[At last people are starting to wake up to the problem as well as some of the solutions.] http://www.thestandard.com/article/article_print/1,1153,16232,00.html Consumers Fight Back, Anonymously New privacy technologies could tip the balance in favor of individual rights. By Elinor Abreu Over the last few years it's become an accepted truth that as technology advances, privacy recedes. E-mail, computer hard drives and Internet surfing trails have become rich fields mined by marketers and law enforcement for information individuals previously assumed was sacrosanct. Now, that may be changing. The tables are turning as new technologies emerge that return to consumers some of the control over their private information once thought lost. Individually, these are narrowly focused products: Some let people surf the Web anonymously, others set e-mail messages to vanish after a specified period of time. Some offer encryption that until recently was restricted in the United States. Taken together, they could herald a fundamental change in the relations between individuals and the governments and corporations looking over their shoulders. How these devices and systems are deployed and regulated in the next few years will have a profound effect on the ongoing struggle over privacy rights. "We're now at a critical point in this debate," says David Sobel, legal counsel for the Electronic Privacy Information Center, "and the balance could really go either way." "Going forward, [privacy] will be one of the most important issues this century," says Austin Hill , whose company Zero-Knowledge offers anonymous Internet surfing. "The next five years will be the deciding factor." The original online privacy battle was over encryption. Philip Zimmermann, creator of PGP, the strongest encryption program available to individuals, was threatened with legal action by the federal government for violating export regulations by distributing his code over the Web. The case was finally dropped in 1996, and last year the Clinton administration relaxed its export policy. "Crypto is one technology that enhances our privacy," says Zimmermann. "Most technology advances are windfalls for law enforcement, but here's one that helped the rest of the people." With the crypto-wars effectively over, a powerful tool that keeps e-mail conversations private now rests in the hands of individuals. But other threats have emerged, intensifying demand for new privacy tools. In the face of public outcry, DoubleClick backed off its plan to combine offline and online consumer data. The company is under investigation by the Federal Trade Commission and is negotiating with attorneys general in four states to forestall or settle class-action lawsuits over its use of personal data. The FTC is also investigating Amazon.com , eBay and Yahoo for privacy infringements. Yahoo was recently sued for revealing customer identities under subpoena, and in a separate lawsuit a Florida state judge has ordered Yahoo to reveal the identities of users accused of posting defamatory information online. The FTC is also seeking legislation to enforce privacy protections after finding that less than half of the Web's most popular sites were in compliance with fair information practice guidelines. And last week, CEOs from a group of companies including AT&T , Dell, DoubleClick and Ford announced the formation of a coalition to address privacy concerns, hoping to head off attempts at regulation. Outside the U.S., countries historically dedicated to protecting consumer privacy have inched away from that stance. In May, Canada confirmed that it is creating a database on its citizens; new legislation introduced in France would require people who publish Web pages to register with authorities; and a bill in England would give police more power to monitor Internet surfers. The European Union has endorsed a pact that will make U.S. businesses, rather than the U.S. government, responsible for protecting European citizen data. Consumers are paying attention. A new survey from Odyssey, a San Francisco-based market research firm, shows that 92 percent of American households say they don't trust companies to keep their personal information confidential. Now that U.S. restrictions on encryption have relaxed, an array of new encryption tools and companies has appeared, such as 1on1mail, HushMail, Lokmail, PrivacyX and ZixMail. Other companies give consumers different strategies: Saratoga, Calif.-based IDcide lets people reject all cookies, or bits of identifying code left on a computer's hard drive; Ontrack removes cookies, history files and other evidence of Web surfing from a surfer's machine; Privada and PrivaSeek let users control the information revealed to Web sites; and Anonymizer allows people to anonymously surf the Web. Montreal-based Zero-Knowledge takes anonymous Web surfing a step further � its customers can choose to surf the Web anonymously or under a pseudonym. People sign up for the service, dubbed "Freedom," under another name for $10 per name per year. For example, a surfer might use one identity for financial sites and another for entertainment sites. The software acts as a sort of firewall-on-a-PC, managing cookies and ensuring that information on the computer doesn't leak out without the owner's consent. Traffic is routed through Zero-Knowledge's network and encrypted in multiple layers, so it can't be traced in either direction. The company partners with about 180 Internet service providers and is talking to major backbone providers to enlarge its network, says Hill, the 26-year-old founder. Another promising new technology is vanishing e-mail. San Francisco-based Disappearing lets corporations (and soon individuals) wipe out e-mail from hard drives and back up storage drives on computers and throughout networks after a set period of time, from one hour to years. Disappearing's CEO Maclen Marvit describes his product in First Amendment terms. "If you can't speak privately, you can't collect your thoughts in order to have public speech," says Marvit. When it's possible to recover deleted e-mail, "there is effectively a microphone over our heads whenever we use e-mail." Bill Gates , whose e-mail messages came back to haunt him during the Microsoft antitrust trial, could have benefited from Disappearing technology. In fact, the service arguably could be used to help companies preempt efforts to subpoena documents. But corporations have been shredding paper for years, points out Disappearing's research director David Marvit, Maclen Marvit's brother. "There's a lot of precedence about what you're allowed to shred. The same legal case law applies," David Marvit explains. "Privacy is a two-edged sword. Anytime you enable a civil liberty you help the good guys and you help the bad guys." What, then, are the consequences of placing powerful privacy tools in the hands of individuals? In the future, will we all send e-mail that self-destructs after five seconds, and shop in anonymity? Will terrorists exchange nuclear secrets over the Internet, without fear of being traced? Executives with privacy companies acknowledge that masking identities and erasing network footprints such as IP addresses could make it harder for law enforcement to track down people committing securities fraud, for instance. "Giving out such a system which totally encrypts your outgoing traffic, without any safeguards against use by malicious users, seems a bit irresponsible," says Ron Perry, president and cofounder of IDcide. Even Phil Zimmermann, a folk hero to privacy advocates, admits that anonymization technology poses special challenges. "I'm concerned about the side effects total anonymity might have," he says. "But if I had to choose between the terrible loss of privacy and what we're seeing on the Web, and the risks from anonymity, I'd much rather have extreme anonymity than none." The Securities and Exchange Commission, which recently came under fire for its proposal to permanently monitor stock-market-related message boards for possible securities fraud, is taking a wait-and-see approach to the new technologies. "There are lots of ways to track people down," says John Reed Stark, chief of the SEC's Office of Internet Enforcement. "If those things change, then we'll have to reconfigure our approach." "There are going to be cases in which anonymity will create difficulties for law enforcement," says EPIC's Sobel. "But I think the benefits of anonymity for the average user and for the online industry far outweigh the potential for abuses." For advertisers and marketers, the issues surrounding beefed-up privacy are equally sticky. Advertisements on the Internet target specific buyers, while many consumer Web sites pride themselves on "personalization" � figuring out a customer's buying habits and designing Web marketing schemes accordingly. Rather than hinder e-commerce, however, privacy technology could actually boost it by reassuring consumers that their information is guarded. New privacy tools, says Sobel, are "certainly good for the development of the Internet because [they] would remove a lot of the hesitation that a lot of people have about conducting transactions online." The next step for privacy companies? Anonymous payment and shipping, an area in which Zero-Knowledge and others are making advances. Once people can make online purchases without giving out credit card numbers or other identifying information � and can hoard their wealth in online "Swiss bank accounts" that can't be tracked to their offline persona � e-commerce will enter a new phase. It's unlikely that in the future everyone will choose total online anonymity. But the new privacy technologies have implications that go beyond the short-term questions of law enforcement and marketing. "The real dimension here isn't the choice between privacy and disclosure," says Paul Saffo, director of the Institute for the Future in Menlo Park, Calif. "The real story is the impact it has on our sense of identity. The fact that we can selectively disclose things on the Internet is changing the nature of social interactions. If you can change your persona at will in cyberspace, that begins affecting what you think of your own identity and who you think you are."
