David Canton @ 7:53 am
The Wired Science blog as a post entitled We Are All Talk Radio Hosts that refers to a paper based on a wide range of evidence concluding “that human reason has nothing to do with finding the truth, or locating the best alternative. Instead, it’s all about argumentation.”
Its worth a read – the strawberry jam study illustrates the point well.
Essentially, when we start thinking and analyzing about choices, we start focusing on variables that don’t really matter.
So while making informed choices is a good thing, don’t let immaterial factors override your gut decision. Next time you make a decision – be careful to weigh the factors, and ask yourself if you are basing your decision on something that really matters.
This would apply to legal advice as well. Lawyers need to consider various risk factors and criteria to make decisions and give advice. But we need to think about whether our advice is predicated on things that really matter to our clients. Its about knowing your client, and about providing advice in a way that allows your client to weigh the risks.
We all backup our data on computers, smartphones, and wherever else it is held. That’s a good thing – but an article on the StorefrontBacktalk blog entitled Are Data Backups Unintentionally Expanding Your PCI Scope? talks about how payment card data can seep into places you don’t want it to, which is then in turn backed up. While the article focuses on payment cards, the issue could apply to any data.
The entire article is worth a read – whether you deal with credit and debit card information or not - but to get a flavour:
Are your automated backup systems expanding your PCI scope? Almost everyone agrees that backing up your important data is a smart thing to do. Except, that is, when it’s not. The problem starts when your sensitive data seeps into places you don’t expect.
Your backup systems then unintentionally spread cardholder data to locations you don’t suspect and expand your PCI scope in the process. Should you be concerned? I think you should be, and I’m not the only one–the PCI Council thinks retailers may have a problem, too.
…
The problem begins because cardholder data has a way of leaking into all kinds of unexpected places. Sometimes this leakage is from users violating company policy: They copy data to their laptops or local databases, sometimes synching to mobile devices. When these systems are backed up, the data is duplicated in new places, compounding the problem.
And another post on the same blog entitled iPhone Payment Peril: Mobile Mayhem Omen? starts by saying:
The iPhone retains everything typed into it through its onscreen keyboard, including payment-card data, for as long as a year. And that penchant for holding onto payment-card data is only the latest in a long line of mobile data catastrophes that are slowly materializing as mobile deployments start in earnest.
Many apps are simply sloppy about the security of sensitive data.
The bottom line is that everyone who designs any kind of hardware or software, or is responsible for any kind of computer system, needs to think about this issue carefully, and limit the unnecessary duplication or storage of personal or confidential information.
That’s the title of my Slaw post for today. It reads as follows.
There has been a lot of press over the latest countries that don’t want Blackberries in their country unless they can get access to monitor user communications. See, for example, the Washington Post, Techdirt, Engadget.
RIM designed Blackberry communications so they would be secure, in a way that RIM itself can’t even access them. That’s a great feature that makes privacy advocates, corporate users, and individual users very happy.
But it also makes some governments very unhappy – particularly those who believe they need to spy on communications. Some to the extent that they threaten to ban use in their countries unless they get the access they want. Those countries feel the need to monitor for illegal activity, or for anti-government sentiment that we in North America would consider basic free speech. And the threat to ban irks governments like the US, because it affects US government officials and users that travel to those countries, and offends their views of free speech and individual empowerment. The attitude of most of us in North America is that those governments should just lighten up and stop trying to suppress or control the thoughts and activities of people.
But we can’t forget that this is all a matter of degree. US and Canada ”lawful access” advocates want ways for law enforcement to access electronic communications to fight criminals and terrorists, and have similar concerns about encryption that modern communications technology provides. Law enforcement has always been able to do things like wiretaps with judicial oversight that requires some standard of reasonable cause before it happens. (Although one is often suspicious about what wholesale monitoring is done at the national security level of things.)
We need to think these things through very carefully in terms of what access is truly needed and effective to fight crime, and what is merely security theatre. Also what kind of rules, oversight, checks, and balances must go along with law enforcement access in order to balance that against rights to privacy and confidentiality.
