Hiding in Plain Sight: Security by Obscurity is Poor Strategy

Though some of you may not have heard the phrase, “Security through Obscurity”; you probably know exactly what I’m talking about. For those who need a more lucid example, allow me to provide one. You may figure you will not end up on any spam email lists if you don’t give out your email address to anyone but friends. You might also think that if you post some pictures of a party you went to online (or a video or a blog) that do one will find it and that it is effectively safe by just being lost in mountains of other information that is out there. This notion has some historical relevance since it allowed the publication of anonymous fliers (think common sense and the federalist papers) as well as avoided government (or private) persecution of individuals (think of trying to track everyone in a civil rights march). In short, blending in to a crowd, or hiding amongst others provided a sufficient level of privacy for most people.

I would hypothesize that the privacy that is hinted at several time in the bill of rights was in the minds of our founding fathers. Few people of the time could have foreseen the information revolution and thus a sufficient amount of protection was provided by blending in. Of course there are negative connotations to this as well (the person who throws a rock from a crowd or fires a shot). The change comes when you have ways to aggregate that information. The assumed level of security disappears. Searches online can find users blogs, face recognition software will soon allow you to search for pictures of people based upon other pictures or tags that have been applied to the photos. Spammers use auto-email name generation and “web bugs” (to be discussed in another posting) to find your email address even if you never gave it to anyone.

The take away from this is simple; don’t assume unprotected information is hidden. Marijuana growers though they were safe using grow lamps within their homes until Mr. Kyllo found out that the police had something called a thermal imaging camera that let them see what was happening in his home. Search engines allow people to look for information that you may have posted (perhaps to a medical online help group). Another example would be that police now take pictures of protesters in crowds for later review (possibly for archiving as well; in some cases they may just want to take the video that you shot as in the Josh Wolf case). The bottom line is that new technology will make information aggregation and discovery much easier than ever before. This has significant social implications (both positive and negative) but from a privacy standpoint the takeaway is simple; don’t rely on hiding in a crowd.