Privacy in the Cloud, a Misty Topic? Ronald Leenes, Universiteit van Tilburg
An introduction to Cloud Computing
What is the relationship between Cloud computing, Grid computing, service oriented architecture (SOA) and Web 2.0?
Increasingly, data and applications are stored and/or run on a web server that hosts what usually was on your local machine. The web browser becomes the usual platform. Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources.
If we talk about “resources”, the definition becomes broader, as we can also speak about computing power or computing time. And these resources are shared by many users, instead of having a dedicated machine. This provide rapid elasticity that allows for easy and quick scaling (up or down).
Models
Software as a Service (Saas): e.g. webmail, online office applications; etc.
Platform as a Service (Paas): e.g. Amazon AWS platform;
Infrastructure as a Service (IaaS): all the power you might have in our PC, in the cloud.
Advantages
Price: many cloud services are reee.
Reliability: redundancy of services and scalability makes the system more stable.
Accessibility: your services, everywhere.
No piracy.
Multiple business models: fees, ads, etc.
Always current version of the software, no needs to update.
Privacy and security issues
Privacy: bodily integrity, data protection, inviolability of the home, secrecy of communications. The later two are specially relevant for cloud computing.
Data protection goals aim at facilitating the free flow of information while providing a minimum level of data protection. Data aspects: confidentiality, integrity, availability. The three of them are (more or less) under control while data are stored in a PC. In the cloud it is certainly less so.
The first thing to state is that, in the cloud, you don’t know where your data exactly are. Indeed, those date are interlinkable by other services, which make them even more ubiquitous while difficult to locate.
Second is that, in “physical” life, one’s identity is made up of different and partial identities of one self. There is a certain control to segregate audiences according to what they can see of me. Not in the cloud. To a large extent, we’re evolving toward a world where you are who Google says that you are (JD Lassica).
As data travel from my browser (and through the Internet) to a cloud service, anyone can potentially intercept your travelling data. The way to avoid this is use encryption (HTTPS) but cloud services do not usually have the incentive to (unlike banks, that are liable for data loss or money stealing) and do have incentives not to (HTTPS requires much more server power and time to encrypt and decrypt, thus making it more expensive at the aggregate level).
Personal data: data that can lead to identification of a person (data subject). Thus, personal data can be taken very broadly as even an e-mail message can lead to identifiable individuals. A processor is a body that processes personal data. A data controller holds or stores personal data.
The DPD is applicable when the data controller is within the European Union jurisdiction, regardless of where the data processor is.
Thus, if Google just provides a platform where the user processes their data, then Google is not a controller, but a processor, which means it is being affected differently by the (European) law. But if data, after being processed, are stored in Google’s servers, then Google becomes a controller. So, cloud service providers can switch between data controlling and data processing or both at a time, with legal consequences.
DPD principles: transparency, legitimate purpose and proportionality.
Discussion
Jordi Vilanova: are there any legal differences in privacy between individuals and institutions? A: legally, in strict sense it only applies to individuals. In the case of companies, we would be talking about intellectual property, trade secrets, etc.
Mònica Vilasau: to balance unequal distribution of bargaining power between service providers and users, what should be done? More regulation? Better contracts? Is the data protection directive enough for cloud computing? A: Contracts should suffice, as they are a very powerful tool. The difference is that in the EU privacy is a public good that needs to be protected, so the law will always be above any contract; while in the US privacy is something that can be bargained between contractors. The DPD is not enough for cloud computing, because its purpose was to regulate over the data controller, a very identifiable agent at a time (e.g. a hospital having data of you). But now, who is a data controller or a processor is very difficult to identify.
Q: Is one of the problems that cloud services are based in the US? A: Yes, of course, if data controllers, processors and subjects were in the same jurisdiction that would make things much easier.
Mònica Vilasau: what about cookies? A: if you accept cookies, you get less of your privay. If you do not, the service provider is no more a data controller (it is not storing data from you, because you refused the cookie) and then you are no more under the DPD. This is an ironic dichotomy.
Education, at any level, is far from being perfect. And the coming of age of digital technologies have, at least, (a) made much more evident the weaknesses of the actual education system, (b) shed some light on the possible solutions and (c) provided some tools that can be applied to achieve those solutions.
An example of the former can be (a) paper handbooks are very expensive, become obsolete very quickly and their content is imposed by publishers; (b) shifting from paper to bytes could solve the three issues and (c) the solution can come in the form of digital educational resources, managed with wikis or collaborative documents and licensed with open licenses.
The digital light has certainly covered all education-related topics and suggested vast ways of improvement. Some of them are (or seem to be) as crystal clear that we feel the urge to rush the improvements and we end up not understanding how will the system still stick together a year longer. Like night owls, we even get so dazzled how could anyone build such an educational system that is, according to some of my last readings, impersonal, inflexible, one-size-fits-all, not engaging, boring, expensive, old-fashioned, reactionary, etc. In one word: industrial.
While we all find stupid people every now and then — surely in front of our bathroom’s mirrors, that’s a fact — it is hard to believe that modern universities and schools have been designed and ruled for 250 years exclusively from ignorance, idiocy or, in the best cases, from aspirations to control people — like many suggest today.
A little bit of Economic History
The history of humanity (or at least a part of it, I’d dare say) is that of achieving higher levels of productivity through efficiency, and as an outcome to that, more quality of life and diversification of human activities due to more people being freed from other (more basic) activities.
Taming led to farming, and farming freed some members of the tribe from the need to go hunting, that could now improve their homes, treat fur to protect them from the weather, etc.
If some people can today devote their lives to activities not strictly related to survival (artists, most scientists, sports, fashion, etc.) is partly because we only need from 5% to 20% of the total workers to work in agriculture to sustain the world (that’s a very rough average, but the point is made).
Reversely, if we want everybody to dress up with the latest trends, we have to shift from hand seaming and knitting to individual loom weaving, and from individual loom weaving to massive, industrial ways of looming, cutting, seaming, boxing and delivering.
Baumol’s cost disease
During the 60s, William Baumol theorized about efficiency and cost in the arts sector coming up with what has been called Baumol’s cost disease. He and William G. Bowen described that, while you can make a craftsman shift from artisan seaming to industrial weaving, it will always take four people to play a string quartet (that’s the marvel of a quartet, mind you!).
We are then to witness how the human labour costs of producing a pair of socks will drop from the cost of some hours (when hand-knitted) to some seconds (when their production is industrialized). A Baroque quartet will, notwithstanding, remain in a fixed figure (and its cost) of four people playing for just and always the same time.
One of the results is that economic activities that can apply labour-saving technologies will increasingly be relatively cheaper than the ones that cannot. In other words, in the 1st century a pair of socks would cost as much as a ticket for the gladiators (I’m guessing here), while in the 21st you could not wear to a concert all the socks you bought for the same money that your ticket cost. A side effect of that is that less “human-efficient” activities push their wages up: while some can make thousands of socks a day, others can only perform a couple of concerts in an afternoon.
There are not many solutions to this “disease”, and the most usual are to increase prices (in relative terms, of course) or to decrease quality (the quartet played without the bass, or the symphony with just a couple of violins and no clarinets).
The industrialization of education
The education suffers Baumol’s disease, and the solutions so far have been both the aforementioned: to increase registration fees and to decrease quality by lowering the ratio teachers/student. In other words, education has been increasingly industrialized to look more like socks production than playing a string quartet. This is an undeniably truth.
But let us not only take a look at the what but at the why or, even more, at the what for.
Unlike opera, that almost everywhere remains very expensive and many times also classy, education is absolutely cheap and definitely popular, especially in Europe, where schools and universities are public or publicly funded. (In Europe again) quality schools and universities are the norm, with just very few of them standing out at the top, and another few lagging off at the bottom.
It is not out of idiocy or stupidity or stubbornness, then, that educational institutions where made the way they are, but to achieve some general purpose goals. And it is just because of that that the system is given oxygen, because the goal is worth a little trade off between individual quality and social equity. Universities and schools might not be as good as we’d like them to, but they are undoubtedly fair.
As Neil Selwyn puts it, we sometimes forget that education is not only about individuals, but about the society.
That said, of course is not only legit but necessary to aim at a transformation and improvement of education. And especially when brand new shiny tools appear that offer so much possibilities. And especially when these same brand new shiny tools are transforming all aspects of our lives whether we like it or not. But… just do not let us look back in anger.
