Braindumping online
The nature of digital data is that it is easily distributable, copyable and very hard to verify since it has no physical counterpart. For years people relied on hardware solutions like usb sticks with sophisticated chips on them for the security of the data. The nature of this data was never part of it.
It is just impossible to secure data without having a hardware solution backing this up. The hardware platform was already introduced and demonstrated a decade ago and a lot of business machines already have basic support for it. But these were only introduced to secure interest of media producers sing protocols like HDCP which secures the line between screen and computer. And exactly this is were we have to look at for understanding what the consequence could be of escalation of the open data conflict surrounding #wikileaks. The music industry is still hurting due to the consequences of poor and shortsighted choices.
Learning from this the following points could help ease the pain:
- Accept that a 100% fit solution is not possible.
The information creation governments need to open up a bit. Especially in diplomatic environments it has been stressed that lack of security hurts confidentiality. Basically this is true, but this has never hurt diplomacy. During the cold war data leaked on both sides in a continuous stream, and this was calculated. - Secure the data and not the media.
Bring down security on the smallest identifyable element. For your eyes only means also the same, and not the secretary or a staffing organisation. A lot of this work is currently handled elsewhere, filtered and reported for handling by the responsible parties. Another positive effect here is that it will need less overhead making it run cheaper or have more people focussed on communication. Use DRM and encryption on the individual documents in a jericho-style manner. - Create ‘open’ and ‘private’ channels like a GovCloud version of Twitter.
Set this up in a distributed manner and do not rely on any for of centralisation. Due to security on message level information is communicated securely between people. - Use a clear human - computer security interface.
The way identification and access are controlled currently are based on centralized control and exactly this is where the problems are. Use a distributed and asynchronous manner of key exchange allowing parties to interact securely one on one. Some crypto’s will only be available on simplified closed platforms like tablets. - Revalidate data security regularly
Don’t expect the security standard of a piece information to be set in stone. Revalidate this, possibly using tools that check if public data is matching this. There is no need to be secret about what’s in the open.
The effects of clouds of processing power in computer or human for impacts the way we live more every day. We cannot expect technology that is used to play games on mobile phones not to be used for processing leaked data.
What is needed is a system that works just as the door of your house. You have a key to open it and to lock it down but it somebody drives a car in it, it just opens. Don’t rely on the quality of the key, but bring more enforcement to the door.
On the other hand data security and privacy should be core values that children learn about as soon as they touch a computer….
