The Repatriot Act

[therepatriotact-blog]

Surveying the herd and theorising the barn

If you've never thought about information security then before spending a week googling it then returning to day-to-day Facebook and Gmail is like waking into a nightmare. While both services make laudable efforts to secure their users data (including from their own government) it seems that not even the most benevolent of tech monopolies can guarantee protection from malicious intrusion, be it from a slip-up, attack or indeed sloppy user behavior. As they say, information just wants to be free.

However despite any real experience of herding techniques to speak of I'd say the first step to securing a herd of free-range data is to know roughly how many there are and in which fields they be a' grazin'. In short; a head count of online services that I entrust my data to is in order.

So as it stands now, the services I use that store (or indeed constitute) my personal data, in no particular order are..

Facebook

Tumblr

Google (Mail, Calendar, Contacts, Google+, Youtube, Picasa, Docs, Chrome, Chrome Sync (bookmarks, password etc), Reader

Dropbox

Springpad

Wunderlist

Flickr

Internet banking

A few work email clients/servers (with Imap/pop)

Android Apps: (Gmail, Greader, Gcalendar, Messeging, Call Log)

Seeing this list for the first is both consoling and a worry. On the one hand, like most problems, it looks much smaller and manageable than when it was just swirling around in my head. Running through this list and either securing, swapping or removing each of the 23 services seems pretty straight forward. However I start to worry about fueling rampant complexity when I throw in two more demands beyond security. Firstly (following my week of paranoia-fueled googling) I have a sneaking suspicion that Google will be complicated to secure or swap and near impossible to remove. While others might disagree , I have quickly come to understand Google to be an enterprise that revolves solely around 'utilizing' your personal information. While this will no doubt consume a few blog posts in its own right, for now I can only say that Google certainly appears to challenge my idea of secure data storage and as such I can imagine that following my mission with real zeal might involve saying goodbye to some of the best free online services around. *tear running down cheek*

The second problem I see with this list of services is that changing any of them will be complicated by my mobile lifestyle and choice of operating systems (note the plural). Syncing data between devices is also something that will at the least become a more complicated affair if some or all of the Google services get the chop.

So having surveyed the herd it's probably also a good start to finish by outlining (or should I say theorising) what I would consider to be a secure storage barn or service for mt precious flock given with my current, albeit rather slim, understanding of information security. Of course after reserving the right to sneak in a few edits when I wise-up to gain perceived credibility, I'd say that in general personal data is secure when:

It's backed-up across multiple hardware and location

It's only accessible by only those that the owner wants (both now and in the future) and..

It can be deleted and edited at any time

Having simple three criteria feels good although looks can be deceiving and the devil is usually in the detail. In this case I can already see the second criteria could possibly entail a Phd in cryptology if I'm not looking to become a cyber hermit. However quick searches suggest that there are no shortage of paranoid geeks out here offering ingenious  (and often open source) solutions to more than the most common security problems and at the end of the day, as they say in the encryption business, "j6F!99dj35d!L2!".

[therepatriotact-blog]

Your paranoid mission, if you wish to accept it..

By way of an introductory post, I feel a little history is in order here. I decided to start this blog as both a means and end to a particular problem I've encountered and as such the posts that follow will make much more sense, dear reader, with a little of the context from whom they were born. So first, a little about myself then to a recent epiphany.

I'm what I consider to be an everyday citizen 2.0 in a couple of regards. Firstly, I have no formal education in anything computer wizardry. Sure I've used loads of software both at home and work but I know nothing beyond what happens when I click buttons; I'm a well-traveled computer newbie. With that said, I do my fair share of clicking and on a few different systems at that. My laptop is dual-boot linux/windows, my desktop at work is a mac and my phone runs android. However, like most people I believe, I'm in the dark about anything beyond glossy user interfaces.

Secondly, I have loads of digital baggage, much of which is online. Beyond emails and Facebook I have photos, documents, music, contacts, calendars and other files all strewn across the web on different services and servers. Some of it, such as this blog, is public while other forms, like my email and Dropbox account, are (hopefully) more private. I feel like I have a rather good grasp of the content and visibility of data on those services that I regularly use however I also have a rather hazy breadtrail of old services that continue to store my data that I've lost track of. In this, like my aforementioned degree of computer nous, I think I lie somewhere near the norm for a middle-class European under the age of 45.

For over twelve years online had always assumed the online data by or about me was either worthless or secured. Worthless in that no one was interested in it or safe i that I had to punch in a password before looking at it. So while I occasionally changed passwords on my Google account I put no real energy into securing the stuff I put online or thought into what happened to my 'worthless' data like on social networks. I thought I was not of interest to anyone so neither would my personal data be of interest to malicious online parties. 

However (and here comes the apparition part) all this changed last Tuesday when I read an article regarding an EU citizen's successful attempt to get hold of all of Facebook's dirt on him (which happened to include deleted messages and rejected friend requests). Perhaps, like most, I immediately thought of how spooky it is that a company stores such extensive files of personal information about us all. However after 'liking' it on FB and defriending a few weirdos I forgot about it: I'll happily swap some spook for social. Next day I caught onto a story about a hacker sharing details of 90,000 email addresses though hacking a blogging service here in Sweden. Most of these people were nobodies, like me, and now their private email was barely that. Not good.

Now curiously concerned I started googling for similar incidents which soon ended, as often happens when googling answers to personal problems, cradling my shotgun in a rocking-chair awaiting the inevitable. Is the security of any of our personal data in our control when online? Beyond google reading our mail, facebook selling our identity and the US government doing thatever the fk they like, the fact that storage is cheap means that not only do we rely on services protecting out data now but also indefinately. The gmail I send today might be hacked in 20 years and while that might not be a big deal for me right now two facts are really worrying. Firstly, I dont know who I will be in 20 years and I don't know what being able to access my past (thanks to an inevitable security breach) might mean. While my cynicism surely rules out politics, even a job interview might be awkward knowing my would-be boss had just just googled what I smoked back-in-the-day.

While it's easy to say 'if you don't want anyone to know, don't do it' the fact is that a minimal online presence is unavoidable these days yet some degree of privacy will always be advantageous. What I need is an information security spring clean; to repatriate my scattered collection of information and make sure what should be save really is.

So as such I set forth on a mission to 'lockdown' my digital data, starting from a position that really couldn't be much more in need. I plan to identify the current mess of my digital data (both on- and off-line) and set about making it as secure as feasibly possible while all the time documenting it and rebuffing the hovering threat of paranoid schizophrenia that the internet has a habit of fueling. I'm not exactly sure how long this process will take. However assuming the current depth of my ignorance and the extent of my online life, I think it's safe to talk in months rather than days. However all being well it will end with a healthy practice of getting the best of 'the cloud' while protecting my identity from the best the future can throw at me.

But why the hell start a blog if your worried about online privacy? A fair question, but firstly because I certainly don't have anything against sharing data online per se. Quite the opposite- I wonder how I would survive not doing it these days. However part of what I think a proper personal online 'lock-down' should involve is to determine what information one wants to be public (such as a blog) before adequately securing the rest. Secondly, because, as cliche as it sounds, I have looked somewhat thoroughly for online guides and discussions about 'leaving the cloud' and online security and only come across blogs and article that either deal with swapping-out individual services or are (openly or otherwise) sponsored by commercial security products. While learning to change email hosts or use trucrypt with Dropbox is useful, I'm yet to find a site or discussion focused on a transition from my recent les-a-fair, happy-go-lucky approach to cloud computing to one of relative security. 

I also recon that if I manage to successfully exercise my paranoia and secure data across my multi-platform/device/location situation without any formal training then it might well benefit (I dare not say inspire) others if I document my mission. To this end I also think documenting my effort will push me to actually go through with it to the sweet end (I'm a sidetracker by nature).

Finally, I think any attempt to gather information is easier in numbers and as such the possibility of getting feedback, advice and guidance from others using a blog is too good an opportunity to ignore. And of course if anyone can point me in the direction of a blog of this sort thats actually been written and/or convince me I'm paranoid beyond reason do let me know and I can stop wri....