Now directed by John Soma, the Privacy Foundation hosts several seminars on privacy each year.

I spoke on how the side effects of information technology impact our privacy, often in ways that we do not notice. First, there has been a radical shift in information systems, which were originally oral, repetition of stories from one person to another. Details would be easy to forget or to report erroneously in retelling. Great effort would be required to preserve information.

A shift occurred toward writing, finally to writing on paper, which allowed for people to communicate precisely, with the eleventh reader seeing what was written with the same precision as the first reader. Exact copies could be made literally to disseminate information further. Even so, paper degrades over time, and the preservation and management of paper documents can be very expensive. Without management, what is written disintegrates, so while information could be preserved literally for longer periods of time, over time, information would be lost by default.

A shift to electrons has taken place in the so-called Information Age, where the benefits of the age of paper were preserved, but the cost of storage, duplication, and management fall dramatically. In fact, copying information becomes essentially free. This badly upset numerous business models, especially in media, where as the name implies, the unit sold was not really information as much as it was the specific medium which contained the information; music on CDs, films on DVDs, and magazines on paper are all excellent examples. Established monopolies and cartels aren't known for their ability to detect changes coming or their willingness to move into new economic systems that they might not be able to control, as demonstrated by publishers being caught with their pants down.

Another shift has taken plce in the context of the information age: preservation of information is now the default. Destruction of information in electronic form becomes a fairly hard problem, as a combination of the difficulty in getting rid of electronic information in a way that a forensic analyst (if no one else) can put together again and the ease with which information can be copied; the simple act of finding all of the copies might well be impossible in many cases.

The second issue is nymity. There is anonymity: the property of having no name; pseudonymity: the property of having a name; and verinymity, the property of having a "true name." What we're really dealing with here is reputation. While many information services will claim that their services are "anonymous," the claim is bogus, because people are tagged with unique identifiers that are persistent from visit to visit. While usually not a true name (i.e., verinym), these are not anonymous because they do in fact have a name, and the ability to establish reputation. User ABC123 looking at page FOO on one visit and user ABC123 looking at page BAR on another visit a month later might seem harmless enough, but looking over a long period of time, we can start to correlate lots of little details that might eventually give us enough to identify someone uniquely. For example, professor Latonya Sweeney has shown that by having only three data: gender, month and date of birth (without year), and a five-digit ZIP code, eighty-seven percent of U.S. residents can be uniquely identified. Thus, defaults have changed quietly, and in a way that can have a dramatic impact on the privacy of individual users.

An example of how these kinds of data can be correlated in a way that can surprise even the implementors of such systems can be found in privacy litigation on which I worked some years back, in the case of Blumofe v. Pharmatrak In that litigation, I performed electronic discovery and analysis, showing that several hundred users of pharmaceutical company Web sites could be identified verinymously by a third-party vendor to those pharmaceutical companies. (The court ruled in that case that although Pharmatrak had general intent to collect all of the information that it could, it did not have specific intent to collect personal information of users, and therefore failed the second of the two tests required to be found in violation of the Electronic Communications Privacy Act of 1986.)

So, how do we avoid running into more problems like this? The important thing to recognize is that we must understand the technology and its properties. Educated consumers who demand strong privacy enforcement mechanisms are, in my opinion, the most effective force to ensure privacy; this will drive matters of Policy. Regulation can also help, by establishing a baseline set of expectations, but come at the potential cost of consumers falsely believing that privacy is a "solved problem" that they need not worry about. Finally, whatever the driving forces, when systems are designed, strong design principles for privacy and security must be built, including such things as fail-safe defaults. My own system, Napersnik, as presented in my 2001 book Developing Trust: Online Privacy and Security is an example of such a system.

After my presentation, I spent some time with some of the folks who attended the session. The following shot was snapped by Pam Dixon at the World Privacy Forum. I'm seated; standing behind me, left to right, are Professor John Soma, David Howell, Molly Young, and Laura Wyant.