&lt;p&gt;I think this is a bullshit argument. Nobody looks after their home security or personal security the way we expect users to be careful of their privacy, nor do we accept the amount of intrusions into our house or personal space as we are told is reasonable in information.&lt;p&gt;Imagine you could get a free pizza every week, you just need to let the driver go through your house and correspondence. Imagine if you had to sign over the risk that your house might be burgled if you signed up for a bank account...And the police didn&amp;#x27;t act on it.&lt;p&gt;These examples seem ludicrous, but that is not because I&amp;#x27;m making them like this, it&amp;#x27;s because the premise that we all do &amp;quot;personal responsibility&amp;quot; is a myth.&lt;p&gt;We have police, laws, community rules, all of these things to protect our houses and personal security. If you leave the door unlocked, robbing it is still a crime. Likewise, if you walk around on an unsafe neighbourhood and get robbed, it would be ludicrous to hear &amp;quot;well, the city warned you that part is unsafe, so the police isn&amp;#x27;t going to investigate&amp;quot;</text></comment>
<story><title>VPNs are not the solution to a policy problem</title><url>https://asininetech.com/2017/03/28/vpns-are-not-the-solution-to-a-policy-problem/</url></story><parent_chain><item><author>nikcub</author><text>There are a few schools of thought on where responsibility should lie in protecting user privacy. The first that it is a role of government and policy - in the same way the government sets standards for automobile and road safety they can set and enforce policies for user privacy.&lt;p&gt;The second school of thought is individual responsibility. Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.&lt;p&gt;The third would be a hybrid approach - that there is a role for the government to play in setting up a universal minimum level of privacy protection while users also have a role to play in their own protection. This is most akin to how healthcare works - i&amp;#x27;m guaranteed treatment in an emergency room but I also might choose to keep myself healthy with diet, exercise etc.&lt;p&gt;I personally believe in user responsibility for personal privacy and security, where you can&amp;#x27;t and shouldn&amp;#x27;t depend on policy to protect you and that all users should be aware of the issues and actively educated on how to protect themselves. For a few reasons:&lt;p&gt;1. Policy is not universal. Some countries may have extensive and rigorous user privacy protections but that doesn&amp;#x27;t apply to users everywhere. While user privacy protections are strong in Europe, and consumers have access to recourse if they&amp;#x27;re privacy rights have been violated, that same advice doesn&amp;#x27;t apply to the majority of internet users, most of whom are residents of a nation or jurisdiction where there is no strong protection or user recourse.&lt;p&gt;2. Governments are a major party in privacy violations and are conflicted, so they can&amp;#x27;t be expected to behave in the interest of users. The most recent campaigns to roll out encrypted communications and connections in apps was prompted by the US government intercepting internal Google data. The government will almost always be incentivized to lower barriers to ease intelligence gathering and in most of the world government surveillance trumps individual rights.&lt;p&gt;3. Similarly, government can&amp;#x27;t be trusted. This is the point Ed Snowden made when he argued for individual and tech solutions to privacy over government policy[0]. Snowden cites the difference in Obama&amp;#x27;s campaign promises and what he delivered[1], and this isn&amp;#x27;t unique to Obama - the FCC ISP privacy rules being blocked this week is yet another example of how easily and quickly policy can be undone, while the mass surveillance Snowden disclosed is an example of how public policy and private actions can be different.&lt;p&gt;4. Tech solutions to privacy doesn&amp;#x27;t imply individual responsibility. We can, and do have, tech solutions that are universal - such as the campaign to roll out encrypted communications and connections with Whisper and LetsEncrypt.&lt;p&gt;5. Policing government policy is labour intensive and difficult. It relies on privacy researchers - usually individuals - to track what companies are doing with user data. With more data being shared between companies it is even more difficult to apply individual oversight to how policies are being enforced. See Natasha Singer&amp;#x27;s reporting in the NYTimes on data brokers[2]&lt;p&gt;6. There are usually very minor enforcement penalties for companies that violate user privacy policy. The FCC tracking opt-in rules were prompted by some ISPs adding tracking headers or cookies to user traffic. AT&amp;amp;T and Verizon were adding tracking cookies to user traffic and it took two years to notice, and there were zero implications for both companies[3] other than the new FCC rules which are now dead.&lt;p&gt;7. Even in the perfect world of good policy, good application of policy and good enforcement you still have more data than ever being stolen and leaked online. You only have to look yourself up on haveibeenpwnd or a similar database to find that for a lot of people, all of their PII has already leaked[4]&lt;p&gt;It is very clear to me that technology solutions have the primary role in protecting user privacy. Policy isn&amp;#x27;t a waste of time but it can&amp;#x27;t be relied upon. The question is how user privacy protection is packaged for a mass-audience. User privacy requires an equivalent of  what &amp;#x27;use WhatsApp, use Signal&amp;#x27; is for user security, what &amp;#x27;install antivirus, don&amp;#x27;t click on attachments&amp;#x27; used to be for user security and the growing popularity and awareness of ad blockers.&lt;p&gt;I&amp;#x27;m not sure what that will be or what it will look like, but warning people away from VPN&amp;#x27;s probably isn&amp;#x27;t going to help. Chances are that some form of VPN connection will become part of the standard solution (along with HTTPS&amp;#x2F;encrypted comms everywhere) now that the reality of ISPs and users not sharing privacy interests is here and many are aware of it.&lt;p&gt;Theres a great market opportunity here - perhaps not for VPNs as a product but VPN as a technology.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.wired.com&amp;#x2F;2016&amp;#x2F;11&amp;#x2F;despite-trump-fears-snowden-sees-hopeful-future&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.wired.com&amp;#x2F;2016&amp;#x2F;11&amp;#x2F;despite-trump-fears-snowden-se...&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.forbes.com&amp;#x2F;sites&amp;#x2F;thomasbrewster&amp;#x2F;2016&amp;#x2F;11&amp;#x2F;10&amp;#x2F;edward-snowden-pardon-president-donald-trump-pardon&amp;#x2F;#a6ea4b21357f&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.forbes.com&amp;#x2F;sites&amp;#x2F;thomasbrewster&amp;#x2F;2016&amp;#x2F;11&amp;#x2F;10&amp;#x2F;edwar...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.nytimes.com&amp;#x2F;2013&amp;#x2F;09&amp;#x2F;01&amp;#x2F;business&amp;#x2F;a-data-broker-offers-a-peek-behind-the-curtain.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.nytimes.com&amp;#x2F;2013&amp;#x2F;09&amp;#x2F;01&amp;#x2F;business&amp;#x2F;a-data-broker-off...&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.techdirt.com&amp;#x2F;articles&amp;#x2F;20150115&amp;#x2F;07074929705&amp;#x2F;remember-that-undeletable-super-cookie-verizon-claimed-wouldnt-be-abused-yeah-well-funny-story.shtml&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.techdirt.com&amp;#x2F;articles&amp;#x2F;20150115&amp;#x2F;07074929705&amp;#x2F;remem...&lt;/a&gt;&lt;p&gt;[4] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;haveibeenpwned.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;haveibeenpwned.com&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>sspiff</author><text>&amp;gt; The second school of thought is individual responsibility. Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.
&amp;gt; I personally believe in user responsibility for personal privacy and security, where you can&amp;#x27;t and shouldn&amp;#x27;t depend on policy to protect you and that all users should be aware of the issues and actively educated on how to protect themselves.&lt;p&gt;The problem is that while home security and personal security is something everyone understands on a basic level, the impact of personal information being public or being available to others is not.&lt;p&gt;Many people believe that whether other people, companies or government agencies or advertisers know some details about their private life doesn&amp;#x27;t matter much, but many don&amp;#x27;t understand the potential impact. Perhaps insurance policies go up inexplicably because you googled backache or headache remedies a few times. Perhaps certain political affiliation or opinions can be outlawed and put you on watch lists in the future (think of the McCarthy era in the US).&lt;p&gt;Many people also don&amp;#x27;t realize how much information can be derived from your network traffic, even if it is not explicitly present in the data itself.&lt;p&gt;Educating people on this kind of complexity and nuance is much more complicated than explaining what a fence does, or how curtains work. It would be expensive and hard, and many people won&amp;#x27;t understand the need for it anyway.</text></comment>