The future of data security

I recently spoke to an incredibly wise co-worker who shared with me his vision of data security, and his explanation was so insightful I couldn't help but share it with you all.

Securing our data

Our data has no value

Today, a fundamental problem is our data has no value. Let me explain why this is a problem. To choose an example, when we use Facebook, we offer the platform access to our basic data (gender, age, name, other attributes we choose) as exchange to use the service for free. This is fair, or at least most of us would come to believe. I would certainly consider an alternative if I had to pay to use Facebook.

Regardless, this information about ourselves gets used ad infinitum in algorithms that match advertising ads that may be most relevant to you on Facebook, even when you aren't on Facebook. As your information is shared throughout Facebook (to show you ads), what additional value are you getting? What benefits are you getting from the companies who are indirectly using your information to show you ads?

I'd like to propose that you are getting nothing. The company will say that it is offering you "personalized ads," but there is more under the covers. You are giving your information away for free* without receiving any benefit besides seeing ads for products you may not need.

*Of course, buried somewhere in the terms of use is this, in legal jargon, that no one reads anyways because don't we all just click the "I accept" button?

I agree to say yes to things I have not read

Facebook isn't the only one that does this, Google does it too. Most any products that are of this vain are sharing your data without giving you anything in return beyond the initial services they provide.

Are you okay with that?

Ask yourself, are you okay with giving away your information for basically free? Or, to put it another way, are you okay with throwing away your personal value?

Burning your own value

Companies pay to get data from customers, why are you giving it away for free? 

This is called market research, where companies go out and pay users for their opinions. 

Sure, some of the money goes to upkeep the services, but how else do you really think Google is able to offer such great salaries? (They sell your data for free* and profit from it. *You of course agree to this also in their terms of service).

You are not in the best interest of the company

This is another problem today. Your personal data is being protected by companies because they have to. They need your trust in order to stay in business. Even with sweeping new regulations, companies are still catching up with data protection. I don't think that because companies are told to comply to protect your information, that they are the best advocate for protecting your data. Consider recent hacks, and how much harder it is to protect your information if every company has copies of it. 

Don't let me ask you if you have worked at a company where personal data has been compromised and you brushed it under the rug, or are not correctly protecting credit card information; the list goes on and on..

The more companies you share your information to, the more vulnerable you are to losing potential value due to data breaches, hacks, or bad security [mal]practices.

How do we secure our data better?

We take a bit of our knowledge of OAuth, jwt, nonce and blockchain concepts to secure our data.

Forewarning this is not fully technical in nature, so take it as an exercise on your own how to connect these dots. Again, this article is a theoretical explanation what we can do to make our data more secure in the future.

Because we can't trust companies to protect our data for us, who can we trust? We can trust transparency, and the blockchain offers us transparency. Acting as a public ledger that cannot be forged or altered, the blockchain can store our personal data. (Similarly how the blockchain can hold the bitcoins we own if we were in on that craze). We can store all information about ourselves in here; address, phone numbers, height, weight, etc.

The data is encrypted of course, and the way we can prove we own the data is through our private key/token.

Great! Now no one can access our data without our private key, but how to we share it to those we trust? Or, as an example, how might we share our address information to Walmart when we checkout online and want to ship the goods (but not let Walmart know it is us purchasing the goods?). For this scenario, my coworker envisioned a token that is generated (similar to OAuth) that would be given to Walmart, perhaps with some address and payment claims (jwt-like) that would only give the bearer of the token access to the address and payment information that is linked to it.

This token would be linked to my data in the blockchain. Walmart would pay some nominal amount in order to access this data in the blockchain, mostly for bookkeeping purposes (to keep the lights on - the blockchain needs constant processing to stay maintained), perhaps some of it goes to you, the owner of the data itself?

Walmart would be able to see my address and payment, and complete the order on their side. Using some nonce, the token that Walmart just used would become invalid and would no longer return any information about my address and payment to anyone else who happened to get their hands on my token.

The order would be sent to UPS, and through some process, I would authorize another token, this time just with my address claims onto UPS. Once UPS used my token, UPS would know nothing about me, except where to drop the package off at my front door. I would get my package, and neither Walmart nor UPS would be holding my data, nor who I am (protecting my identity). 

The whole series of handoffs of my data is publicly stored in the blockchain, so I can see any party who used my information.

The resistance

Obviously, the government would not like this anonymity. Companies would not like this either, as they are greatly profiting of your data today. 

How might you incentivize parties to help convince and implement better data security for everyone?

Thank you

Thank you for reading this blog post, I hope it inspires future data scientists.