Debunking a myth: If you have nothing to hide, you have nothing to fear

| 6 Comments
| More

The idea that an individual can live in a surveillance society with nothing to fear so long as they have nothing to hide may, on the face of it, appear attractive. For those of us who think of ourselves as 'honest' - we pay our taxes, don't commit murders and are loyal to our partners - why indeed should we fear surveillance?

"Nothing to hide, nothing to fear" (NTHNTF) is a myth that is built on certain false assumptions, and these assumptions are never questioned when it is wheeled out as an argument to support whatever draconian surveillance measure is being pushed out in the face of citizen opposition (commercial organisations rarely try such an approach, since it dooms them to failure from the very beginning). These assumptions include:

  • Continuity: When a large data gathering exercise is started, the lifespan of the system will almost always be greater than that of its instigators. The most benign and caring government, authority or private company is inevitably subject to a change of management, and if the new executive does not share their moral stance, then data can be reused for very dangerous purposes. Those who provided data believing they had nothing to fear may find that data is misused in the future.
  • Context: Those who use the NTHNTF argument most commonly use it in the context of government collecting information about individuals. In the information age, the idea of a single entity holding that information does not hold true. The massive pressures to share information within and beyond government mean that information is constantly on the move. Sooner or later, information held by the government will be shared across the government and with the private sector.
  • Control: Whether through a sharing agreement, aggregation of databases or simply leaving a memory stick in a pub car park, information is always shared sooner or later. Information security professionals always assume a system to be insecure, and plan for when - not if - data is lost or corrupted.
  • Consistency: The most important issue is that of consistent use of accurate information across all authorities and all individuals.

Let's consider consistency in more detail. When databases work from 100% accurate information; when that information is used in accordance with the original consent purpose; when processes work correctly; when outcomes are as expected for every subject in the database; then, arguably, individuals have nothing to fear. Unfortunately, this is a Utopian state that is never achieved in a real world system. We see numerous examples of this problem:

  • Take the extreme example of Khalid El-Masri. This German national was kidnapped, flown to Afghanistan, tortured and then eventually released when it was realised that his was a case of mistaken identity, and he was not in fact an alleged terrorist with a similar name.
  • In 2007, junior doctors found their personal information - including sexual orientation - published on the Internet in a web security breach. How many of those individuals were 'outed' as a result of that breach? Those who had kept their orientation secret from their families or colleagues were perfectly at rights to do so, but found it released anyway.
  • In 2006 a student was wrongfully arrested for stealing mail when a batch of letters were recovered. His fingerprints - which had been taken a year previously when he was accused of criminal damage but released without charge after the real culprit confessed - matched those on some of the letters. After his arrest it was discovered that the letters bearing his fingerprints were posted by him. He was released, and then had to campaign to have his DNA data removed from the National DNA Database.
  • Time and again individuals have been fired from jobs, or failed to get jobs, because of errors in the Criminal Records Bureau database. They have been stigmatised as criminals, even to the extent of being falsely branded as sex offenders, because of database failings.

This sort of mistake might seem rare, but it is going to become increasingly common. Police cars are being fitted with fingerprint scanners, and it seems to be only a matter of time before they can even check DNA on the spot. Systems will make mistakes, and procedures will go wrong. The victims of the benign database state are those who aren't treated in accordance with the intended rules, but are at the wrong end of breakdowns in data accuracy, procedural rules or system errors. Under a benign government, it's not the intended surveillance that makes victims of innocent people, but the errors.

So why do I fear the idea of a database state, even when I have "nothing to hide"? Well, I do have things to hide. Everyone has things to hide. If I have a serious health concern, I want to be able to consult my GP without worrying my wife. If I'm looking for a new job, there is no reason why I should have to reveal that to my employer. In fact, if even I've committed a serious crime, been convicted, rehabilitated and paid my debt to society, why should I be obliged to reveal that history to my neighbours if I pose no threat to them? Should my friends know if I've got an unauthorised overdraft, or if I've downloaded perfectly legal adult content from the Internet? I've done none of these things, and am in no particular rush to, but I demand the right to privacy if those situations arise.

"Nothing to hide, nothing to fear" is a myth, a fallacy, a trojan horse wheeled out by those who can't justify their surveillance schemes, databases and privacy invasions. It is an argument that insults intelligent individuals and disregards the reality of building and operating an IT system, a business or even a government. If ever you hear someone at a dinner party crank out this old chestnut, grab your coat, make your apologies, run fast and run far. And as William has said before, I wouldn't want to be stuck at a dinner party next to someone who has nothing to hide - imagine how dull that would be.

6 Comments

  • One of the more cogent and coherrant exposes on the "NTHNTF" myth.

    One of my chief concerns (and I have many) regarding the emergence of what Guy Herbert from the campaign group NO2ID calls, "The Database State", is that its development is inextricably linked to with notion that as good citizen's we should be required - indeed expected - to constantly proove: (a) that we we're good - i.e., that we behaving in a socially acceptable and socially endorsed manner and (b) that whatever we may ask for from the state, we are in fact entitled to ask for it. That is, that we must first proove our entitlement. Only by constantly monitoring us, under a constantly operating regime of surveilance may we achieve this and in the process, weed out those who aren't entitled and those are are deviant and dangerous to society.

    Such a view profoundly confuses the distinction between entitlement and privacy and is symptomatic of the move towards to emeregence of a totalitarian state. It is my view my view that we in the west are already well on the way to a new form of post-modern totalitarian state (what Guy Herbert calls 'soft fascism') in which behaviour and opinions which are disapproved of by the political class are pathologised and then regulated by violence-backed laws "for your own good' or "for the children" or "for the environment. The emeregence of the surveilance state is simply the icing on the cake if you like of the development of an infrastucture designed to orchestrate social control. Resonating strongly with the warnings Orwell extols in his book 1984, it's obvious how the more information you have about citizens, the more you can control what they see, hear, think and ultimately do.

    What's essential, somehow, is to get across the idea that you are entitled to be anonymous in going about your lawful business. I think that this is close to being a fundamental principle of a free society under the rule of law: because we ought to be treated equally in equal circumstances, an enquiry into who you are ought to be considered unacepptable in any casual transaction because it ought to be irrelevant.

    Compare those rules in effect forbidding employers from asking female candidates at interview about their plans for children. Because the inquiry implies a discrimination on grounds of personal characteristics that it is thought ought to be irrelevant, it is barred.

    The very fact of formal inquiry as to your identity - rather than the relevant characteristic - implies that we are not equal before the law and places you in the position of a personal supplicant, not a customer or equal citizen.

    Beyond the reasons already articulated, one can easily think of persons who do have aspects about themsleves that they would arguble have completely legitimate reasons for wanting to keep secret. To give but a few examples:

    1) People with "socially unnacceptable" illnesses who would not want that information shared outside professional medical contacts.

    2) People fleeing domestic violence who do not wish to be traced.

    3) "Spent" criminal convictions - although that's already largely redundant. Very little is spent these days.

    4) People who do not want their living arrangements made 'public' (ie. people living alone would become increasingly vulnerable).

    5) journalists protecting sources who are uncovering corruption

    6) political activists may wish to hide sensitive personal information from the govt that might be used against them

    7) scientists who perform experiments on animals who may wish to hide their details from militant animal rights activists

    8) some people may be wary of publicising their religion lest they get persecuted for it.

    Do the innocent really have *nothing* to hide? What about their sexual acitvities? Bank details? Medical records?

    If someone says the blighted phrase to me...my usual reply is:

    "Then you won't mind me comming round to to your house to search through your bedroom draws after which I'll then install a CCTV camera in every room in your house." After all, you've said you have nothing to hide!

    We are, of course, fighting for the principles - presumption of innocence / right to privacy - but I have found that some 'nothing to hide' folk can be made to think twice when you point out how easily they could become a suspect in a database state. As easily, say, as getting a letter addressed to the wrong person at your home address - and who's not experienced that at some point?

    Wihtin the database state, it's not what whether you think you've done something wrong, it's whether *they* think you've done something wrong. And if they control your identity, how are you going to prove your innocence - when it's your ID that will have drawn you to their attention in the first place?

    You may have been pulled in because you were tracked to a certain place at a certain time (Gordon Brown's sharing of retail data with the police...), or because your behaviour fits a 'profile' or deviates from some definition of 'normal'. Or because the technology simply isn't up to matching amongst 50 million fingerprints, and the police will - despite all assurances - be allowed to go on 'fishing expeditions'. How many Shirley McKies will it take to explode the fingerprinting myth?

    'Nothing to hide, nothing to fear' cuts right to the heart of civil liberties - those things which protect us from the arbitrary exercise of power by the authorities. There is nothing more arbitrary than assigning a person an official identity and then treating them as nothing more than a number, or piece of data to be matched.

    The assertion that "if you have nothing to hide you have nothing to fear" is no different from saying "if you're not with us, you're a supporter of the terrorists". How best to put this across? Would a simple statement to that effect be enough? It splits everybody into either "innocent" or "guilty" (by which jury?) with no consideration for "not under suspicion" or "never even accused".

    The difficulty is with constructing a similar enough (and short!) false dichotomy which whilst potentially plausible at an extreme, shows unequivocally that the argument of 'nth-ntf' holds no value.

    The argument is a particular species of false dichotomy. You are presented with a simple either/or choice. Either you’re guilty, and so should be exposed; or you are innocent, in which case nothing will be exposed, and so you have nothing to worry about. Either way, you have no legitimate reason to be concerned. Like all false dichotomies, the problem is that there is at least one more option than the two offered in the either/or choice.

    The most common retort against privacy advocates - by those in favor of ID checks, cameras, databases, data mining and other wholesale surveillance measures - is this line: "If you aren't doing anything wrong, what do you have to hide?" Well the answer, as I hope I've been amble to demonstrate, is "everything."

    Here follows some clever answers to the aformentioned question:

    "If I'm not doing anything wrong, then you have no cause to watch me."

    "Because the government gets to define what is unacceptable behaviour, and not you or anyone else."

    "Because you might do something mistakenly with my information."

    My problem with quips like these answers - as right as they are - is that they accept the premise that privacy is about hiding a wrong. It's not. Privacy is an inherent human right, and a requirement for maintaining the human condition with dignity and respect.

    Cardinal Richelieu understood the value of surveillance when he famously said, "If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged." Watch someone long enough, and you'll find something to arrest - or just blackmail with. Privacy is important because without it, surveillance information will be abused: to peep, to sell to marketers and to spy on political enemies - whoever they happen to be at the time.

    Privacy protects us from abuses by those in power, even if we're doing nothing wrong at the time of surveillance.

    We do nothing wrong when we make love or go to the bathroom. We are not deliberately hiding anything when we seek out private places for reflection or conversation. We keep private journals, sing in the privacy of the shower, and write letters to secret lovers and then burn them. Privacy is a basic human need.

    A future in which privacy would face constant assault was so alien to the framers of the Constitution that it never occurred to them to call out privacy as an explicit right. Privacy was inherent to the nobility of their being and their cause. Of course being watched in your own home was unreasonable. Watching at all was an act so unseemly as to be inconceivable among gentlemen in their day and yet as a nation there are more CCTV cameras here than anywhere else in the world. You watched convicted criminals, not free citizens. You ruled your own home. It's intrinsic to the concept of liberty.

    For if we are observed in all matters, we are constantly under threat of correction, judgment, criticism, even plagiarism of our own uniqueness. We become children, fettered under watchful eyes, constantly fearful that either now or in the uncertain future patterns we leave behind will be brought back to implicate us, by whatever authority has now become focused upon our once private and innocent acts. We lose our individuality, because everything we do is observable and recordable.

    How many of us have paused during conversation in the recent past since 9/11, suddenly aware that we might be eavesdropped on? Probably it was a phone conversation, although maybe it was an e-mail or instant-message exchange or a conversation in a public place. Maybe the topic was terrorism, or politics, or Islam. We stop suddenly, momentarily afraid that our words might be taken out of context, then we laugh at our paranoia and go on. But our demeanor has changed, and our words are subtly altered.

    This is the loss of freedom we face when our privacy is taken from us. This is life in former East Germany, or life in Saddam Hussein's Iraq. And it's our future as we allow an ever-intrusive eye into our personal, private lives.

    Too many wrongly characterize the debate as "security versus privacy." The real choice is liberty versus control. Tyranny, whether it arises under threat of foreign physical attack or under constant domestic authoritative scrutiny, is still tyranny. Liberty requires security without intrusion, security plus privacy. Widespread police surveillance is the very definition of a police state. And that's why we should champion privacy even when we have nothing to hide.

  • If ever you hear someone at a dinner party crank out this old chestnut, grab your coat, make your apologies, run fast and run far.
    Alternatively suggest they Google "data abuse" and click on the first link.
  • And a point rarely mentioned: what if you DO have something to hide? You're an undercover cop. In Witness Protection. Fleeing an abuser. Were the victim of a crime. Had prosthetic surgery to correct a harelip. Were treated for depression after losing a family member.

    And "the data will be protected" is silly. Look up the UK experience with their RIPA data. Originally, the data was limited to a very few law-enforcement and/or anti-terrorist government organisations - but after less than a decade, hundreds of agencies get access - for fighting such horrible crimes as putting out your rubbish bins the night before collection rather than getting up at 5AM to put it out before the 7AM pickup. And that is legitimate, as in government, access - leaving laptops or USB sticks with unencrypted data on the bus is far from unknown.

  • It's the best time to make some plans for the future and it's time to be happy. I've read this post and if I could I wish to suggest you some interesting things or suggestions. Perhaps you can write next articles referring to this article. I desire to read more things about it!

  • Hi there! This is kind of off topic but I need some advice from an established blog. Is it very hard to set up your own blog? I'm not very techincal but I can figure things out pretty quick. I'm thinking about making my own but I'm not sure where to start. Do you have any points or suggestions? Many thanks

  • Leave a comment

    Disclaimer

    The views expressed in this blog are my own, and do not necessarily reflect those of any client or other organisation.

    Subscribe to blog feed

    Archives

    Categories

    Toby on Twitter

      Recent Comments

      Burgess21GWE on Privacy bears its fangs f... : Essays Empire organization for available informat...
      Traci34Higgi on Debunking a myth: If you ... : My advise to you is that I will usually strive to...
      Vivian33Rosa on Debunking a myth: If you ... : click here if you would like to buy research paper...
      David Moss on Postcodes, PAF and Pseudo... : 1. In view of the above, amused to remember earlie...
      Wayne Scott on Postcodes, PAF and Pseudo... : It’ll be tough with the current mail sortation tec...
      David Moss on Could Identity Assurance ... : I agree with Philip. To adapt Crosby's marvellous...
      Philip Virgo on Could Identity Assurance ... : Thoughtful as always but what about the lack of tr...
      Steve Wreyfo on Could Identity Assurance ... : Interesting post Toby, as ever, though needs to be...
      David Moss on Real Time Identity?... : This article originally appeared in the ICAEW's Ch...
      Lance Piper on Identity Assurance: Risk-... : Quarkside published some ideas for finely tuning l...

       

      -- Advertisement --