Government officials tell companies at Web 2.0 Summit that they are asking for trouble if they collect data first and ask questions later.
10 Lessons Learned By Big Data Pioneers
(click image for larger view and for slideshow)
Would-be data miners were urged to dig carefully at the Web 2.0 Summit in San Francisco on Tuesday.
Ann Cavoukian, information and privacy commissioner of Ontario, Canada, and David Vladeck, director of the Federal Trade Commission's Bureau of Consumer Protection, took turns advising the entrepreneurs and business leaders in the audience to gather only data that's necessary and to do so in a way that respects user privacy.
Cavoukian advocated what she called privacy by design, building privacy protections into products because it's better business and better for consumers. Privacy and business interests are not a zero-sum game, she insisted. It can be a positive-sum game, where businesses can gain better, more actionable information by involving consumers in the process.
Businesses have a choice between privacy-by-design or privacy-by-disaster, she suggested.
"Privacy is about control," said Cavoukian. "The individual should control what happens to the information."
[ Facebook has been mentioned frequently at the Web 2.0 Summit because it has so much data. Ironically, its biggest problem may be that it presents users with too much information. ]
If Cavoukian's vision of proactive privacy protection represented the carrot, Vladeck described the stick. As the U.S. government's consumer privacy enforcer, Vladeck acknowledged that the business leaders in the audience didn't want to hear from him and he insisted that he didn't want to hear about them.
Don't collect data you don't need, urged Vladeck. "It's an albatross that can come back and really bite you," he said.
He urged entrepreneurs to familiarize themselves with privacy laws like the Children's Online Privacy Protection Act, which forbids the collection of personal information from children under 13 without parental consent. He cited the FTC's recent settlement with mobile app maker Broken Thumb Apps as an example of how companies can get in trouble when they fail to follow the law.
And lest anyone be tempted to ignore the call to self-regulate, Danny Weitzner, from the White House Office of Science and Technology Policy, spoke briefly to remind conference attendees that the openness of the Internet should not be taken for granted.
Those who have been paying attention to the global tide of Internet policy will know that the tradition of leaving the Internet loosely regulated is being reevaluated in various countries, he said. This is happening not just in countries like China but in European countries like Germany, he said.
The message coming out of these sessions was clear: Be careful with your data, or be prepared to deal with regulators.
Published: 2015-03-30 The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...
Published: 2015-03-30 Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Published: 2015-03-30 The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...
Published: 2015-03-30 readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...
Published: 2015-03-30 Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.