The ability of any company to 'mine the mosaic' of personal data has consequences far beyond individuals' privacy

An imminent report on an emerging threat to individual privacy to be issued by the European data protection authorities raises even more serious issues than those it is likely to address. The report will consider Google's asserted right to expand its data mining to combine users' personal data across all their accounts and services, including Gmail, internet searching, map and location information and photo sharing, with no way for individuals to opt out. At least one technology blogger has accused Microsoft of planning similar changes, while two new Facebook programmes to aggregate user data with other advertising and loyalty card data have also drawn concern. Whatever the merits of each case, the larger issue deserves greater public attention.

There is a powerful reason why cloud services and other data-mining companies aggregate data across multiple accounts and services: the results are extremely valuable. Just as tiny bits of coloured tile can be combined and transformed into a coherent piece of art, tiny bits of seemingly unrelated personal data, when aggregated and mined at huge scale, can provide immense value to advertisers, marketers, corporate sales forces and others. The revenue generated by combining and monetising such data – by mining the mosaic – is the reason "free" cloud services can afford to be free.

Privacy groups and regulators are appropriately concerned with threats to individual privacy inherent in mosaic-mining business models. Less noticed has been the potential use of these same tools and techniques against government employees and, potentially, governments themselves. But is this a more serious problem and, if so, why? The privacy rights of government employees are no more or less important than those of private citizens. Beyond individual privacy, however, consider the national security, government integrity, and even personal safety implications.

What if, instead of using the power of mosaic mining to identify a potential new customer, it was used to identify an undercover intelligence operative? Multiple map queries starting at a known intelligence agency's headquarters instead of the work address on an operative's business card, might suggest their true job, even if those queries were conducted from their personal computer. Such a scenario is neither hypothetical nor attractive just to adversarial intelligence services. American lawyers defending Guantánamo inmates provided surreptitiously obtained photographs of undercover CIA operatives to their clients. Whatever the lawyers' motives, imagine how much more could be done by those motivated to out covert agents, if they mined today's mosaic of private and governmental information.

What if, instead of mining the mosaic to anticipate a company's office supply needs, data from across individual and government accounts – email contents, internet searches, travel plans – were used to anticipate a government policy decision or treaty negotiating position? What might the geolocation of a cop's personal laptop for several consecutive nights reveal about a stakeout? And what pressure could be put on government decision-makers by someone armed with video download receipts, browser search records or credit card statements?

These risks do not assume ill motives on the part of cloud service providers, although we must assume that there are at least a few such companies around the globe not particularly diligent about selling amalgamated customer data. But no company can hope to block all ill-motivated insiders or skilled hackers. Massive databases of aggregated personal and governmental data would present irresistible targets.

Beyond such security concerns, what European data protection authorities are confronting is an early, but vital, test of whether governments will continue to control their own data.

Governments considering deployment of cloud computing solutions should consider several steps to mitigate these risks. The first step is awareness. Law enforcement, security and other governmental organisations should consider carefully the ramifications of a private entity being able to aggregate sensitive data across government, and their employees', private accounts. Second, governmental entities should not accept generic provider privacy policies, but should demand government-specific agreements prohibiting data mining.

Governments also should insist that data-mining capabilities be technologically disabled from use against their data. Providers whose business models are so dependent on data mining that they cannot compete for government business without it may have to stick to the many lucrative non-governmental markets. Beyond this, governments should ensure they can determine independently whether vendors are living up to no-data-mining assurances. Finally, governments should provide their employees with awareness training about the risks of data mining of their personal and governmental accounts – a prudent measure whether or not cloud solutions are deployed.

Personal privacy is vitally important. But if governments do not address the national security implications of mining the mosaic, we may soon look back with nostalgia to when personal privacy was our only concern.

Bryan Cunningham © 2012 Guardian News and Media Limited or its affiliated companies. All rights reserved. | Use of this content is subject to our Terms & Conditions | More Feeds



Who's Online in Technology

We have 8 guests online