Way back in 2012 I wrote about the lack of understanding of the issues around online privacy. The reason was that the head of internet security at the Cabinet Office (the administration department of the British government), Andy Smith, had commented (accurately) that demanding real names and addresses in online transactions might actually make security worse. Indeed, he advised people to use fake details in Facebook at this was a “sensible thing to do”. He was apparently unaware that providing fake details was in direct violation of Facebook’s policy, which is why Simon Milner, Facebook’s head of policy in the UK and Ireland at the time, was not particularly happy with Andy and had a “vigorous chat” with him to persuade him to revise his view.
My view has always been that, however vigorous Mr. Milner’s chat might have been, there are almost no circumstances where it is necessary to use real names and we only use them now because we lack a proper identity infrastructure. By and large, we use the real name as a proxy to the attributes that are actually needed to execute a transaction. Internet security expert Andy’s 2012 comments elicited an immediate and vituperative response from internet security expert Helen Goodman MP, formerly Chief Executive of the National Association of Toy and Leisure Libraries, who said that “I was genuinely shocked that a public official could say such a thing”. She said that she had been contacted by constituents who have been the victims of cyber-bullying on major social networking sites by people hiding behind fake names and I don’t doubt that this is true. But so what? People bully under their real names too, and it doesn’t make any difference.
If people have broken the law, they can easily be traced, since the interweb tubes will lead the plod directly to them. Or, indeed, directly to the plod as in the case of the serving police officer arrested over claims that he tormented a mother with abusive online messages. I wasn’t cyberbullying Ms. Goodman, just using her to illustrate a point. After all, her fellow Oxford graduate and internet security expert Edward Vaizey MP agreed with her and said he “wouldn’t encourage people to put false identities on the internet”.
I wasn’t writing all of that to shill for Andy Smith. Andy and I disagreed about things from time and time, and while I make notcomment on whether he is an
Epic F***ing Secure Hero or not, he certainly is an actual internet security expert. His comments were informed and relevant and exposed a lack of policy integrity. I don’t know why politicians don’t take the time to think this through. They always reach for the same knee-jerk response: some sort of internet passport or driving licence so that you can tell who is posting abuse about the government on The Daily Telegraph web site (hint: me).
As has been clear from the earliest days of the web, if there was an Internet Driving License that you had to use to log in to web sites, that would almost certainly make the situation far worse, since these website would now know exactly who you are, and this information would then be freely obtained by perverts, the secret police, News International or whoever else wants to pry.
We don’t have to guess about whether this is true or not because there are plenty of real examples to look at. Consider the experience of South Korea as a case study. In 2007, South Korea temporarily mandated that all websites with over 100,000 viewers require “real names”, but rescinded the law after it was found to be ineffective at cleaning up abusive and malicious comments. In fact the results of the “real names” law were predictably perverse. While unwanted comments fell by an estimated .09%, identity theft went up, because real identities were stolen from the thousands of web sites that now had to ask for them and store them. And since people became used to be asked for their real identity all the time, it was easier for dodgy web sites to get them to hand them over!
If you make people smear their “real” identities all over the internet because of such a policy, thus delivering the “over–identification” noted above, then that will make identity theft worse. I wonder if we will have learn this lesson all over again when driving licences are stored in Apple wallets?
We need a better-informed public discussion and debate to determine public policy and the balancing of interests between competing pressures needs to be made explicit. How should we determine whether Mumsnet or the EFF are right? In back rooms or in public consultation? Incidentally, “public consultation” I mean consultation in public, not with the public – I don’t really care what the public think since they are almost completely uninformed. Anyway, we (ie, the public) have no idea what we want. We want anonymity for dissidents but not for pedophiles. We want anonymity for hospital nurses blowing the whistle on incompetent surgeons but not for looters. We want anonymity for celebrities in some circumstances but not others. Most of all, and most paradoxically, we want the authorities to spy on other people but not on us.
So what should the government’s policy be? What should regulators demand?