Data Security

Apparently, some of our peers at the Massachusetts Institute of Technology have made a deal with the digital devil. In exchange for a free Windows Mobile “smartphone,” about 100 MIT students have agreed to allow researchers at the Media Lab to track their every digital move, including phone calls, e-mails, and text messages.

The scientists at the Media Lab are not working for the students’ families, significant others, or the Department of Homeland Security. Instead, all of this data is being used to explore a new field known as collective intelligence, where aggregate data from individual use of electronic media is compiled on a massive scale. Collective intelligence is a potentially groundbreaking development in cyberspace, allowing community organizers and advertising firms alike to tailor their message for the broader public.

While we have no qualms with the MIT experiment—which is clearly a well-designed research project conducted with human subjects who have provided informed consent—we believe that it is time for policymakers and concerned citizens to begin a careful and informed dialogue regarding the new role of privacy rights in the 21st century. Given the recent and explosive growth of social-networking websites and the increasingly broad abilities of search and service providers to monitor and interfere with Internet usage, the issue has grown even more pressing.

In particular, state and federal legislators must craft a flexible legal framework for dealing with data security, especially as the tools available to insurance companies and other interested observers become increasingly complex and powerful. According to Dr. Alex Pentland, a researcher at the Media Lab, the basics of privacy regulation should be based on the fundamentals of English common law. We agree with Dr. Pentland’s basic ideas: that an individual possesses his or her own online data, has the right to control data collection by any interested observer, and also has the right to destroy or remove this data.

Implementing these principles is imperative, because the potential consequences of inaction are chilling. According to the New York Times, software developed by web-based firms like Facebook, Google, and even the software division at Apple have the potential to be abused—and this is not limited to relatively innocuous profile access on Facebook. The Orwellian prospects of powerful firms or the government using collective intelligence are truly shocking. Governments across the world could use sense-driven networks—cellular phone towers, for example—to track down dissidents and protesters. American health insurance providers, already notorious for their predatory practices, could use similar tactics to preemptively deny coverage to those who they suspect are at risk for a certain disease. And Comcast, one of the largest telecommunications providers in the country, has already come under fire for limiting the bandwidth of consumers who supposedly paid for an “unlimited” subscription to its high-speed Internet service.

Policymakers should also take extra steps to make the importance of privacy rights clear to those who may not understand the significance of secure hyperlinks or data encryption. Doing so will not only head off the inevitable consumer-protection lawsuits, but will also make it easier for concerned parties to identify abuse of secure data and report it to the appropriate authorities. Any new regulations on this booming sector of the economy will have to be carefully crafted, but protecting the right to privacy should be a primary objective in a digital world.