tim's experiment

Another week, another “data breach”. These stories follow a fairly predictable trajectory. An embarrassed company – or government department – announces that the “personal data” of thousands of people has been “hacked”.

The Privacy Commissioner is informed, and weighs in with some critical comments on the precautions taken, or not taken, by the data holder. The hacker, meanwhile, is at a safe distance from retribution or punishment, and we are all left to ponder the horrifying possibilities.

But are they horrifying? Last week’s example concerned two Japanese clothing vendors, both new to me, and the lost data comprised, according to rather sketchy media reports, names, addresses and phone numbers, as well as records of what the customers had bought.

Now wait a minute. Many years ago, when telephones were not mobile, and were tethered to the wall by a wire, subscribers to a telephone service were treated to a free book. This was called a telephone directory and included the name, address and number of everyone who owned a phone in your locality, apart from a few eccentrics who for various reasons opted to go “ex-directory”.

If the person you were curious about lived too far away to be in the book you could telephone a woman (it was always a woman) called Directory Inquiries, who had a whole collection of these books. If her range was not wide enough she could, at no extra charge, call her counterpart in the area where your target lived.

If you lived in America you could also (I am indebted to the incomparable Sue Grafton for this snippet) also consult a different directory which listed all the addresses in your area and would tell you who lived in them. You could then look at their tax records.

If a policeman in England stopped you (“just a routine inquiry”) and you gave him your name and address he would not consult the phone book, and computers had not been invented. But in the police station they had a copy of the electoral register.

This was compiled by asking every householder to record who actually spent a specified night in his house, thereby qualifying for the local vote. So your claimed name and address could be compared with the names recorded as residing in your claimed home. If none of them looked anything like yours you had some explaining to do. Anyone could inspect a copy of the electoral register.

In Hong Kong there was even more information available about you if you were a civil servant. Every six months (if I remember correctly) the government published an official phone book, copies of which were eagerly snapped up by journalists.

Large numbers of civil servants appeared in this, along with their official job titles, current jobs and workplaces. At considerably more expense you could buy something called the Blue Book, which listed every government employee, giving his rank, how long he has held that rank and which salary scale he was on. Women of course were also covered but I am too old-fashioned to use “their” as a singular pronoun.

Armed with the Blue Book and the latest government accounts, published as part of the paper avalanche unleashed by the annual Budget Speech, you could establish the exact salary of every civil servant.

When I worked in a local university we were required to provide detailed biographies to be included in course documents, which later moved to the library where anyone could read them. So you can find my early life in the Archives Department at HKBU. Departmental websites routinely include names, phone numbers and email addresses of staff, as in this randomly selected specimen.

Now I realise that there are some pieces of personal data which we would all really like to keep to ourselves. We are sensibly paranoid about credit cards, for example, and would not wish our personal relationships or erotic activities to be a matter of public discussion.

But when it comes to names, addresses, phone numbers and email addresses, one has to ask, where is the harm? I am a sitting duck for junk email because I still use my old work address. This comes with a reasonably good spam spotting service and I delete a lot of stuff unread. I have no objection to people knowing about my purchases from Japanese clothes shops although I imagine interest in my taste in Uniqlo tees is limited.

Your name and address can be used for “doxing” in which you are held up for general disapproval on the internet. This is a serious problem in times of violent disagreement and a source of genuine fear. But the evil here is not in the widespread knowledge of your home address; the evil is in the existence of people who think it justified and reasonable to come round to your house, harass your kids, throw things at your windows and write four-letter words on your front lawn with weedkiller.

I do not see the existence of these nutjobs as justifying a universal rule that people’s names and addresses should be regarded as a precious secret. Nor, in practice, do most people. When you sign up for a “privilege card” or a loyalty programme you are gratuitously trusting a commercial entity with information about yourself which they will happily exploit and, in many cases, trade. We do it anyway.

Buy one thing online and you will be bombarded for months, or even years, with suggestions for further purchases, not all of them from the original vendor.

Having your intray stuffed is particularly galling if participation is compulsory. Like many drivers l used to have an Autotoll pass. The company concerned topped up my balance occasionally from my bank account, and the transactions were routinely recorded in my bank statements. Then the government took over the tunnel tolls and we were all required to install a new gadget.

On the new system, when I go through a tunnel I am immediately sent an email recording my passage through the tube, and another email recording that my account has been charged the fee. Returning through the tunnel I get two more emails, followed by another one saying that my charges have been consolidated and deducted from the linked account at my bank. This is followed by another email, from the bank, recording that the money has departed.

This seems a very elaborate way of separating me from $16. Do I hear the word bureaucracy?

Read Full Post »