Modernizing Authentication — What It Takes to Transform Secure Access
Consider the photographs depicting prisoner abuse at the infamous Abu Ghraib prison in Iraq. They have been enormously damaging to the U.S. and its military, and they will likely be remembered as some of the canonical images of the war. These pictures were taken with digital cameras, some reportedly with camera-phones.
The dissemination of the images from Abu Ghraib demonstrated a fact of life for all in authority: It's getting harder to keep a lid on what people can see. In a world of edge-in communications, the tools of media creation and distribution are being democratized in powerful ways. For companies, as well as for governments, the implications of this sea change are only just becoming clear, and people who have become accustomed to being in control are starting to get worried.
When the Abu Ghraib pictures first reached the public view, one rumored reaction within the Pentagon was to consider banning digital cameras inside military installations. "We're . . . in a wartime situation in the Information Age, where people are running around with digital cameras and taking these unbelievable photographs and then passing them off, against the law, to the media, to our surprise," said Secretary of Defense Donald Rumsfeld. The urge to ban cameras would have been understandable, if misguided, but it was also ultimately a practical nonstarter.
The same urge is felt at businesses such as Samsung Electronics, where the desire to protect trade secrets has led to a ban on camera-phones inside some company facilities. U.S. federal courts also ban the devices, and sports teams are telling fans they can't use them to take videos at games.
Such efforts are, at best, fingers in the dike and, at worst, may fool corporate executives and government officials into believing they've actually accomplished something. Here's why: It takes very little effort to find a "spy shop"a store selling all kinds of cloak-and-dagger stuff. The proprietor will be happy to sell you a camera that replaces the top button on your shirt, or one that fits nicely into your briefcase, giving you the same hidden-camera abilities that local television news programs so cheerfully demonstrate when they're looking for a ratings boost.
Unless governments and businesses are ready to deploy sophisticated electronic scanning and sweeping devices, or force us all to strip naked and then put on special clothing in order to enter their premises, the idea of keeping cameras out is pretty much a dead issue. Soon enough, technology will likely be incorporated into our bodies as well.
Not only will many of us be carrying high-quality video cameras around all the time, but they'll be connected to digital networks. We'll have the potential to be personal broadcasters. This is creepy from a privacy standpoint; we need a zone of solitude, or at least of semiautonomy, even when in public. Maybe people will take to wearing Groucho Marx disguises, complete with glasses, nose and moustache, whenever they're outside.
The implications from other societal viewpoints are also fascinating. Bystanders have carried cameras at significant events in the past. The grainy, grisly, and ultimately heartbreaking film of the assassination of President John F. Kennedy, captured by an amateur named Abraham Zapruder, is undoubtedly the most famous "home movie" of all time. But imagine if Dealey Plaza in Dallas had been filled with spectators grabbing still and video images with their digital cameras and uploading what they'd seen to Flickr or YouTube. Or if passengers on the airplanes hijacked on Sept. 11 had been able to show the world what was going on inside those doomed craft.
We got a taste of this new information flow after the July 2005 London terror bombings. The most enduring image of that event is a blurred photo, with a greenish tinge, that shows a man clutching a cloth over his nose and mouth as he escapes from the smoke-filled Underground. Taken with a camera-phone, this picture ricocheted around the world that day, from camera to Web to newspapers to television.
Cameras aren't the only worry for companies. A USB flash drive, for example, can carry plenty of documents away from an unguarded computer. The tech industry is working on ways to make PCs more secure via digital-rights ("restrictions" is a better word) management, but in the end this effort is likely to bring with it a false sense of security. Because humans are analog, not digital, and because documents, audio and video have to be converted, eventually, into a form we can read, hear or view, it will be almost impossible to fully lock down information in a way that doesn't also make collaboration difficult.
The technology industry's penchant for secrecy is best exemplified by Apple Computer, which has even sued Web sites that dared to publish descriptions and photos of upcoming products that, apparently, had been leaked. Apple contends that such sites expose trade secrets; I think they're doing journalism (and I've filed unpaid declarations, at the request of several of the offending sites' lawyers, to that effect). How this case is resolved will make a difference in how journalism is conducted in California.
All kinds of legal and ethical issues are at play in this emerging world. One involves intellectual property, not all of it hidden beyond locked doors or network security. Big-time entertainment and sports companies (is there a difference?), claiming absolute rights under intellectual-property rules, are increasingly using copyright and trademark authority to clamp down on how others can use the images deriving from what they do. Never mind that the First Amendment gives us rights, too, or that copyright is a balancing act, not an absolute right of control.
And why should companies that depend on the goodwill of fans so readily squander it? Banning video cameras means banning phones with built-in video cameras. Some parent will therefore miss a call from the babysitter about a crisis, and the resulting bad publicity will overwhelm any perceived value from the ban.
Companies also need to recognize that insiders, not outsiders, are the more serious threats. Then they need to work on policies that protect the information that simply must be kept secret without discouraging everyday business.
I'd urge people in authority to consider the possibility that some of the most closely guarded information would be better off in the public sphere. This is unquestionably true for government-held information, where the penchant for secrecy is frequently a tactic to keep taxpayers and political opponents from learning the details of mismanagement, or worse. It's likely true in companies as well, where information that might be used by competitors could well prove more valuable if made available to assist customers and investors in making better decisions. It might even help the company improve its products and services.
I'm not trying to minimize the potentially serious risks here. But if we don't understand that the world has changed in fundamental wayswhere more openness is almost a requirement, for the most practical reasonswe're not going to cope very competently with what's coming. Establishing and enforcing a police-state mentality is not typically conducive to quality, anyway, at least not in enterprises that value creativity and independent thinking. Does yours?
Dan Gillmor is author of We the Media: Grassroots Journalism by the People, for the People and director of the Center for Citizen Media (www.citmedia.org). His next column will appear in June.