Why we need to be careful about utilising Off-shore Online Services

Talk to Online Environments Support Group, Sticky Issues, 7th June, 2010

Who am I?

Other than the obvious, I identify quite strongly with one of the characters in this web comic (take special note of the title!). (although I don't strongly display any of the key indicators for autism).

The Law

(I Am Not A Lawyer!) The main laws dealing with the issues outlined below are contained in the Privacy Act (Commonwealth) 1991 and the summaries known as the Information Privacy Principles (IPPs) and the National Privacy Principles (NPPs). To what extent the ANU, as a Commonwealth body, is subject to the IPPs or the NPPs I cannot speculate upon. However, NPP9 shows that Transborder data flows are an issue to the Privacy Act. One of the elements of NPP9 is that of consent - ie. people should have the option to not participate in any service which stores personal or identity-disclosing information on an overseas information system.

Foreign Security Agencies

The main nexus of so-called Web-2.0 services is in the United States, which has many laws controlling access to private and personal data. One of the recent key pieces of legislation is the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act, 2001. There have been and continue to be many criticisms of this Act, especially in how it deals with foreign (to the USA) persons and their data.

For example: the British Columbia Privacy Commissioner David Loukidelis, in 2004, wrote: "once information is sent across borders, it's difficult, if not impossible, to control" (USA Patriot Act comes under fire in B.C. report).

Or, a recent research paper on how law enforcement agencies can compel Certificate Authorities to issue "false" certificates to intercept otherwise "secure" web and other transactions (Certified Lies: Detecting and Defeating Government Interception Attacks Against SSL (includes actual sales documentation for devices marketed to U.S. law enforcement organisations to streamline this attack). To quote from that paper:

"Individuals living in countries with laws that protect their privacy from unreasonable invasion have good reason to avoid trusting foreign governments (or foreign companies) to protect their private data. This is because individuals often receive the greatest legal protection from their own governments, and little to none from other countries."

Private Corporations

All of the so-called social networking sites are operated by private corporations, often set up with Venture Capital, then sold on to other larger corporations once they are successful.

For example, Twitter expends over US$10M per annum (in 2009) to fund it's operation. As they have no publicly stated revenue model, all of this money is coming from their Venture Capital ("burn-rate"). As of mid-2009, Twitter had raised over US$50M in VC funds. Why are the Venture Capitalists investing in Twitter? How do they hope to recoup their investment? There must be other value in Twitter that people are not being made aware of.

The Internet Paradigm

It has been stated at many times that the Internet is a "peer-to-peer" service (mainly in arguments against the use of Network Address Translation). With the advent of the monolithic Web-2.0 web-sites, the Internet is being transformed into a "Hubs and Spokes" model with a small number of central services and everyone signing up to those services.

The Solution

Distributed, or Federated, "Social Networking" (ie. a "web" of social network sites):