Rochester Institute of Technology RIT Scholar Works Theses 2006 Public Policy and Technology: Advancing Civilization at the Expense of Individual Privacy Aaron D. Sanders Follow this and additional works at: https://scholarworks.rit.edu/theses Recommended Citation Sanders, Aaron D., "Public Policy and Technology: Advancing Civilization at the Expense of Individual Privacy" (2006). Thesis. Rochester Institute of Technology. Accessed from This Thesis is brought to you for free and open access by RIT Scholar Works. It has been accepted for inclusion in Theses by an authorized administrator of RIT Scholar Works. For more information, please contact [email protected]. Public Policy and Technology: Advancing Civilization at the Expense of Individual Privacy By Aaron D. Sanders Thesis submitted in partial fulfillment of the requirements for the degree of Master of Science in Information Technology Rochester Institute of Technology B. Thomas Golisano College of Computing and Information Sciences May 2006 Rochester Institute of Technology B. Thomas Golisano College of Computing and Information Sciences Master of Science in Information Technology Thesis Approval Form Student Name: Aaron Sanders Thesis Title: Public Policy and Technology: Advancing Civilization at the Expense of Individual Privacy Thesis Committee Name Signature Date Prof. William Stackpole Chair Charles Border, Ph. Di Committee Member Prof. Ronil Hira Committee Member Thesis Reproduction Permission Form Rochester Institute of Technology B. Thomas Golisano College of Computing and Information Sciences Master of Science in Information Technology Public Policy and Technology: Advancing Civilization at the Expense of Individual Privacy I, Aaron Sanders, hereby grant permission to the Wallace Library of the Rochester Institute of Technology to reproduce my thesis in whole or in part. Any reproduction must not be for commercial use or profit. Date: ____ Signature of Author: __.:.....:.Aa=..:...ro.;:;..:.n.:,...=S;.;:;:.:an..:....::;d:...::..:erc..::....s ___ 3 Abstract Technological advances have created a new existence, providing an unforeseen level of interaction and transaction between parties that have never physically met. Preliminary thinking was that these advances would create a previously unimaginable level ofprivacy and anonymity. While a surface examination suggests an abundance of privacy in modern society, a more thorough examination reveals different results. Advances in technology and changes in public policy have produced a world in which a startling amount of information is available regarding a given individual. Rather than experiencing an increase in individual privacy, modern societies suffer from rapidly decreasing individual privacy. Table of Contents I. Introduction a. Cultural Influences 6 b. Panoptic Sort and Persistent Digital Nym 9 c. Liberty and Passport: Persistent Digital Nym go Corporate 14 II. Computer Technology a. Protocol Flaws 17 b. The Problems of EP Addresses 23 c. Cookies: A Dangerous Treat 26 d. Spyware: Tracking Your Steps 31 e. The Wonders of Wireless 33 f. Archiving 36 g. Information Gathered From the Local Computer 38 III. Available Information a. The Wallet as a Tracking Device 47 b. The Dangers of Public Records 52 c. Name Seeding 53 IV. Case Study a. Case Study 55 V. Public Policy a. USA PATRIOT ACT: Enabling Government Monitoring 64 b. Collecting the Data 72 c. TLA: The Government's Data Warehouse 79 d. Other Programs 84 e. Government Information in Public View 85 f. Cameras on Every Corner 86 g. NASA's Mind Reading Experiments: Pre-Crime in the Physical World. .95 h. CAPPSII 99 i. Smart Stamps 1 02 j. FBI's DNA Databank 104 k. US VISIT 105 1. Privacy Protection Laws 106 m. Summary of Government Policies Ill n. Results of Policy Enactment 113 VI. Non-Computer Technology a. Automobile Data Recorders 115 b. Cellular Phone Tracking 117 c. REID 118 "Loyalty" d. Customer Cards 125 e. Chip Implants: Voluntary. .For Now 127 f. Social Engineering: Getting the Information From its Source 129 g. The Lurking Dangers of Identity Theft 137 VII. Concluding Section a. Conclusion 139 b. Bibliography 1 42 c. Curriculum Vitae 154 Introduction Cultural Influences Before examining the current situation, it is insightful to examine the opinions ofpopular "Metropolis" culture. Fritz Lang's (1927) was one of the first movies to explore the possibility of "Anthem" humanity's dark future. Ayn Rand's (1946) focused on philosophical struggles in a future where individuals did not choose their profession or spouse, and individuals identified each other by a number rather than name. Although a vehicle for spreading objectivism, "Anthem" did suggest the notion that a unique number could mean more than an individual's name, as the SSN (Social Security Number) often does in modern society. Next was George Police" Orwell's landmark "1984", which introduced familiar phrases such as "Thought and "1984" "Big Brother". presents a future where the government monitors individuals 24 hours a day, and even their own thoughts are not private. The novel coined the phrase "Big Brother is 'Net" watching". "The (1995) introduced a world in which all of an individual's personal information was available in digital form and stored in massive databases. The film highlighted the fact that one mistaken entry could ruin an individual's life. In the movie, a criminal cracker alters all of the warehoused information regarding the main character, causing law enforcement Report" to identify her as a criminal. "Minority (2002), introduced a future in which police can prevent crimes before they happen by predicting the future. In addition, the film presents a future where biometric technology is ubiquitous. At one point, the main character is walking down a street, and biometrics-enabled billboards scan his retina and change their advertising to suit his preferences. Definition of Privacy and Privacy Measurement "privacy" Although it may seem to possess a proper definition, the word requires clarity. The problem is that what privacy has been and what privacy is do not guarantee what privacy will be or what privacy could be. For that reason, the best definition of privacy is "control". When this thesis discusses an individual's right to privacy, it is referring to their right to have control over their personal information. Privacy does not mean secrecy, as an individual may freely share their personal information with everyone, if they so desire. Individual privacy focuses on an individual's right to have control over their information, allowing the sharing of their personal information only with their explicit permission. Privacy is critical because it enables individuals to feel safe, secure and in control of their lives. A feeling of privacy allows individuals to set limits that make them feel protected from the outside world. In addition, privacy can influence an individual's behavior, particularly in their shopping behaviors. Studies have found that an individual's shopping behavior can vary greatly given their feelings of trust towards an organization and their desired level of privacy protection (Glen Nowak, Joseph Phelps, and Giles D'Souza "Antecedents and"; Sheena Mitchell "The new"). Measuring privacy is difficult, as there is little prior knowledge on the subject of privacy measurement. In addition, measuring privacy attempts to put quantitative values on qualitative personal feelings, which each individual might perceive differently. This thesis measures privacy as the "level ofprivacy as it should effect all individuals". This thesis defines a "Privacy Level Indicator" with a scale of 1 through 5, with 1 being the least invasive and 5 being the most 4- invasive. The defined levels are: 1-Controlled, 2-Acceptable, 3-Uncomfortable, Threatened, 5-UncontroIled. To add finer granularity, the scale contains quarter points. This provides the ability to show a much more specific analysis of an event's effect on the "level of privacy" during the point in time when the event occurred. One similar measurement of the level of privacy is that ofEPIC s (Electronic Privacy Information Center) Privacy Threat Index. EPIC designed the index after September 11, 2001 to DHS' mirror the (Department of Homeland Security) Terrorism Threat Index. The Privacy Threat Index contains 5 levels, each identified by a color and descriptive label. This thesis does not utilize EPIC's Privacy Threat Index for two reasons. First, it was desirable to use quarter points between each integer level, to provide a finer analysis of each threat. In addition, this thesis looks to apply its designed scale to specific points in history, to determine the extent to which privacy has changed over time, ending with a current level ofprivacy. Those two objectives could not be met using EPIC's scale, although their scale is an important factor in determining the level of privacy for recent events. Most of the existing research has focused on the importance of privacy in specific situations, the value ofprivacy, or methods ofbenchmarking the effectiveness of privacy preservation methods. The AMA (American Medical Association) has created the Ethical Force Program, to develop performance measures for ethics in healthcare. Novak, Phelps, and consumers' Elizabeth Ferrell (2000) studied whether privacy concerns affected their willingness D' to provide their personal information during transactions. Nowak, Phelps, and Souza (2001) created an empirical study of how privacy concerns effect consumers. Christina Cary,