Privacy by Indolence
I know it doesn’t have the same dactylic rhyme as “security through obscurity”, but the discussion we led at #cetis12 really drove home to me the fact that a lot of people rely on the laziness of others to remain private.
It turns out that a lot of people give away more data in reality than they say they would if you asked them. It’s called the privacy paradox. Many of the people who claim they want to remain private still post all their photos on Facebook and use Google for search, despite it being well known that they both harvest and hoard immense amounts personal data.
Some of this can be put down to people not knowing or reflecting on how things work behind the scenes, but I think there’s an element of expected behaviour from other people and relying on their laziness to keep our data private.
I have reached this conclusion by the reaction people have to making access to data easier. That is one of the fundamental aims of the Southampton Student Dashboard after all. Even though the data is accessible in one way or another (whether it is virtually trudging through Banner Self-Service or physically trudging down to student services to view the paper copy of a student record), people immediately raise privacy concerns as soon as you present an accessible interface to it.
An example of this came up in the discussion. One group were asked what directory information should be available on the University intranet, and the issue of photos was hit upon. When we ask the potential users of the Dashboard what information would be useful to them, photos are always high on their list. However, one of our participants countered with something along the lines of: “if students want others to see what they look like, they put photos on Facebook, just go look there”.
Well immediately that begs the question, if it’s already openly available, why make someone go to more effort to see your photo, unless you are hoping they will just give up and not bother?
I am a teaching fellow in Electronics and Computer Science, teaching modules on the Computer Science degree, Information Technology in Organisations degree and Engineering Foundation Year. I studied my undergraduate degree and PhD at the University of Southampton, and loved it enough to stick around :-) My research is in the area of Technology Enhanced Learning, including methods of adapting teaching resources to the student and novel approaches to teaching programming.
It is my opinion during the co-design process users should never be allowed to speculate on ideas of privacy or licensing until they have a well featured system in front of them. Users always have ill considered knee jerk reactions when confronted by these issues. Ten users in a room will argue themselves round in circles. The fact of the matter is you are a very capable and well informed professional and they are usually not. You wouldn’t let one of these people fly a plane or be a military stratagist without training and this should be no different. They simply are not qualified to make decisions of this nature. You can give justifiable reasoning for your default privacy selections. Always make the default the behavior you want people undertake. Once they have the system many people will realize this what they wanted, some will be discontent but not so discontent as to spend 5 minutes changing it and very very few militant people will change the defaults.
Your system should not disable people from having the behavior they want but it should assume the behavior you want.