Page 49 - Privacy in a Cyber Age Policy and Practice

34 PRIVACY IN A CYBER AGE

which information collected, stored, and analyzed by a given federal agent
may be shared with other federal agents or other parties. Distribution and
access are two facets of the same process; sharing information captures
both forms of cybernation. Here, the relevant measures are (1) the scope of
limits set by laws and by regulations; (2) the volume of information that is
shared; and (3) the number of agents with whom the information is shared.
For instance, Social Security numbers were initially meant to be used only
by the Social Security Administration and were not meant to be shared
with other federal agents—let alone other parties. However, their wide use
today makes it easier to collate personal information from different sources
and draw a much more comprehensive and therefore privacy-violating pic-
ture of an individual.
To complete the analysis, it is essential to add a variable that at first
blush seems rather different; one might well hold that it should be treated
as a fourth dimension that would turn a cube composed of volume,
sensitivity, and cybernation into a four-dimensional tesseract. For first
approximation purposes, this additional variable is treated as negative
cybernation and is referred to as accountability. All the various “places”
from which personal information is collected, stored, and analyzed have
at least some barriers to use by unauthorized parties. These include sim-
ple devices such as passwords and locks on computers as well as more
powerful ones such as firewalls and encryption. Although all of these
have a technological element, human factors are also involved. Audit
trails, for example, are useless if no one reviews the records detailing who
accessed the data or determines whether the information has been inap-
propriately employed.
All accountability measures limit one element of cybernation or
another. Some limit sharing, such as making Medicare data inaccessible;
others limit storage by ensuring that data stored for longer than a given
period is erased; others limit analysis, such as by de-identifying the infor-
mation. The more extensive and effective accountability measures are, the
less cybernation occurs and the better privacy is protected. It follows that
the stronger the accountability measures associated with a given database,
the fewer privacy violations will occur even if the volume of information is
high, the information’s sensitivity is considerable, and a significant degree
of collation and analysis takes place. Conversely, if accountability is defi-
cient, more violations of privacy will occur even if volume is relatively low,
information is relatively insensitive, and collation and analysis are not
particularly extensive. This demonstrates once again that collection is less
important in the cyber age than the scope of—or limits on—secondary
usages, a ratio that is expected to continue to grow significantly due to
improvements in artificial intelligence. 70