Hello, friends and colleagues.
I chose this as the title for my talk thinking
of the following metaphor.
500 million years ago photosynthetic bacteria
in the ocean gradually changed our atmosphere to one
of oxygen. And I said, oh, what must have happened visually?
It must have been the case that we
went from a murky, obscure atmosphere to one
where you could see clearly for a long distance
like we can today-- in most places besides Los Angeles.
I don't think that was quite the case.
But I think it's a good metaphor for what's
happening with the information revolution we have now.
We can access information easily much further away
than we could before.
And this transition of the atmosphere, I think,
is sort of a nice metaphor to-- even though it's not accurate,
maybe not on this planet.
Keep it in mind.
Background reading assignment for all of you--
if you haven't seen Enemy of the State, go see it.
It's a wonderful movie.
There's a lot of discussion of privacy and illustration
of what current technology is capable of.
One of the corrupt NSA employees there has this nice quote.
"Privacy is an illusion.
We haven't had any for 20 years.
All that's left is what's in your head.
And maybe that's enough."
I don't think that's true.
I don't agree with that.
I don't think it's enough.
But we need to work in order to preserve our privacy.
Go see the movie.
What's happening?
The digital revolution reverses many of the default assumptions
we've had.
What was once hard to copy is now trivial to duplicate.
And this is having grave and tremendous consequences
for the publishing industry.
The once-familiar friend is now hard to identify online.
You get some email allegedly from your friend.
Is it really from your friend?
You're no longer so sure.
What is once forgotten is now stored forever.
You can look up everything you've ever posted
on a newsgroup in Deja News.
And what was once private is now public more and more so
as time goes on.
And that's the issue I'm addressing today.
How do we visualize this problem?
I think trying to imagine a world where
we have 100 to 1,000 times as much information stored
about everything we do is the place to start.
So imagine your personal website now has 1 million automatically
generated web pages in it documenting
every aspect of your life.
[INAUDIBLE] [? Bush ?] sort of had a image like that.
And Dave Carter talked about this kind of thing earlier,
too.
Every artifact has a website.
Everything that's ever been made,
there's a little website, a web page describing it.
Every transaction has a web page.
Video cameras have plummeted in price
to $19.95, sold on late night TV.
And they're now pervasive.
They're all over the place.
And video feeds are coming from everywhere.
You're always on camera.
And the computers track where you are and what you're doing.
So here's a website for my toothbrush.
It gives the owner, who it was made by,
et cetera, et cetera, transaction information
to current location.
Actually, this website is supported
by the computer that's in the toothbrush itself,
of course, because everything has got a computer in it.
That's one kind of information, personal information which
you may want to control, personal artifacts.
Transaction information-- here's a transaction web page
saying the purchase of that toothbrush.
So this might be information that's
maintained both by me and by the manufacturer
that I bought it from or the store that I bought it from,
and other kinds of information about it.
This is the kind of information known by two parties
that the European Privacy Directive is
so good at addressing.
What are the companies allowed to preserve about various kinds
of transaction information?
You have, on the one hand personal information.
Here's transaction information.
And then we've got, maybe, this video kind of information.
Here's the bathroom video cam saying where that toothbrush
is, sitting on the sink.
But you can imagine that these video cameras are not
just in private homes, but they're going to be all around.
We've seen this in the news already.
You'll have cameras on the streets.
And people that can be monitored very easily.
So, privacy is the issue.
Great study of privacy by Supreme Court Justices Brandeis
and Warren in 1890--
"Privacy is the right to be let alone."
And another wonderful quote--
"Numerous mechanical devices threaten
to make good the prediction that was once
whispered in the closet shall be proclaimed from the housetops."
And if a webcam in your bathroom doesn't
count as that kind of a thing, I mean,
that's really exactly what they're talking about.
More recently, we've had justices
talking about technology that breaches
a reasonable expectation of privacy
violates the Fourth Amendment, requires a court order.
So privacy is something that comes into the law a lot.
We need to define legally what we
mean by privacy, what a reasonable expectation
of privacy is these days.
I mean, that's getting harder and harder to define.
But we need to work on the technology
to enforce and enable a reasonable level of privacy,
a reasonable expectation of privacy.
So privacy is no longer the default.
You should assume everything is public
unless you've made some effort to make it otherwise.
We need to work to define what security policies we want,
who's allowed to see what, and then work to achieve those.
We don't have the natural difficulty of accessing
information anymore.
What's in a file cabinet in some secretary's office,
hard to access, has now become a website
on the same computer in the same secretary's office.
We need to establish artificial barriers where there were once
natural barriers.
So you have to decide.
Before it was default to private.
Now you have to decide what should remain private.
Who should know where you are now?
The kind of scenario that Hari Balakrishnan gave earlier,
where you can find our colleague in Greece, was great.
But if you've got a stalker after you,
you may not want your current location to be known.
Who should know what you are doing now or saying or reading?
We can implement lots of different mechanisms
to enforce policies one way or the other,
but you've got to say now what should be public
and to what extent should it be private?
Who should know what you have purchased,
when and where, where you bought your last toothbrush?
Who should know your medical history?
Clearly, that needs to be shared.
We need to think hard about the right kinds of access
policies for this information.
Who should know your voting record, something
that needs to be a bit private or whom you communicated with
or who you are?
We've got a panel coming up an anonymity that
talks about this issue.
First director of LCS, Bob Fano, wrote an article
in Scientific American back in 1967 which remains true today.
"You should have the right to decide
what is to remain private."
I think that's an important fundamental principle
of privacy.
But that means you've got to put the work in and decide
and think about these questions.
In oxygen, we imagine that the technology
for achieving the goals, once you've
decided what you want to do, will be based
on public-key cryptography.
That's really the only workable technology,
the only flexible authentication and encryption technology
in a large-scale system.
Each individual or device will have public keys.
You might have more than one if you're acting in several roles.
You might have a public key for yourself
as a private individual and another key
for your business role.
We may get to the point where messages that are not digitally
signed or authenticated cryptographically
are merely considered trash and thrown away.
This junk that comes in over the email from who
knows whom, we just toss out.
Your internet identity really then
becomes tied to your public key that verifies
the signatures you create.
And so the public key, being in some way, something
you own and control, it's almost the other way
around-- the public key defines the identity.
And you're sort of the physical appendage to it.
So the identities are to become the public keys in cyberspace.
Freshly-made public keys can be used as pseudonyms.
You can make up a new identity by creating a new public key
and starting to sign things with it.
And that starts creating a record of statements
made by that new entity.
No one knows you, as a physical person,
controls that pseudonym.
And using the pseudonym, of course,
doesn't allow other people to sign for that pseudonym.
That's the nice thing about public-key cryptography,
is you can sign things without giving other people the ability
to sign for you.
And no one can link your pseudonyms.
Only you can transfer information between them.
There's actually several students
at MIT currently working on pseudonym systems
and the wonderful things you can do with them
and developing fantastic mathematics
for these kinds of things that I don't have the time
to get into.
But it's a good research area.
So you've got the keys there.
Then access control needs to be specified.
Somehow, you need to put on a web page
or on a piece of information to tag it
with the public keys that are allowed to sign requests
for access to that information.
So the key is, in some sense, their access
to the information.
So each information object will have an access control
list saying which keys are allowed
to read it or work with it.
We have some ongoing research in the lab for computer science
on public-key infrastructures addressing precisely
that question of ease of use.
The [? SPOOKY, ?] [? SUDSY ?] systems,
if you know the acronyms, are addressed towards this question
of trying to make that easy because once you answer these
questions of who's allowed to know where you are,
you've got to somehow convey that to the computer
in an intelligible way.
And that needs to be easy to do if we're all gonna do it.
Part of the [? SUDSY ?] system that we've developed
has a distributive naming system where every key, in essence,
becomes its own naming authority and creates certificates
defining groups and subgroups of names
to be used in your security policy specifications.
And finally, a couple of issues that
come up in oxygen-- intentional naming
was mentioned by Hari Balakrishnan.
There's real security concerns I have about that
if it's not done carefully.
But I think we can handle it.
When a device says, I'm this kind of a device,
why should you believe it?
It says, I'm a fiber optic cable.
It's broadcasting its service.
If you're trying to get into a system and attack it,
you'll have people spoofing things and so on, too.
So we have the same issue that actually we
have now with applets.
When you download an applet, why should you trust it or believe
that it's--
oh, it's digitally signed.
So these things will probably be digitally signed as well.
And finally, we have in oxygen the question
of setting up a collab region that
was talked about in Hari's example,
again, of getting a group of people
together and setting up a private--
essentially a virtual private network
between them with their names being
used to identify their keys, and then
the keys being used to set up a symmetric key that's
used to encrypt all of the communication between them.
So a collab region, as a fundamental notion of oxygen
here, is actually something we think
we know how to do pretty well.
This is one of the easier problems to solve.
The harder ones are privacy and allowing
the support for the kind of access control you want.
So setting up a collab region-- you still sign your messages,
encrypt them with the group key, and so on, too.
For large groups, we have more elaborate things.
So we're moving into this new world
where things have changed.
All the defaults are different.
We have to work.
And we're getting a lot of benefit
out of this digital revolution.
Things are easy to access.
But we pay a price.
And the price is that we have to work now
to say what it is that shouldn't, all of a sudden,
become easy.
Where should we set up the artificial barriers,
the cryptographic barriers, or other kinds of barriers
against the access of information
in order to preserve for ourselves
the privacy we need to have?
So I'll stop there.
And thank you for your attention.
Well, privacy and anonymity are, as the point
has just been made, not quite the same thing.
But it's certainly a good lead-in.
We're going to soon discuss, in a panel
right here, whether the anonymous remailer
that LCS maintains on the internet,
whether that remailer should be shut down.
So please be sure to come back for that panel discussion.
We're going to take a little break just before it.
Why don't you all please come back here
by 5 minutes after 4:00?
That'd be a 15-minute break.
Thanks very much.