Learning From the Data Scandals

It's obvious that there is too much data being stored, and the biggest problem is that even more data is being accumulated.  The NSA scandal reveals what happens when a very large, secretive government agency with a big, but probably unverifiable budget decides it wants to know everything there is to know about everyone--it accumulates the Brobdingnagian pile of data that would allow it to do just that.  And Edward Snowden's revelations prove that whoever you might be, even if you're the NSA, your data isn't secure.

The Target data hack shows what happens when a private sector organization accumulates massive amounts of valuable data--someone figures out how to get it.  And much of the fallout falls on the most innocent of all--Target's customers.

These examples are only the beginning.  By all indications, Google and Facebook want to gather and store all the data on the Internet about you for ever and ever, so they can sell it to the highest bidding advertiser closest to your GPS coordinates.  But in accumulating these massive amounts of data, they make themselves tempting targets for hackers--and perhaps the NSA.  Remember what Willie Sutton supposedly said when asked why he robbed banks:  "Because that's where the money is."  Wherever there is a big pile of data, someone will go after it.  No person or organization has completely secure systems; not Google, not Facebook; not anyone.  The value inhering in these huge databases will motivate somebody somewhere to put in the effort it takes to find the flaw.

How can we get this data based nightmare under control?  By doing what banks do to limit the impact of robberies--keep less around.  Banks generally keep only limited amounts of cash on hand. If they are robbed, the bad guys don't get that much.  The damage is limited by the fact that there simply isn't a lot of cash to steal.

The same thing can be done with data.  The big accumulators should be forced to stop hoarding.  Private organizations like Google and Facebook should be allowed to hold most types of data for only short periods of time.  For example, perhaps they could be allowed to keep location data for a few seconds.  That would be long enough to sell an ad to the restaurant you're walking or driving by.  But the data should not be added to a profile of you or other long term records that they could keep forever and forever so that it would be available for hackers to steal.  Your web browsing activities could be similarly retained for just seconds, to accommodate the sale of advertising, but not to be incorporated into your profile or other long term records.  Of course, information that you voluntarily post on your Facebook page or your blog could be retained for as long as you choose to keep it there (although you should be allowed to delete whatever you post and thereby prevent Facebook, Google or whoever from retaining it thereafter). 

Even for data accumulated from sources other than the Internet--possibly much of Target's data was accumulated from activity of customers at bricks and mortars stores--could be subject to time limits on retention.  Why does it matter who was buying what brand of diapers two years ago?  Kids grow older and stop needing diapers, and the customer isn't going to buy any brand of diapers no matter how badly bombarded with advertising.  And if a person stops by at a Target store a few times a year, would the store's extremely limited information about that person's buying habits really justify keeping information about the person?  Why put that person at risk of being victimized by hackers when the store's knowledge of the person has little commercial value?  The bottom line is much less information should be accumulated, and the justifications for keeping whatever is kept should be much stronger than they now are.

Some of the proposals for reform of the NSA reportedly take a similar approach.  Data accumulation may be taken out of the hands of the NSA and placed with service providers or other third parties.  While such non-NSA accumulations would present tempting targets for the bad guys, they could be spread out among more places (and therefore be more difficult to attack).  In addition, time limits should be set on the retention of such data.  Yes, any such time limits might make detection of terrorists and other bad guys harder.  But there isn't much evidence that NSA's Big Gulp of data has detected a lot of terrorists anyway, so what we lose from time limits could be pretty theoretical.

Time limits on data retention would mean potentially big changes for the business models of some major companies.  So be it.  Our personal data and personal lives don't exist to serve the needs of soulless corporations.  The surging appeal of SnapChat, with its limited half-life for posted photographs, shows that people want time limits on data about themselves.  One of the most appealing aspects of American life is that you can re-invent yourself.  No need to be weighed down by what you were years ago.  And you shouldn't have to be weighed down by data stored by Internet or retailing giants years ago.  Live free.  Power to the Delete key.  Death to personal data.