Showing posts with label data security. Show all posts
Showing posts with label data security. Show all posts

Monday, April 05, 2021

In Facebook We Trust

 

Consider what may seem to be an odd comparison:  Facebook and God.  For purposes of discussion, we will compare Facebook to the traditional Judeo-Christian God of the Old and New Testaments.  And we will restrict the comparison primarily to two matters:  communication and trust (or faith).

 

Users of Facebook communicate with that entity by entering personal information into Facebook's system.  That act of communication is accompanied by a certain level of trust, or faith.  Facebook promises to safeguard one's information and not to reveal it to anyone else without your permission.  Users can set up various levels of security ranging from public (anyone can see it) to very private (only a selected list of people can see it).  In entrusting what is sometimes very personal data to Facebook, the user expects Facebook to safeguard it in accordance with Facebook's own promises.

 

According to most traditions, God will not tolerate being used.  In the book of Luke, when the Devil tempts Jesus to throw himself from the top of the temple to show that God the Father will keep him from being injured, Jesus replies, "Thou shalt not tempt (test) the Lord thy God." In throwing himself off the temple, Jesus would have been using God for the purposes of performing a stunt, and so Jesus rightly rejected the Devil's proposal.

 

But believers in God, those who trust in him, communicate with God by praying.  God has made promises regarding prayer, such as listening to those who call upon him, and in the person of Jesus, he has said such radical things as ". . . whatsoever ye shall ask in my name, that will I do, that the Father may be glorified in the Son."  So those who trust in God will certainly pray for things they want, but they also trust God that his vastly superior knowledge and insight will lead him to do things differently than our limited minds can conceive.  It is part of wisdom to ask God for things we want, but not to tell him how to get them done.

 

What do Facebook users expect from their communications with Facebook?  Well, nobody I know puts stuff on Facebook simply for the pleasure of seeing it show up there.  The hope is that other people will see it and react in some way that one hopes is personally gratifying, or at least useful.  (I'm ignoring the commercial and institutional uses of Facebook for the moment, and concentrating on the personal user only.)  And by and large, most Facebook users see that happen enough to keep them using it, although most people I know who have used Facebook have sworn off it for a while at least once, usually during election season.

 

How about the trust angle of Facebook?  Yesterday (Saturday, Apr. 3), a hacker published a list of some 500 million phone numbers and other personal data scraped from Facebook.  News reports say that anyone with rudimentary data skills can access this list.  Facebook says that the list was obtained through a fault that they patched back in 2019, and the data is two years old.  Still, not a lot has changed in the lives of many of those people since 2019, and the result is that everyone whose data is on that list has another increment of concern to add to the dangers of online existence. 

 

For most people, this particular breach will not have serious consequences, except to underline the fact that what Facebook promises and what Facebook delivers are two different things.  This is not a surprise to some Australians who used Facebook to share news items until Facebook decided last February that they couldn't, as a move in response to a proposal by the Australian government to make Facebook pay for news items it puts on its own platforms. 

 

Both God and Facebook share the characteristic of inscrutability.  One never knows quite what either entity is going to do.  The believer explains that God is inscrutable to us because God knows everything and we don't.  The Facebook user explains Facebook's inscrutability because Facebook is a large, physically distributed organization whose inner workings and leading personalities are obscured from the general public, and even governments have a hard time figuring out what Facebook is up to. 

 

The comparison breaks down completely when we ask about the moral character of each entity.  By definition, God is the ultimate perfection of every virtue:  all-wise, all-knowing, and all-loving.  Facebook, on the other hand, is composed of fallible human beings, and exists primarily to make money, while staying enough within the law to operate profitably in the various jurisdictions around the world where it has a presence, which is essentially everywhere on earth.  To expect perfection from Facebook, or any other human organization, is to set oneself up for disappointment.

 

So while my sympathy goes out to everyone who uses Facebook (including my wife, who called my attention to this matter) and is now that much more concerned that their use will lead to unintended negative consequences, I can't say that I'm very surprised.  Facebook data represents such a juicy target to hackers that occasional breaches are well-nigh inevitable.  Facebook spends enough money on data security to ensure that whatever breaches occur are infrequent enough not to scare most of its users away, and spending a lot more than that would probably cut into their profits severely.  The only way to make Facebook perfectly unhackable would be if it had no users at all, and that's not going to happen any time soon.

 

It may seem that I've taken 900 words to say only that Facebook isn't God.  But even the obvious bears repeating every now and then.  If we listen only to what social media organizations tell us about themselves, it is tempting to attribute God-like qualities to them:  omniscience and omnipotence, for example.  And when they inevitably mess up, such as with the latest data breach, we rightly feel a sense of betrayal.  But the Psalmist advises us to "put not your trust in princes," even princes named Zuckerberg.  And that advice is still good today.

 

Sources:  Business Insider carried a story about the Facebook phone-number data breach at https://www.businessinsider.com/stolen-data-of-533-million-facebook-users-leaked-online-2021-4.  The story of Jesus's temptation by the Devil is in Luke 4, and Psalm 146:3 advises us not to trust princes. 

Monday, May 14, 2012

To Cloud or Not To Cloud?


The other day I was working in my lab with a new student, and we ended up with a lot of image data to transfer from his laptop to mine.  Because I personally date back to the days when computer data was transferred by means of a stack of paper IBM-type punch cards, my first thought whenever I want to move or store lots of data is to resort to some physical medium:  a hard drive or flash (USB) drive, typically.  But my student proposed using a service called Dropbox.  To use it once it was installed, all he had to do was to put the data in a file on his computer.  The software sent it over the Internet to some data center somewhere, and then sent the stuff to be downloaded to my computer where I could access it in a similar file.  And it was free, at least for the first two gigabytes of data.

Dropbox is an example of “cloud computing”:  the dispersal of computing resources onto the Internet, instead of localizing your computer power in a physical box or boxes at your site.  Radioastronomers came up with one of the earliest cloud-computing applications I’m aware of, when they wrote an application to process raw data produced by SETI (the Search for Extraterrestrial Intelligence).  If you wanted your computer to help in the SETI search in its spare time, you just downloaded their app and could take comfort in the knowledge that you were one of hundreds of people all over the country helping SETI look for extraterrestrials.

Nowadays, of course, cloud computing is a big deal business-wise, as companies recognize that outsourcing a lot of their IT needs makes more sense than trying to maintain their own physical system with all the hassles that involves.  But I wasn’t aware of the ethical implications of cloud computing until I came across an article by Dunstan A. Hope and  Ryan Schuchard on greenbiz.com, an Internet publication for businesses interested in being more environmentally conscious.

It turns out that the “cloud” is, of course, no airy nothing floating around in the ether, but consists of servers, processors, power supplies, cooling systems, and (a few) maintenance personnel concentrated in “data centers” whose locations are not always public knowledge.  It’s understandable for security reasons that companies who run these centers aren’t just posting their addresses everywhere, but their geographic anonymity makes it easy to assume that the cloud really is a cloud, and has no needs for space, electricity, water, or other resources.  It’s a little like things were back before we started being environmentally conscious in general:  when you threw something away in those innocent times, you didn’t give a second thought to where “away” was.  But now we know better, or at least we should.

Large data centers run by outfits such as Google use so much power that they are located near sources of abundant cheap energy.  One estimate by the Environmental Protection Agency says as much as 1.5% of the U. S. electric power output is used by data centers.  This can be hydroelectric energy, such as The Dalles, Oregon’s Columbia River power, or coal-fired power plants in the Midwest.  It’s an open question, as far as I know, whether it’s more energy-efficient for 100 businesses to use the cloud-computing services of one data-center operation, or for them all to have their own computers in their own locations.  I suspect if the data center is run with an eye toward energy efficiency, it may be better energy-wise to use the cloud.  A new trend in data centers is to build them in arctic areas so that you can use natural cooling (basically running with the windows open, so to speak) even in the summer, rather than pay for expensive refrigeration machinery to cool the systems in hot weather.  But there are not that many arctic areas with abundant cheap energy, so there are problems with this idea too.

Besides the notion of energy conservation, there is the question of security.  I confess to an atavistic feeling that the best measure of security for my data is if I can hold its physical embodiment in my hands:  a flash drive, a hard drive, or a laptop where the data is physically stored.  But realistically, a better way to protect against data loss is to hand it to professionals who put it on multiply-backed-up remote servers such as the Dropbox people or many other Internet services provide.  I suppose some malevolent malware-writer could cause a wipeout of the data stored in an entire cloud-computing service’s files, but it would be hard, and not nearly as likely as a hard-drive crash on one individual’s computer.  I always keep backups, but backups can fail too, and there’s the bother of keeping track of the media, updating it as it goes to legacy status, and so on.  So cloud computing makes sense from a data-security standpoint.

Besides physical security, there is the question of somebody stealing data or otherwise gaining unauthorized access to it.  The banks have dealt with this type of problem since the first bank began using the first computer, and while Americans are notoriously sensitive about breaches of their personal financial data, nobody much seems bothered by the fact that your personal financial information is stored in scattered places around the country.  Of course, not all cloud-computing firms have security as good as bank data systems, but at least the precedent is there.  So I’m not so concerned about this aspect of cloud computing.

Whatever the ethics of the trend, it looks like cloud computing will be in our future more as time goes on.  If you use a cloud-computing service, you can make an effort to find out what their Power Usage Effectiveness (PUE) rating is.  This is the ratio of the total power used by the facility divided by the power actually needed by the computing equipment.  A lower number (lower than 2) is better.  And if they provide such information, find out where their data servers are, and what kind of power they use.  Even if it’s billed as a free service, somebody’s paying for electricity somewhere, and you might as well be responsible enough to find out about it.

Sources:  The article “Cloud computing raises new ethics, sustainability issues” appeared at http://www.greenbiz.com/blog/2012/04/11/ethics-cloud-computing?page=0%2C0 and was written by Dunstan Allison Hope and Ryan Schuchard.  I referred to the articles on data centers and The Dalles on Wikipedia.  And I use Google’s cloud-computing service blogspot.com to post this blog, although I always keep a copy on my laptop!