Dr. Tom Keenan FCIPS, I.S.P., ProfessorDr. Tom Keenan FCIPS, I.S.P., ProfessorFaculty of Environmental Design & Dept. of Computer ScienceFaculty of Environmental Design & Dept. of Computer Science
University of CalgaryUniversity of Calgary
PrimeLife2010 Helsingborg, Sweden Aug. 2, 2010PrimeLife2010 Helsingborg, Sweden Aug. 2, 2010Copyright © 2010, T.P. KeenanCopyright © 2010, T.P. Keenan
Oops - We Didn’t Mean to Do That! – How Unintended Consequences Can Hijack
Good Privacy and Security Polices
Meet LUC -- The Law of Unintended Consequences
Paris, 1895
Engine Driver was trying to make up time
Brakes failed (foreseeable?)
Oops!
LUC in ActionLUC in Action
In 1997 Canada Imposed a Levy on Blank In 1997 Canada Imposed a Levy on Blank Recording Media such as cassette tapes Recording Media such as cassette tapes and CDsand CDs
Today 29 cents CAD is added to each Today 29 cents CAD is added to each blank CDblank CD
Goal was to compensate musicians for Goal was to compensate musicians for copies made of their workcopies made of their work
What Really HappenedWhat Really Happened
Mp3 player sales soared Mp3 player sales soared
(Technology Substitution)(Technology Substitution)
People started using DVDs which, People started using DVDs which, bizarrely, are not subject to the levy bizarrely, are not subject to the levy
(Law Lags Technology)(Law Lags Technology)
Canadians flocked to US stores Canadians flocked to US stores
(Materiality -- 29 cents often exceeded the (Materiality -- 29 cents often exceeded the cost of the disk)cost of the disk)
HIPAA Foul-upHIPAA Foul-up
US Health Information Privacy Law US Health Information Privacy Law (HIPPA, 1996) Allows Individuals to (HIPPA, 1996) Allows Individuals to Withhold Information from Health Care Withhold Information from Health Care Providers (very broad definition)Providers (very broad definition)
HIPPA is a Federal law and takes HIPPA is a Federal law and takes precedence over state lawsprecedence over state laws
Lawsuits are generally governed by state Lawsuits are generally governed by state lawslaws
ConsequenceConsequence
People have launched lawsuits against People have launched lawsuits against health care providershealth care providers
Then demanded that their info be Then demanded that their info be protectedprotected
Legal process impededLegal process impeded
(Scope conflict)(Scope conflict)
The The a:visiteda:visited exploit exploit
Browsers Generally Don’t Allow Sites You Browsers Generally Don’t Allow Sites You Visit to Access Your HistoryVisit to Access Your History
But They Do Provide render sites you have But They Do Provide render sites you have visited in a different colorvisited in a different color
A Malicious site can exploit this by playing a A Malicious site can exploit this by playing a list of urls (“history stealing”)list of urls (“history stealing”)
This May Uniquely Identify You (through This May Uniquely Identify You (through group memberships, ref: iSecLAB) group memberships, ref: iSecLAB)
(Inadvertent Functional Equiv.)(Inadvertent Functional Equiv.)
Facebook suicideFacebook suicide
According to the UK media, a 24 year old According to the UK media, a 24 year old teacher named Emma Jones committed teacher named Emma Jones committed suicide in February 2010 “'after (her) ex-suicide in February 2010 “'after (her) ex-boyfriend posted naked pictures of her on boyfriend posted naked pictures of her on Facebook” Facebook”
Was living in Abu Dhabi, feared legal Was living in Abu Dhabi, feared legal problemsproblems
(Pricing Failure)(Pricing Failure)
Future Technologies Not Yet Future Technologies Not Yet InventedInvented
““Beware of time-travelling robots from the Beware of time-travelling robots from the future” –Templeton, EFFfuture” –Templeton, EFF
fMRI – Functional Magnetic Resonance Imagery
TechnologyTechnology Will Will Be Mis-AppliedBe Mis-Applied
NY Times article during US Presidential NY Times article during US Presidential campaigncampaign
Tried to assess voter reactions to Tried to assess voter reactions to candidatescandidates
Hilary Clinton caused activity in the Hilary Clinton caused activity in the “disgust center”“disgust center”
The Experts Say that’s Junk Science
“As cognitive neuroscientists who use the same brain imaging technology, we know that it is not possible to definitively determine whether a person is anxious or feeling connected simply by looking at activity in a particular brain region. This is so because brain regions are typically engaged by many mental states, and thus a one-to-one mapping between a brain region and a mental state is not possible.”
Adam Aron, Ph.D. & 16 others, NY Times
To Recap Some LUC-y factorsTo Recap Some LUC-y factors
Technology SubstitutionTechnology Substitution
Law Lags TechnologyLaw Lags Technology
MaterialityMateriality
Scope ConflictScope Conflict
Inadvertent Functional EquivalenceInadvertent Functional Equivalence
Pricing FailurePricing Failure
Let’s Not Forget Let’s Not Forget Malicious/Opportunistic UsersMalicious/Opportunistic UsersNot all LUCs are innocentNot all LUCs are innocent
City of Calgary (and many other places) City of Calgary (and many other places) post property values onlinepost property values online
Led to snoopingLed to snooping
Entrepreneurs based businesses on it!Entrepreneurs based businesses on it!
And Definitely Don’t Forget Human Stupidity…
Does Unintended Mean Does Unintended Mean Unforseeable?Unforseeable?
-Unpredictable-Carries a massive impact-After the fact we concoct an explanation
Taleb calls these Black SwansTaleb calls these Black Swans
Success of GoogleSuccess of Google
9/11 Attacks9/11 Attacks
The Rise of HitlerThe Rise of Hitler
Fall of the Soviet UnionFall of the Soviet Union
Many things are forseeableMany things are forseeable
Strategic Foresight techniquesStrategic Foresight techniques
ScenariosScenarios
Constant revisiting, especially in the light Constant revisiting, especially in the light of new technologiesof new technologies
What Can We Do About LUC?What Can We Do About LUC?
Recognize that they are inevitableRecognize that they are inevitable
Understand that they span technical, Understand that they span technical, social, and even psychological dimensionssocial, and even psychological dimensions
Reason by analogy to help anticipate themReason by analogy to help anticipate them
Analytic tools such as EXAM, PONDER, Analytic tools such as EXAM, PONDER, OWL may help find conflictsOWL may help find conflicts
Scenarios may also have a placeScenarios may also have a place
Thank you!
Dr. Tom Keenan, FCIPS
www.ucalgary.ca/evds
This image courtesy
Elise Pelchat
www.conceptsforall.uqam.ca