Harley Hahn's
Internet Insecurity


Chapter 5...

The Psychology of Privacy

Transition and Ignorance

One of the themes of this book is that the internal forces that control our thoughts and our actions are frequently out of sync with reality. All too often, we feel emotions and take action based on ignorance only to find that, looking back from a distance, our actions were wasteful — even, on occasion, to the point of being contrary to our own interests. At the same time, while we are side-tracked, worrying about unimportant issues, we are likely to miss the real problems, the ones that do require our attention and our planning.

In Chapter 1, you may remember, we discussed the basic ideas regarding how data is transported over the Net (in packets, using a distributed system). This knowledge led us to an understanding (in Chapter 4) of why Internet companies become less efficient as they grow, and why the Internet is not, and cannot be, an efficient broadcast medium.

In the late 1990s, the Internet began to attract the attention of the business community in a big way. At the time, the people making business decisions didn't understand the nature of the Net. As such, they were led to the false conclusion that it was possible to create impossibly profitable companies whose success could be assured by advertising and selling to an ever-growing audience of Internet-savvy consumers. The collapse of Internet stocks in 2000 demonstrated that such ignorance was not confined to the boardrooms of the world. It was shared in large part by a vast number of investors who created a classic, inevitable boom/bust scenario.

It is true that the creation of the Internet stock bubble and its subsequent implosion had much to do with greed and fear, the mainstay forces that drive the market even in normal times. However, in this particular case, there was another force involved: ignorance. Too many people were being distracted by too many ideas that were just plain wrong.

Such phenomena are common during times of great change, when the salient characteristics of particular issues have not yet penetrated into the culture at large. At such times, when conventional wisdom has yet to catch up to reality, people are apt to make decisions based on their feelings, feelings that are based on fundamental misunderstandings.

There is nothing inherently wrong with this. Whenever we are confronted with a new and important technology, for instance, it takes some time for us to come to terms with how the technology is affecting us. During the time of transition, we tend to run around with half-cocked ideas but, eventually, we figure out what's what, and Reason once again returns to Her throne.

The popularity of the Internet provides us with compelling examples of such activity, for instance, the temporary stock market turbulence. However, the Internet is deeply important to us in many ways, and it is only reasonable to expect that, as the Net creates social change, we are going to find ourselves in the position of having to deal with issues that we do not yet fully understand. One such issue is that of privacy.

Jump to top of page

Why Talk About Privacy?

The Internet, by its nature, has significant effects on our privacy. For one thing, people use the Net to talk to one another, through email, chatting, mailing lists, discussion groups, and so on. It's not hard to imagine someone talking about you behind your back, or passing around information you would prefer to keep private (such as your email address or the intimate details of your sex life). There is also the threat of eavesdropping. In Chapter 1, we discussed how law enforcement agencies, such as the FBI, have the tools to monitor and record Internet communications, including email.

On the other hand, there is a completely different way in which the Net can invade our privacy. As you know, there are many, many computers that store data about us: personal information culled from commercial databases, credit card data, and so on. Many companies are actively using the Internet to gather new information and correlate it with the existing databases. In the trade, this is called DATA HARVESTING, and is a widespread activity among companies looking for a marketing edge. In this way, we can be inundated with spam (unsolicited email), while, at the same time, our activities on the Web are tracked assiduously by companies looking for new and better ways to sell us things (see Chapter 4).

For these reasons, much of this book is devoted to discussing issues of privacy, and showing how you can protect yourself from prying eyes and gossiping ears. Aside from the immediate practical considerations, you will find that understanding and protecting your needs for privacy has long-term benefits that may be more significant than you realize right now. Moreover, like other important ephemeral qualities of modern life — such as trust, freedom and security — people do not miss their privacy until it is gone. So the sooner we, as a society, understand and debate the issues, the better off we will be.

In this chapter, I will create a context for such discussion by exploring the very idea of privacy: what is it, and why is it important to us? In order to provide you with practical answers to these questions, I will analyze the basic motivations underlying our desire for privacy. By doing so, I hope to lead you into a thoughtful state of mind in which you can reexamine your ideas and assumptions in light of our changing world. Along the way, I will explain some of the misconceptions people have about privacy. My goal is for you to approach your decisions regarding privacy and the Net from a posture of understanding and confidence. The reason I discussed the mistakes made by so many Internet companies and investors is that I wanted to show you what can happen when people do not make decisions from a posture of understanding and confidence. This will not happen to you.

Jump to top of page

What Is Privacy?

Let's consider the fundamental question — what, actually, is privacy? To start, let me observe that, broadly speaking, there are two types of privacy. If someone peeks into your bathroom window as you are taking a shower, he is certainly violating your privacy. However, when a company sells your name, phone number and credit card information to a telemarketer, they are also invading your privacy, but in a completely different way.

The first type of privacy concerns itself with your activities. The second type of privacy has to do with the buying and selling of data. To distinguish one from the other, let's call them observational privacy and informational privacy. (I know, the terminology is awkward, but that in itself is significant, as you will see in a moment.)

For most of human existence, the desire for privacy has been exclusively a desire for observational privacy. This only makes sense. Until the twentieth century, intruding on someone's privacy required you to be physically near the person, close enough to see him or overhear what he was saying.

This type of privacy is important to all of us and gives rise to a need which we feel instinctively. From time to time, everyone wants seclusion, the knowledge that what we are doing is not, and cannot be, observed by other people. It may be because we are doing something personal or intimate (taking a shower, gossiping); it may be because we are doing something wrong and don't want to be caught (eavesdropping, stealing); or it may because we are engaged in an activity that requires secrecy to work well (planning a surprise birthday party).

In the twentieth century, things changed. The rise of modern technology afforded the world many new ways in which people could snoop on one another. There were binoculars, video cameras, microphones, phone taps, and so on. In recent years, miniaturization, computers and satellites have enabled people (and organizations) to spy on one another to a degree that would have been unbelievable only a generation ago. Still, no matter how someone spies on you, whether they are listening outside your bedroom with a glass pressed against the door, or tracking your movements with a miniature radio transmitter hidden in your car, they are still intruding into your life in a way that invades your observational privacy, that age-old desire to be alone with your thoughts and your actions.

The other type of privacy is one that has really only become an issue in the twentieth century, with the invention of devices that can transmit and store large amounts of information efficiently. Now that we live in a world in which computers are ubiquitous, we are subject to the machinations of those who would compile data about us: credit agencies, banks, marketers, governments, health providers, and on and on. Any time you do anything that requires a computer, that computer is keeping a record of what you did, and those records are stored permanently in a database. Think about this the next time you use a credit card, make an airline reservation, get money from an ATM, make a phone call, see a doctor, stay at a hotel, or whatever. Moreover, remember what we discussed in Chapter 4: Internet companies go to a lot of effort to track your activities on the Web, and use that information as much as they can.

What is really scary — or fascinating, depending on your point of view — is the realization that the organizations that hold this information about you will often combine the contents of various databases in order to correlate and analyze their holdings. (This is part of the data harvesting process I mentioned earlier.) I'll have more to say about this later.

Jump to top of page

A Lack of Vocabulary

You will have noticed, from the above discussion, that there is a certain awkwardness in analyzing the various aspects of privacy. For example, in order to discuss the basic types of privacy, I had to introduce two new terms, observational privacy and informational privacy. Although these terms are adequate, in the sense that they are descriptive, they are stilted, even pompous (and I am not normally a pompous fellow).

The point is, I had to make up these expressions because there just aren't any words to describe different types of privacy. Moreover, there aren't words to describe the varying degrees of privacy (as in Mary needs more privacy than John, but not as much as Elizabeth). Nor are there words to describe the opposite of privacy. (The closest I can come to such a word would be publicness, and even then, there is no simple way to refer to degrees of publicness.)

The reason for this lack of vocabulary is that our thinking about privacy is actually quite primitive. It is a characteristic of social topics which are poorly understood, that there do not yet exist adequate words to talk about such issues. In fact, this is one way by which you can judge how far society has advanced with respect to a particular problem. Ask yourself, do enough specific words exist to make it easy for us to describe and discuss the problem? In this case, the lack of privacy-related vocabulary shows us that our culture is still immature when it comes to understanding these issues and their significance.

I would imagine, and I am sure you agree, that privacy has been important to people as long as there have been people. If you live in any type of community or family unit, you are going to have a sense of when someone is looking at you and when you are alone. However, this is observational privacy. It is only in the last few generations that what we are calling informational privacy has been an issue. Moreover, with the sudden increase in technology — including the unexpectedly swift growth of the Internet — the need to identify and debate the issues of privacy has increased faster than our ability to talk about them.

Don't let this bother you. It is the nature of change to impose itself upon our lives before we are ready for it, but that's okay. In time, we will develop the wisdom and experience to deal with such problems. (Of course, by then, there will be new problems.)

If you look closely at our world, you will see that there are many areas of life affected by new technology with which we are not yet comfortable. How can you identify such areas? The tip-off is that, even though you recognize something as being important, you notice that you do not yet have the vocabulary to discuss the topic in a mature manner. In other words, when our understanding of something is immature, we will have problems finding the words to discuss it. This is the case for individuals, from childhood to old age, and it is also the case for society as a whole. (What, for example, is the exact word to describe the desire of a man in Medford, Oregon, to keep his wife from knowing that he is using a Web chat room to have a personal relationship with a woman in Florida whom he has never met?)

The relation of understanding to vocabulary is an insight that I want you to remember and apply frequently. The next time you notice that something important is difficult for people to discuss, ask yourself why. If the topic is related to technology, the problem may be that the technology is still new and, collectively, we have not accumulated enough experience and wisdom to use the technology well. Computer scientists have understood this phenomenon for years: no matter how fast theory and technique advance, hardware is always ahead of software.

Returning to privacy: eventually, of course, our vocabulary will develop to meet our needs. In the meantime, we still have those needs and, without a mature understanding of what privacy really is and what it means to us in the twenty-first century, it will be all too easy to make misjudgments. For this reason, I want you to understand the nature of privacy: what it means to you as a person, and how you should think about it. Let's start by asking, why do human beings want privacy?

Jump to top of page

Our Desire for Privacy

It is ironic that, although we enjoy more privacy now than human beings ever have, we are more concerned about someone invading our privacy than ever before. Why is this? The answer lies in the forces that drive our desire for privacy.

There are many instances in which we can imagine wanting privacy, and to make sense out of them, we need to look for basic principles. Toward this end, I will observe that there are four different biological and psychological roots from which a desire for privacy can grow.

First, and most important, we will desire privacy if we have a perception that we are in danger and hiding will allow us to protect ourselves. Imagine yourself being pursued by two large, armed men named Guido and Vince who want to discuss an outstanding loan, and you will quickly see the value of being able to conceal yourself in certain situations.

A second reason to desire privacy is that we know we are doing something that is socially unacceptable, and we want to escape detection in order to avoid censure. For instance, if you ever find yourself littering or taking candy from a baby, you will, no doubt, want to be unobserved at the time. In some cases, our need for privacy will be restricted to being able to avoid detection by a specific person or agency, such as when a teenage girl does her best to keep her diary private from her parents. This same principle governs our behavior when we know we are doing something illegal, and we don't want to get caught. You can imagine, for example, that people who run stop signs, shoplift, or cheat on their income tax will feel a strong need to do so away from the eyes of authority.

The next motivation for wanting privacy is related to our psychological conditioning. There are a variety of activities that we avoid doing in public, not because they are necessarily dangerous or unacceptable, but because we have been trained by our society to feel discomfort in such situations. Consider, for example, how various cultures expose the human body. A woman in a Muslim country who grows up with a strict code of behavior may be conditioned to cover her entire body in public. If such a woman were to visit, say America, she would (at first, anyway) feel a lack of privacy if she were forced to walk around in a revealing blouse and skirt. Similarly, an American woman, even one who is used to dressing in skimpy outfits, would feel some discomfort on her first visit to a nudist retreat. In both cases, the women would feel a desire for privacy, even though being less clothed or naked is certainly safe and (under the circumstances) acceptable. This particular need for privacy is inherent in all of us in many ways. For example, we all have things we prefer to do in private, just because doing so in public, or in front of certain people, would make us feel uncomfortable, such as using a toilet, trying on clothes in a store, flossing our teeth, looking at pornography, and so on.

The fourth situation in which we desire privacy occurs when we want to create a special environment, either alone or with other people. For example, we want privacy when we are having a romantic dinner with a loved one (or a potential loved one), when we are in an important business meeting, or when we want to concentrate on reading a book or watching our favorite TV show. In such situations, we seek to create a bubble around us, and having our privacy invaded would be an intrusion, causing us to be distracted and lose our focus. In romantic situations, privacy is especially important, if we are not to lose the magic of the moment.

Thus, we have the four roots from which a desire for privacy may arise:

  • Our perception of danger.
  • Our understanding that specific acts are socially unacceptable or illegal.
  • Our internal conditioning toward avoiding or embracing certain behaviors.
  • Our wish to create a special environment.

In order to relate this to our behavior, especially with respect to how we deal with the Net, we need to go one level deeper and ask, what drives us to action when we feel a desire for privacy?

Jump to top of page

The Controlling Forces

Let's take a closer look at the four reasons why we may feel a need for privacy, and see just what it is that getting privacy might afford us in each case.

First, there are times when we want privacy because we feel it will help us avoid some type of danger. At such times, we are driven by our need for safety.

Second, when we know that we are doing something wrong, we also want privacy. In this case, it is so that no one (or, perhaps, certain people) will find out what we are doing. In other words, we are motivated by guilt.

Third, there are various activities that we prefer to do in private. These activities may be perfectly safe and acceptable but, because of our conditioning, we are uncomfortable having people observe us in any way. In such cases, we are responding to anxiety.

Finally, there are times when we want to be alone, possibly with other people, in a special environment. At such times, we want privacy in order to avoid an intrusion.

Thus, we can see that the four types of situations that make us want privacy do so because they are able to invoke a particular feeling within us, a feeling that is related to one of the following considerations:

  • Safety
  • Guilt
  • Anxiety
  • Intrusion

Such feelings are powerful, and often control us more than we like to admit. Indeed, they can control us to the point where, unless we understand what is happening, we will find ourselves making decisions and taking actions that are not in our best interests.

For example, consider two people, Pat and Mike. Pat has received harassing and threatening email from an old girlfriend. As a result, he has changed his email address and is especially picky as to whom he gives the new address.

Mike, too, is picky about giving out his email address, but not for any particular reason. Mike is simply the type of fellow who easily feels anxiety and, as a result, likes to control things.

One day, Evelyn, an AOL user and a friend of both Pat and Mike, receives a message that she particularly likes. (The message talks about angels and how important they are to all of us.) Evelyn, being a good AOL person, decides to send the message to 100 of her closest friends. To do so, she forwards the message by directing it to the addresses of all her friends. This means that each person receives not only important information about angels, but the email address of each of the 99 other people who received the message.

Pat, of course, is upset because he is trying his best to keep his new address away from his old girlfriend. Mike, as you might imagine, is also upset, but for a completely different reason. Mike is not worried about a specific threat; he is worried because that is the way Mike is. In this case, it is reasonable for Pat to be upset about the loss of privacy: he has a real concern about his safety. Mike, however, has no reason to feel threatened, but he does anyway, and he is upset.

The interesting point is that, although their situations are different, both Pat and Mike may be experiencing the same degree of discomfort. Mike may honestly be as worried as Pat, even though Pat's concern is based on reality while Mike's is not.

What is important to Mike is not so much the actual danger he is in, but his perception of the situation. Many people like Mike feel at odds with the world, and tend to feel a desire for privacy even when there is no practical reason to do so. In this case, Mike has no real reason to worry about his email address, but he does so anyway.

Consider the following analogy. As human beings, we have evolved in such a way that, whenever we are faced with immediate danger, our bodies react in a particular way, the so-called "fight or flight" response. Our glands send various substances — corticotropin releasing factor, adrenocorticotropic hormone, adrenaline and cortisol — into our bloodstream. Our heart speeds up, our blood pressure rises, our breathing becomes deeper, our mind concentrates better, and we begin to sweat.

This type of reaction is important, even crucial, when we need to run away from a wild jungle beast or confront an enemy intent on hurting us. Unfortunately, it is all too common to have such a reaction, perhaps in a more mild form, when we are under emotional stress: if we need to make a speech, confront a person with whom we are having a conflict, or listen to our boss berate us for something that was not our fault. In such cases, our bodies and our minds automatically react in a way that is inappropriate to the situation.

It is human nature to be prey to a variety of inappropriate reactions.

It is part of human nature to be prey to a variety of inappropriate reactions, such as the one I just described. In particular, it is common for people, especially certain types of people, to feel that their privacy is being threatened even when it is not. When this happens, it is all too easy for such people to believe that what they feel is based on reality, which leads to poor judgment.

Mike, for example, is a computer programmer, who happens to serve on the Internet security committee at his company. Because of his unrealistic feelings regarding privacy, he has pushed his company to install expensive and intrusive privacy monitoring software that is not really necessary. Moreover, he spends too much of his time and energy fighting imaginary enemies.

In this case, however, the story does have a happy ending. Both Pat and Mike sent email to Evelyn (Mike's message, by the way, was a real stinker) complaining about her lack of email etiquette. As a result, Evelyn took the time to learn how to hide recipient addresses by putting them in the Bcc: (blind copy) line of an outgoing message. (You can learn how to do this yourself in Chapter 8.)

Jump to top of page

Who Gets Privacy?

I have explained that a desire for privacy can spring from a biological or psychological need related to safety, guilt, anxiety or intrusion. However, there is one more, large part of the picture that still needs to be filled in.

In our society, privacy is often sought, and given, as a symbol of power or status. Ask yourself, who in our culture is often denied the privacy they desire? The answer is, people who are very young, very old, poor, sick, or in need.

What do all these people have in common? They have a relatively small amount of power, or a low social status, or both. Another way of putting it is that, in our society, you get to enjoy the most privacy when you are powerful, rich, not too old, not too young, and of high social status. Privacy is often used as a perquisite, given to the rich and powerful, and lack of privacy is often used as a tool to underscore someone's lack of power and status, and to punish people who misbehave.

For example, consider how office space is allotted in a large company. The more powerful (and best paid) executives have the most space and the most privacy. The least powerful employees have the least privacy, in many cases being forced to work in open areas or cubicles. In some companies, you may even see extra status given to someone simply because they work closely with a powerful person. For instance, the executive secretary of the Chairman or CEO may have more privacy than a middle manager.

By their nature, organizations are very good at recognizing social status by allowing or restricting privacy. Ask yourself, for example, how you would feel if you were moved against your will from a private office to an exposed cubicle. Even if the cubicle were the same size as the office, you would know without a doubt that your company was trying to send you a message.

When a company wants to show someone that they have very low status, they do so by taking away all the person's privacy. This is often the case when employees of a large company are fired. In such situations, it is common for the employees to be called into their manager's office to be told that they are losing their jobs, and then escorted to their desks by a security guard. Under his watchful eye, they are allowed to remove their personal belongings and nothing else. They are then escorted out the front door.

Here is a typical example. In January 2001, CNN found it necessary to fire 400 employees. As reported in the New York Post newspaper, "Stunned employees from New York to Los Angeles are being yanked into personnel offices all this week and told to pack their things and get out the same afternoon... When they return to their desks, they learn that technicians have already rendered their computers inaccessible, preventing them from retrieving personal files... Uniformed security guards stand watch as the dismissed — some crying — clean out their desks. The guards then escort them like common criminals to the exits."

It is easy to brand CNN's behavior toward their employees as being inconsiderate and insensitive, but it would be a mistake to do so. Why would CNN want to antagonize people for no reason? What is really happening is that an organization — with a life of its own — is showing certain people that they have the lowest possible status (that of a non-employee) by taking away all of their privacy. In the process, the people, who have an innate sense of their social status, are humiliated and angered.

Enforcing social status by taking away privacy is so common in our culture that we often don't pay attention when it happens. Still, it is real. For example, who do you think gets more privacy, a patient who is seeing an expensive doctor in a rich town, or a patient with no money who must wait for a long time to see a doctor at a community clinic? In my experience, observing doctor's offices and hospitals is an excellent way to get a free lesson on privacy and power. Many doctors and nurses are very good at disrespecting people's privacy in order to (subconsciously) make it clear who has the power.

Have you ever wondered why so many people who become wealthy buy themselves houses that have a great deal of privacy? Why do the very richest people live in homes that are all but unapproachable without permission? The reason is that we all have, to a greater or lesser degree, a desire to control our privacy, a need to decide for ourselves who gets to see us and under what circumstances. The plain truth is that rich people have more power to indulge this desire than do poor people, and so, are able to buy more privacy for themselves.

Jump to top of page

Our Real Needs

There is no doubt that privacy is important to us psychologically. However, as we have discussed throughout the chapter, our desire for privacy is usually more primal, existing at a deeper, biological level. Occasionally, our desire is more superficial, reflecting our desire for social status, wealth or power.

Anyone who works or lives with animals knows that they have an innate sense of privacy. For example, a cat will often consider its litter box to be a private place, not to be violated by a human. My cat, The Little Nipper, hides in his box when he sees I am ready to brush his teeth and he is not in the mood for such an experience. (On the other hand, he is always willing to give me access to the box when it needs to be cleaned.) Both wild and domestic animals will crawl away to be by themselves when they are sick or dying. And have you ever waited for a horse to give birth? If so, you will know that it will bide its time until you become impatient and leave, and the minute you are gone, it will deliver the foal.

It is certainly fair to say that, seeing as we too are animals, we have, at times, a biological need for privacy that cannot be denied. This is especially true when a lack of privacy would, in some way, put us in a vulnerable position. On the Internet, we are not exposed to the point of being in physical danger. However, we can be made to feel vulnerable in other ways. For example, we might worry about malicious gossip, or about having important business secrets exposed, or about having our computer attacked by someone who wishes us harm. In many cases, such worries are groundless, but still, if we perceive them to be true, we will feel a desire for privacy.

As you have seen, a desire for privacy is not necessarily the same as a need for privacy. I am sure you would agree that it is a waste of time and effort to chase after something we don't really need, so it behooves us to think carefully before we act. However, analyzing our motives honestly is something that is extraordinarily difficult to do.

Unfortunately, when it comes to the world of computers and the Internet, misinformation and misunderstanding abound, and it is all too easy to be troubled by the wrong issues. The next time you hear of a privacy issue that scares you or bothers you, I want you to take a deep breath and ask yourself, why does this upset me?

If the reason is a good one, then by all means, do what you need to do to safeguard your privacy. However, if you find that your privacy concerns are being fed by irrational feelings or a desire to increase your social status, take a moment to reevaluate the situation and ask yourself, is this really something I need to worry about?

It is my observation that anti-privacy efforts (like censorship efforts) are often vendettas led by obsessive people who are driven by their own inner demons. However, we do live in a highly automated world, one in which both observational and informational privacy concerns are real and important. There is a real risk that, in wasting our efforts on the wrong issues, we will inadvertently allow the real privacy violations to invade our lives when we are not looking. It is my job to make sure that this does not happen to you.

Jump to top of page