American Civil Liberties Union

British Airways made headlines in Britain last week with reports that it is planning to do internet searches on customers in order to provide them with a “personal touch.” As a BA spokesperson explained,

We’re essentially trying to recreate the feeling of recognition you get in a favourite restaurant when you’re welcomed there, but in our case it will be delivered by thousands of staff to millions of customers. This is just the start—the system has a myriad of possibilities for the future.

A few links that have caught our eye this past week:

Paul Rosenzweig has posted a nice piece on Lawfare on the reasons to be skeptical of the need for cybersecurity regulation. He breaks cybersecurity down into its constituent parts (as we have urged) of cybercrime, cyber espionage, and truly catastrophic “digital Pearl Harbor” attacks. He suggests that the first two do not justify regulation, and (like us) is skeptical about the degree of risk of the third. In explaining that skepticism, he provides an elegant analysis of the electric grid, the taking down of which is a frequent cyber-attack scenario, and makes the point that the pro-regulation viewpoint “mistakes vulnerability for risk”—in other words, there can be a vulnerability in a system, but still a low risk that anyone will actually be able to or try to exploit it.

In a post yesterday I discussed the belief that as long as our behavior and communications are only scrutinized by a computer, our privacy has not been invaded. Many people have that sense because computers are so much dumber than human beings.

It’s funny how unpredictable the course of technology is. A few weeks ago it was reported that a Texas school district plans to implant RFID chips in student IDs, and use them to track the whereabouts of students. RFID chips, of course, are what make all kinds of contactless technologies work, from toll booth speed passes to contactless transit passes and entry keys. We have seen attemtps to use RFID’s in schools before and have opposed such efforts, not only because we don’t want to see this kind of intrusive surveillance infrastructure gain inroads into our culture, and because we should not be teaching our children to accept such an intrusive surveillance technology, but also because RFIDs are a generally insecure technology not appropriate for use with children.