From online companies tracking users' digital footprints to the trend for more and more data to be stored on cloud servers, Internet privacy seems like a thing of the past -- if it ever existed at all. RFE/RL correspondent Deana Kjuka recently spoke about these issues with online security analyst Bruce Schneier, author of the book "Liars and Outliers: Enabling the Trust Society Needs to Survive."
RFE/RL: It is no secret that online companies like Google, Facebook, and Twitter are tracking users' digital footprints. How accurate are these online profiles? What are they used for, other than advertising?
Bruce Schneier: We don't know how accurate it is. The information is used to target advertising. It's used to sell to other companies who use it to target advertising and it's used by the government for whatever reasons governments use that information. Google publishes how often they get national security letters and different government requests from various countries for information about people. Other companies do not. So we have a little visibility into what Google does but not into other companies. So basically it’s used to judge people. Either judge them for marketing purposes or judge them for political purposes.
RFE/RL: Is it possible to protect one's identity online by using tools like proxy servers?
Schneier: All tools matter in some way. No tool is perfect. I mean, when you go to Facebook, you log in. It doesn't matter what tools you are using. You give Facebook who you are. For web browsing, yes, there are some great tools you can use. There is even a search engine -- DuckDuckGo -- that doesn't collect personal information.
So there are a lot of things you can do around the edges. But there are [also] so many ways you can crack information, it’s unclear if you can do anything if someone wants to know who you are. You can [for example] not carry a cell phone. But as soon as you carry a cell phone, the cell-phone company knows your location.
Schneier: Yes and no. I mean, yes, I think it's pretty much impossible to keep your privacy online against a sufficiently motivated, skilled, well-funded adversary. There are still a lot of things you can do to protect your privacy online, and I think we should all do them. But if the other side wants to know who you are, I don't think there is any way to stop them.
RFE/RL: Could you talk about the relationship between governments and the big tech and online companies like Google and Skype? How willing are companies to give away personal data?
Schneier: Companies have to follow the law. I mean, the answer is all over the map. Companies aren't going to fight with governments because their business model is to make money. So they want good relationships. I think, in general, companies are more than willing to do whatever governments want. Some of them are more reluctant than others. Some of them demand more things than others, but some of them just roll over.
We pretty much are sure that Microsoft allows different governments to spy on Skype users, but they've never told us, so we don't actually know. A lot of it is hidden. We don't get a lot of information.
RFE/RL: You have said that the model of feudalism is beginning to permeate computer security today. Could you elaborate on this?
Schneier: This is the model where the companies in power have a lot of control over our computing. So our data now is much more likely to be in a cloud server somewhere and user devices are much more likely to be controlled by the companies. This just makes it even harder for us to protect our privacy.
If [you use] Gmail, [then] Google has all of your e-mail. If your files are in Dropbox, if you are using Google Docs, [or] if your calendar is iCal, then Apple has your calendar. So it just makes it harder for us to protect our privacy because our data isn't in our hands anymore.
RFE/RL: You have said that the real risks the Internet is facing do not come from hackers or terrorists but rather from government and corporations. Will this continue to be true in the future?
Schneier: I don't know about the future, but my guess is that, yes. The big risks are not going to be the illegal risks. They are going to be the legal risks. It's going to be governments. It's going to be corporations. It's going to be those in power using the Internet to stay in power.
RFE/RL: It is no secret that online companies like Google, Facebook, and Twitter are tracking users' digital footprints. How accurate are these online profiles? What are they used for, other than advertising?
Bruce Schneier: We don't know how accurate it is. The information is used to target advertising. It's used to sell to other companies who use it to target advertising and it's used by the government for whatever reasons governments use that information. Google publishes how often they get national security letters and different government requests from various countries for information about people. Other companies do not. So we have a little visibility into what Google does but not into other companies. So basically it’s used to judge people. Either judge them for marketing purposes or judge them for political purposes.
RFE/RL: Is it possible to protect one's identity online by using tools like proxy servers?
Schneier: All tools matter in some way. No tool is perfect. I mean, when you go to Facebook, you log in. It doesn't matter what tools you are using. You give Facebook who you are. For web browsing, yes, there are some great tools you can use. There is even a search engine -- DuckDuckGo -- that doesn't collect personal information.
So there are a lot of things you can do around the edges. But there are [also] so many ways you can crack information, it’s unclear if you can do anything if someone wants to know who you are. You can [for example] not carry a cell phone. But as soon as you carry a cell phone, the cell-phone company knows your location.
Bruce Schneier
RFE/RL: So is the idea of online privacy now an illusion?Schneier: Yes and no. I mean, yes, I think it's pretty much impossible to keep your privacy online against a sufficiently motivated, skilled, well-funded adversary. There are still a lot of things you can do to protect your privacy online, and I think we should all do them. But if the other side wants to know who you are, I don't think there is any way to stop them.
RFE/RL: Could you talk about the relationship between governments and the big tech and online companies like Google and Skype? How willing are companies to give away personal data?
Schneier: Companies have to follow the law. I mean, the answer is all over the map. Companies aren't going to fight with governments because their business model is to make money. So they want good relationships. I think, in general, companies are more than willing to do whatever governments want. Some of them are more reluctant than others. Some of them demand more things than others, but some of them just roll over.
We pretty much are sure that Microsoft allows different governments to spy on Skype users, but they've never told us, so we don't actually know. A lot of it is hidden. We don't get a lot of information.
RFE/RL: You have said that the model of feudalism is beginning to permeate computer security today. Could you elaborate on this?
Schneier: This is the model where the companies in power have a lot of control over our computing. So our data now is much more likely to be in a cloud server somewhere and user devices are much more likely to be controlled by the companies. This just makes it even harder for us to protect our privacy.
If [you use] Gmail, [then] Google has all of your e-mail. If your files are in Dropbox, if you are using Google Docs, [or] if your calendar is iCal, then Apple has your calendar. So it just makes it harder for us to protect our privacy because our data isn't in our hands anymore.
RFE/RL: You have said that the real risks the Internet is facing do not come from hackers or terrorists but rather from government and corporations. Will this continue to be true in the future?
Schneier: I don't know about the future, but my guess is that, yes. The big risks are not going to be the illegal risks. They are going to be the legal risks. It's going to be governments. It's going to be corporations. It's going to be those in power using the Internet to stay in power.