Magazine menu Close Magazine menu

data privacy

Latest stories

ethical data AI privacy

When AI goes low, go high: How ethical AI fights unethical AI

  • min read
    • "This is the world now. Logged on, plugged in, all the time,'' said Jason Clarke in 2015 movie Terminator: Genisys set in 2029. He might as well have been talking about today. Devices have become so integral that today's world wouldn't be possible without artificial intelligence (AI.) AI powers everything from smart homes to customer service to airport security. In Terminator, sentient artificial neural network Skynet sends robots back in time from 2029 to kill the humans who will, in the future, lead the resistance against it. Technology today might be quickly catching up to some aspects of Terminator's fictional 2029, but AI experts say we're a long way from evil, self-aware humanoid robots taking over the world. AI coming close to human intelligence is such a long way off that CEO of Allen Institute for Artificial Intelligence Oren Etzioni says it's "like being worried about overpopulation on Mars before we even have gotten a person on Mars." But there's more to AI than what science fiction shows us. Surveillance and cybercrime applications of AI are concerning, but AI can also strengthen systems and improve data privacy. Like in Terminator, real-life AI can be ethical or unethical. How can AI be ethical? As well as keeping databases and systems safe, ethical AI can influence human behavior, 'nudging' people to make better decisions. Geoff Webb, vice president for solutions, product and marketing strategy at AI-enabled payroll firm isolved, says, "We should expect to see greater use of AI not only to protect privacy, but to enhance ethical behavior. A good example is the use of AI to evaluate things like diversity and inclusion within a business. We'll see AI moving from protecting data to helping us see what that data means." "Businesses are looking to implement machine learning which gives them a smart, efficient and effective way of querying all of the data they hold about people and chop that data up in various ways that can be useful to them. But we need to recognize criminals can also make use of this," says David Emm, Principal Security Researcher at Kaspersky in audio series Fast Forward by Tomorrow Unlocked. Anonymizing and analyzing data more privately Companies collect mountains of data going about their business, and each of us generates data when we check a message from a friend, browse the internet or use an app to check the weather. Some of that data will be sensitive and confidential. To analyze that data, someone's had to look at it. But AI might be able to fix that. AI models can scrub data of identifying characteristics and draw conclusions from large data sets. Francesco Di Cerbo, AI privacy research lead at SAP Security Research, said, "It's like looking at blurred shadows of people. We can still see how many there are, their heights and postures, but not their faces. We can extract information like average and distribution of heights, but it will be hard to identify them. For example, an AI technique like Named Entity Recognition (NER) can detect a date in a sentence, but it might be an invoice date or birth date. Our models must know if that date is personal information. Once different pieces of information are detected in a sentence, we proceed to anonymization." Humans make mistakes. AI (mostly) doesn't. The weakest points of a database are always those where humans are involved. A Kaspersky survey found 46 percent of security incidents that led to business data being exposed were linked to employee error. AI could mean human operators don't need to see sensitive data, giving the processing and sharing of data stronger privacy and security. "AI tools can operate on the data without exposing it to humans. Analysis within platform means reduced risk of someone needing to copy it or print it, or accidentally exposing it," says Webb. "If the platform is secure, granting an AI tool access is often less risky than a human pawing through the data." AI can't be bribed into revealing healthcare data or details of a celebrity's divorce proceedings, for instance. It doesn't leave sensitive data sitting around on a desk or unsecured device. Ethical AI in cybersecurity In 1999, a 15-year-old hacked into NASA with the US Department of Defense, downloading software worth 1.7 million US dollars and shutting systems down for three weeks. Over two decades later, security systems are more sophisticated and harder to break into, but cybercriminals are smarter too. The days of teenagers hacking into government databases are gone – cyberattacks today are dynamic and customized. Traditional security can fail against targeted attacks, but AI can strengthen fortifications and respond more effectively to phishing attacks or breaches. Di Cerbo says, "Automatic defense approaches using AI are highly effective." AI is especially effective in password protection and user authentication. Defensive AI can rapidly detect and contain any emerging cyberthreats, and it's the best way to fight back when AI is part of the attack method. According to Capgemini's report AI in Cybersecurity, hackers use AI for more sophisticated attacks, including spear phishing Tweets – personalized Twitter messages sent to targeted users tricking them into sharing sensitive information. AI can send Tweets six times faster than a human, with twice the success. But while AI can be used for foul play, it also deters these attacks. "Alongside traditional methods, AI is a powerful tool for protecting against cybersecurity attacks," says Capgemini. AI can't do everything, but its potential is great AI is far from an alternative to all human oversight. AI programs have famously replicated human biases – from facial recognition systems not recognizing People of Color to AI recruitment tools not wanting to hire women. But well-designed AI can create a more secure online world, keep data safe and nudge humans towards more ethical behavior. "Security, privacy and compliance will remain business challenges because the counter-pressures are always changing – hackers develop new tools, new privacy expectations and legislation evolve," says Webb. "While businesses could try to manage these risks without AI, it would be complex and expensive. And the more humans involved in processes, the more likely human error or malicious activity will result in a breach," Webb continues. "AI tools can't do everything, but they can deliver better insight more quickly and with less risk of expensive and ugly data exposure." US technology historian Melvin Kranzberg's first law of technology famously says, "Technology is neither good nor bad, nor is it neutral." There may be no greater example of a technology more often called good, bad and non-neutral than AI, and perhaps fairly. So AI is what tech has always been. As in Terminator: Genysis, when good AI robots battle bad AI robots to save humans, today we see AI on both sides of the ethical fence. Using this power wisely isn't a question of if we use it, but how.
data toxic waste

Data – the new oil, or potential for a toxic oil spill?

  • min read
    • Both of these statements were once controversial, but today, they're commonsense. If Equifax, the CIA, the NSA, The Office of Personnel Management, Facebook and dating sites can't keep our secrets secret, then neither can your business. In truth, industry's old, ill-placed confidence in the security of data was always an example of motivated reasoning. Collecting data is so cheap and storing it is so easy, and there were so many analysts and investors and hustling grifters exclaiming that "data is the new oil" that it seemed fiscally irresponsible not to collect everything you could, and retain it forever. Who knew how that data could be put to profitable use in the future? It was raining soup, so it was time to fill your boots – even if you couldn't find a market for soup-in-a-boot today, there was no doubt that such a market would appear in the foreseeable future. Given such a value proposition, it's not surprising that the people doing the collecting and the retaining of data talked themselves into the idea that both activities could be undertaken safely. But of course, they were wrong, and as history has caught up with them – as breach after breach has hit in ever-increasing waves – the rationale has changed. Now, rather than arguing that breaches are inevitable, the story goes that breaches aren't a big deal: every time there's a data breach, company spokespeople recite the catechism: "We take our customers' privacy very seriously. None of the data that leaked was compromising." Some of that is "privacy nihilism" – it was all going to leak eventually, so what's the difference? But there's a more insidious version of this, which argues that breach data isn't a problem because bad people can't do much with it. This isn't just nihilism; it's denialism. Breach apologists argue that the data they leak isn't compromising because it's anonymized, or because key identifiers were removed from it. This profoundly misunderstands how data is used – and abused. Re-identification of anonymized data-sets is a hot research topic for computer science today, with researchers creating automatic tools that piece together disparate data-sets to identify the people in them: for example, you can merge a health authority's database of anonymized prescribing data (doctor, medicine, date and time) with a breached database of taxi journeys that includes trips to hospitals that coincide with the prescribing times to infer who is taking antipsychotic medications, or antiretrovirals or cancer therapeutics. Many data-protection vendors have promised that they can inject noise into data-sets to prevent re-identification, but those promises rarely survive contact with security researchers who evaluate their claims. It's been years since the first significant re-identification theoretical work was done, and things keep getting worse for those who insist that anonymization is possible. Re-identification methods tell us a lot about how digital criminals operate and their incredible frugality and resourcefulness. Usernames and passwords can be recycled in credential-stuffing attacks that allow them to break into security cameras from Ring and Nest, order takeout, or track and immobilize entire fleets of corporate vehicles. Breach identities can be used to overwhelm regulatory proceedings with plausible fake comments or to create fleets of Twitter identities. Criminals operate by combining and recombining data-sets, using one company's breach in combination with a public data source, and a third company's anonymous data release to wreak incredible havoc. They might even get enough data fragments to fraudulently obtain a duplicate deed for your house and sell it to someone else while you're on holiday. Never mind that no one can point to a specific piece of data you're liable to lose control over someday and say, "That, that's the data-point that will cost someone their house, or let their stalker find them or expose their retirement savings to thieves." It's similarly true that no one can point to a specific droplet of dioxin in a factory's illegal effluent pipe and say, "That, that is the carcinogen that will kill a young mother of three, some five miles downstream of the pipe." This doesn't stop companies that poison the water or the air from paying the price. The harms from breaches are stochastic (i.e., randomly determined), not deterministic. So far, remedies for those who have been injured by breaches have been severely limited, but they're getting stiffer. Home Depot's 2014 breach cost it $0.34/customer in direct compensation. But that was then. Breached Yahoo! customers may get compensated $100 each. Facebook just got hit with a $5B fine, and the party's just getting started. The harms from breaches are cumulative: like toxic waste in nature, breaches build up in the information environment, and they are effectively immortal in their potential for damage. As the public – and the law – come to grips with this, we're likely to see greater and greater remedies for those whose data has been released into the wild (forever). Remember, breaches affect everyone alike – all political persuasions, rich and poor, including the governing classes and lawmakers themselves. Inevitably, we will see the framework for breach remedies transformed to look more like the remedies for other probabilistic harms, such as environmental harms. When that happens, it might be too late for you: the data you're warehousing today might already have been ex-filtrated from your network without you even knowing that it's happened – until one of your customers finds out the hard way that you've compromised them, and seeks legal remedies. Your insurer isn't going to write policies for you – or errors and omissions policies for your board – if you're warehousing all this digital toxic waste in leaky digital barrels, not once the penalties for losing control over it start to turn into real money. Maybe you could still justify all that risk if the profits from all that data were commensurate with it. But as researchers keep discovering, the benefits from data are wildly oversold – the efficacy of ad targeting based on users' behavior is almost identical targeting based on the content of the pages where the ads appear, which requires no user data. But if you're an ad-tech company or a Big Tech platform like Facebook or Google, the mystique about the ability of data to convert customers allows you to sell your product as a massive premium, while intimidating potential competitors who think that they will never get started because they can never collect as much data as the companies that are already in the space. The people who claim data is the new oil are people who are selling the data, and the claims they make about the ways that this data lets you do amazing things are sales literature, not peer-reviewed studies. Data was never the new oil. It was always the new toxic waste: pluripotent, immortal – and impossible to contain. You don't want to be making more of it, and you definitely should be getting rid of the supply you've so unwisely stockpiled so far. Data minimization isn't just good practice; it's good business. Collect as little data as you can, and keep it as briefly as you can. If your privacy policy fits on the back of a napkin – because you're collecting almost nothing and processing it only for specific purposes, and then deleting it forever – you're on the right track! This article reflects the opinions of the author.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries