please rob me: geolocation and security

Written by Andrew Rens on March 31st, 2010

Geolocation is all the buzz, at least in early adopter geek circles. Most smart phones now have global positioning system capability, so that the phone can determine your geographic position. Geolocation apps such as Foursquare use gps capability to enable users to signal a user’s location.CIO explains in the detail in Geolocation 101.

It may not have occurred to the early adopters of SOMA, Mountain View, and Watertown but the issue of security will likely be the first concern of anyone from Mzansi, and certainly for anyone from iGoli. Do I really want to signal that I’ve just left home, which I have conveniently tagged on an online map?  Why not just type  “please rob me”?

That is a concern that privacy advocate have raised with a site called Please Rob Me
which used to collect and display  tweets generated by geo-location services in which people comprimised their own privacy and possibly security. Point made they have now ceased doing that (perhaps the lawyers warned of potential liability if one the people featured was robbed). Its a salutory warning, but it mustn’t bet taken as reason to reject these services, but rather that two aspects of them need to be refined; the ability of the user to easily control what information he or she gives out and a new set of social skills.

Together these may actually enhance the security of South Africans who use them, if an app permits the automatic sending of location information to only one or two people this would be a good way of knowing where a loved one is, especially if thta person works in an unsafe area, or is travelling late at night. Someone could also use it to tell trusted friends that one has reached home safely after a night out. Perhaps an app could even be set to to alert someone if a person doesn’t arrive home by a certain time. The key is that user’s can control who sees what easily and intuitively.

The other issue is an evolving set of social skills for using the technology. There is already too much information, I don’t need or want a step by step live feed all my friends movements every day. Of course there will be some of that in the beggining as people play with the apps and figure out how to use them. One obvious guide up front is not to signal the location of friends and colleagues in a way that might comprimise their safety, and privacy. This calls for a big dollop of common sense. Do I signal that I am meeting colleagues for lunch in Bree Street? Why not? Do I signalt that a female friend has set off home from a party on her own in her 1985 VW Golf  at 11:30 PM? You tell me.

We will probably see a lot of journalistic silliness around the privacy issues raised by geolocation since it has all the elements for a thouroughly enjoyable moral panic; unknown technology applied to the quotidien realities of people’s lives. Sooner or later someone will signal that she is in a bar with someone else who swears that he was working late.There will be litigation as some point. Employees dismissed for being found not being where they should, partners and spouses for being where they shouldn’t. What legal responsibility does a person have to safeguard information about another’s location? Can someone be liable for signalling someone else’s location?

Ask a lawyer and she will tell you “it depends”. It will depend on a lot of things. What was the harm suffered? What is the relationship between the persons? Is there a duty of care? How foreseable was the harm? We don’t know how this will play out but its going to be interesting.

And test our assumptions about privacy.

 

epistemology in a networked society

Written by Andrew Rens on March 24th, 2010

We live in a world where we readily accept that we and other people can act and communicate across contents. We rely on others seeing, hearing and reading our communications when all we have in front of us is a screen. We’ve developed  commons sense about when to believe what machines tell us and when not to. We disregard the email from “Mary Smith” telling us that we won the” UK Lottery” but accord some trust to the email purporting to come from someone we’ve met once.

We’ve developed an implicit epistemology about the virtual world. Epistemology is about how we know what we know, what causes us to think we know something, and how much we can rely on it. Its not just the concern of philosophers but also intelligence services, and (although they don’t seem to realise it) anyone trying to prove something. Epistemology is a very practical concern; Wired ran this article on how the U.S. Defense Intelligence Agency uses video games to train agents in think about how they know what they know.

The South African Law Commission has published an Issue Paper on Electronic Evidence, for public comment, that lists issues encountered in proving what people said and did when they use ICT networks to do and say things:

  • Ease of manipulation
  • Rapidly-changing technology
  • Media fragility
  • “Reading” data
  • Dependence on specific hardware and applications

The current evidence system relies on people collecting data in hard copy documents. How can it adapt to what the Law Commission calls “a plethora of evidence residing almost anywhere”.

The Law Commission is calling for public comment by 30 June 2010.

The issue paper poses questions and invites answers, or other submissions. What might be lost in the important details (and they are important) is the sense that there is an implicit if inarticulate epistemology thats being developed by the network society. It may be difficult be to capture the nuances but it holds the greatest promise for creating legal rules that actually work.

FYI the admissibility of electronic evidence in both civil and criminal proceedings in South Africa is currently governed by section 15 of the Electronic Transactions and Communication Act:

15 Admissibility and evidential weight of data messages
(1) In any legal proceedings, the rules of evidence must not be applied so as to deny the admissibility of a data message, in evidence-
(a) on the mere grounds that it is constituted by a data message; or
(b) if it is the best evidence that the person adducing it could reasonably be expected to obtain, on the grounds that it is not in its original form.
(2) Information in the form of a data message must be given due evidential weight.
(3) In assessing the evidential weight of a data message, regard must be had to-
(a) the reliability of the manner in which the data message was generated, stored or communicated;
(b) the reliability of the manner in which the integrity of the data message was maintained;
(c) the manner in which its originator was identified; and
(d) any other relevant factor.
(4) A data message made by a person in the ordinary course of business, or a copy or printout of or an extract from such data message certified to be correct by an officer in the service of such person, is on the mere production in any civil, criminal, administrative or disciplinary proceedings under any law, the rules of a self-regulatory organisation or any other law or the common law, admissible in evidence against any person and rebuttable proof of the facts contained in such record, copy, printout or extract.