Lately I’ve been mulling over some thoughts concerning the future of security, privacy, and how it relates to data records. This post will present some ideas for you if you do not know where to start when it comes to cyber security or are looking for ideas on how to keep you and your family’s private data secure.

The problem

The problem with record-keeping as related to privacy and security is a passive one: there’s no immediate threat which provokes acceptance. I.E. “I need to get this book for my friend’s birthday, so I’ll go ahead and sign up for this account at this online store, and perhaps I could always close my account in the future.”

Bam, you’ve just spread private information to yet another database somewhere.

A blast from the past

Let’s take a blast from the past. 100 years ago, nobody had any personal information on computers; instead, presumably, we killed more trees and used paper for any type of record keeping. Paper is not “connected” or networked to the Internet in any way, so this meant that unless someone went out of his or her way, there was at best one copy of your information lying around in one location and at worst, a few copies, but still a finite number. Also, in order to obtain the information, an attacker would need to do one of several things:

1. Coerce someone who had access to the paper to make a copy of it or take the original from the workplace and provide it to them. This could obviously be done in many ways including bribery, threats, etc.. This includes mailing or smuggling a physical copy out of the office.

2. Physically go to the location and gain access to the paper, copying it and putting it back or stealing the original.

3. Get ahold of it by some other means – ie finding it when a mail carrier lost a letter, it blew away in the wind and someone found it, a business failed to properly destroy it via shredding, etc…

4. Get a person who has access to the document to call them on the phone and read the sensitive information to them.

How computer-stored data differs

Now, let’s look at the computerized or “digital” world, where there are several major differences:

1. There’s virtually no practical limit as to how many “copies” of a document can be made. Modern document files have nearly negligible file sizes in comparison to disk space. For example, a 500GB drive can store over 25 million copies of a 20kb Word document file, taking into account of 10GB dedicated to the operating system. Try doing that with paper records. This doesn’t even include the cloud and servers that everyone has access to.

2. No physical presence is needed to obtain or copy the document, and since all computers can be compromised by zero day exploits, social engineering, malware, bad passwords, and other bad security practices as well as broken cryptography algorithms, this simply reduces security of the document and increases the chance that an unauthorized party can get their hands on it. This also means that potentially more threats can be attacking the victim. For example, if I have sensitive data on my machine and one attacker writes about it on social media, potentially, that same day, there could be any number of individuals, up into the thousands, attempting to attack my data in a few moments notice and the repercussions for this attack with current legislation would either be none or much less than if 35,000 people tried to break into my office at once, physically. With prior technology, unless there was a television broadcast or newspaper article, this was not likely.

3. In recognizing point number 2, secured computer systems use cryptography in order to turn the sensitive data into gibberish called ciphertext such that if an attacker is able to snoop the information, it will not be legible and he or she will receive gibberish. While cryptography was absolutely necessary and used (primarily by governments) with physical paper documents a while back, because a simple letter was not exposed to potentially unlimited numbers of attackers by traveling across the Internet to computers in unknown locations and in other countries, the need for cryptography was not part of the daily lives of as many people. Whereas now, the average joe uses every day. In fact, if you’re reading this blog post, you’ve just used it (note the HTTPS and padlock in the address bar of this site).

4. This means that the burden of message security, instead of relying simply on the security provided by paperwork via snailmail, now relies on password strength, software developers, computer hardware manufacturers, internet service providers, anti-virus and anti-malware vendors, IT administrators, the computer user’s technical knowledge, and many many more fronts that I haven’t even mentioned. So, in the example of a paper document to an electronic document, we went from your hands to the employees of the postal service, to the hands of people at an office to now all of these intricate and complex systems that are too technical for most end-users to understand. A simple analogy is going from living with one significant other who has only a couple friends and one house key, to living with 25 roommates who each have 15 friends and 2 housekeys each; the transience provides a much higher chance that someone will gain unauthorized access to the property.

Cryptography – a major piece of the puzzle

A significant portion of the burden of security for messages and data transmitted digitally relies on cryptography. In other words, the strength of today’s cryptographic algorithms is what protects much our data transmissions from prying eyes. Unencrypted messages are so insecure that all it takes is a person with a computer, a network card, and a simple program to read everything in the message and even assume someone else’s identity, as demonstrated by the FireSheep browser extension¹ used primarily on public wi-fi.

Cryptography is complex. However, it is known that all mainstream cryptographic algorithms which are used to transmit our sensitive financial, legal, and other private information are in fact breakable. These algorithms rely on the fact that in present day, it would take an unreasonably large amount of computer processing power in order to break into the protected data or message. The concern with this is that there is no real way to predict the computing power of the future, and in the past, they’ve been way off.

For example, RSA-129 was said to take 40 quadrillion years, using the best computers and algorithms at the time, to break. However, it ended up only taking 17 years². Quite a difference.

Another example of this is quantum computing. Quantum computer theories are getting more and more traction, and while most of us are not likely to be walking around with quantum computers in our pockets any time soon, even just one big machine could be weaponized and used to easily break any current encryption standards such as AES-256, RSA, Serpent, and etc³…

This all sounds cool, but how is this an actual threat? Well, the issue is that the current trend for companies and other organizations is to track and store as much data as possible; they’re being told that the more information they have about your users, the more money they can make from them and that they can provide better services when they better understand the customer… Which of course means they want to collect as much information as possible. In the best case, this information is secured using the secure algorithms of today. Meaning, as soon as computers get faster or are otherwise able to handle a greater workload of number crunching and break the algorithms, now it will cause retroactive damage since we’re now talking about decrypting messages which are stored on servers and computers all over the Internet, such as the “Cloud.” What this means, is whatever data you place on any server or computer, including in the cloud, in Gmail, on Facebook, on Reddit, on any message board, or ANY website, anywhere, is irrevocably out in the wild and while it may be secured now, in a few years, a computer will be able to get the information without much trouble. Since the data is irrevocable in most cases, this means, there won’t be much you can do about it.

Possible Solutions – Leave your input

Let’s discuss solutions:

At the time of this writing, the best option I can think of is to upgrade the data to a future algorithm. When an algorithm goes obsolete or is broken, use the current, improved algorithm to re-encrypt the data so it is secured again and replace the old encrypted data with the data which is encrypted by the new and improved algorithm.

The problems with this though is, again, we have no idea exactly how or where our data is since for example, when we purchase goods from an online store, the data may go to the store itself, as well as their transaction vendors, and God knows who else. The physical locations of machines and knowledge of inner-company policies is also abstracted from us… For example, when we delete an account on Facebook… How do we really know it’s gone? Because Facebook says so? How does Facebook even know it’s gone? What if it’s tucked away in one of their backups that even they forgot about? The possibilities are endless here.

So how do we track down every single machine we’ve ever placed our information on, and get it to upgrade our data to the new algorithm? The answer is, we can’t unless somehow some sort of policy was enforced which caused this to occur as soon as a machine connected to the Internet, and even then, a disconnected machine would still have the data. The best we can do is use the new algorithm from this point on, and hope and pray that our past data is not attacked.

The above issues are ones raised by the current age of information technology and I’m afraid that we have not properly considered them before placing sensitive data into the hands of others. These issues ones that you should be pondering before you ever place sensitive data into computers. Please comment below or email me for further discussion or other ideas, I’d love to hear them! Note that these are just thoughts and by no means indicate an exhaustive list of facts or options, which is why this is in the editorial part of this website. Thanks for reading.