Data privacy: how should we look at it?

April 9, 2020· Michel Aguilera

It is a sensitive subject, especially as, with almost daily revelations of service companies caught red-handed reselling data or eavesdropping illegally, one may well ask: is privacy really possible nowadays? It is with this question in mind that, in this article, we will go through some of the ways to protect ourselves against spying or data theft, and the good habits to adopt in our everyday use of IT tools. A short general-purpose guide for anyone who wants to see things more clearly.

Hello? I can see you…and I can hear you!

Yes, it is a fact: nowadays, IT tools are an integral part of our daily lives. Whether in message exchanges, with tools such as WhatsApp, Facebook Messenger or others, our slightest exchanges are analysed, stored…and sometimes redistributed without our knowledge. The most striking example during this period of global lockdown is the case of Zoom, whose number of users exploded in a very short time. But this overexposure has also lifted the veil on some particularly dubious practices.

So, what can be considered confidential? What turns out to be for public use or open to everyone? It is important to be able to tell the difference, starting with a personal classification of what we consider can be shared without any impact on our private life, and what must not be seen or read beyond the inner circle we have chosen. This separation is no easy matter, because the IT tools we use every day rely on a data-exchange structure, with common protocols and interfaces. You can see in the illustration below that APIs (application modules) can be reused from other software publishers to enrich the experience we will have of any given service.

When classifying your data, it is essential to ask yourself the right questions. To protect sensitive data properly, you must first know and understand your data. More precisely, you must be able to answer the following questions:

- What sensitive data do you have (personal photos, financial documents or copies of identity documents, etc.)?
  - Where is this sensitive data hosted?
  - Who can access, modify and delete it?
  - How would your privacy be affected if this data were disclosed, destroyed or improperly modified?

This analysis lays the foundations of what is called data governance. In modern companies, this is a very sensitive activity, because it ensures lasting good practice across all the data used, collected and, where necessary, transformed.

Coming back to the mismanaged use of data entrusted to a communications company, let us look at the news a little. Take the example of the video conferencing software Zoom, which used Facebook software components to operate and redistributed data, without the user of the original service even needing to have a Facebook account.
In this scenario, someone who just wanted to chat with a family member ends up unwittingly feeding the social network’s data lake. The latter, rich with this information, can use it, transform it or even sell it on to third parties…and the user does not even know it! Information such as the place where the participants are, their email and home addresses, their phone numbers.
It also turned out that the software, when running on a computer, could easily be targeted by hackers, who could readily take control of the machine and gain full access to it through the installed version of Zoom.

The response of those accused (namely, Zoom’s management) of misusing our personal data often remains the same: our transactions are encrypted and nobody can intercept them. It is a simple way of saying: I have put a padlock on your data and I am keeping the key. But who controls that? If this key is shared with a development partner of the software or service we use, this third party could use the key to unlock and read in plain text everything that is supposed to remain confidential, without the user being informed. Can this kind of situation be avoided? Yes: by taking back control ourselves of the security level of the information we transmit. In our previous article on video conferencing tools, we mentioned that solutions exist to make sure conversations do not end up just anywhere (or get recorded without our knowledge), and that solutions hosted on national territory should be preferred. One example of an application offering effective encryption, with its services based in Switzerland, is Threema.

Texts, images, voice and soon video chats too are fully encrypted. But can we set up this kind of security ourselves with our own computer?

One example would be: I want to send a confidential email to one particular person. I do not want anyone else to be able to read or intercept this message. So I am going to encrypt the message (with a key that only I hold and with a padlock that will protect the content of my message). But is there a simple way to do this without being a specialist in the field? Here is an explanatory video on using PGP, a free solution that will help you prepare email attachments to be sent in complete security. Demonstration:

With a little practice, you can also easily encrypt the body of an email with the same tool. Effective and free, it works on all computer operating systems (Windows, Mac, Linux).

Let us mention access to the devices we use every day (mobile phones or computers). All recent devices come with strong security (biometrics, facial or fingerprint recognition) to unlock access. This is combined with a username and password to complete the identification of the user who is to use the device. It is also recommended to physically protect the medium that holds the data — I am of course talking about hard drives. Encrypting drives ensures that, in the event of theft, what is stored on them cannot be misused. We covered this point in one of our previous articles. Here is a short video that goes over the basic rules of IT security:

In short, we must protect ourselves!

Our data is an important part of our lives (private or public). It is important to be fully in control of how this data is used, transmitted and stored, as well as who we share it with, and to know through which channels it travels. Do not let the desire for comfort or convenience cloud your judgement. There are enough solutions and means to stay out of trouble and remain protected, while still benefiting from the technological advances that all the new communication tools bring us.