Alessandro Alessandro Acquisti studies the behavioral aspects privacy (and information security) on social networks. of Acquisti. What motivates you to share personal online information? The answers come in a video from TED Talks by 
The translation into Greek was done by Chryssa Rapessi with final revision by Miriela Patrikiadou.
The line between public and private has become blurred over the past decade, both online and in real life, and Alessandro Acquisti is here to explain what that means and why it matters. In this provocative, slightly chilling talk, he shares details of recent and ongoing research—including a diagram showing how easy it is to match a stranger's photo to their sensitive personal data.
I would like to tell you a story that connects the infamous privacy incident involving Adam and Eve and the remarkable shift in the boundaries between public and private that has taken place over the past 10 years. You know the incident.
Adam and Eve, one day in the Garden of Eden, realize they are naked. They freak out. And the rest is history. Today, Adam and Eve would probably behave differently. [@Adam Yesterday was jam! The apple was perfect LOL] [@Eve yeah.. baby, do you know what happened to my pants?] We reveal much more information about ourselves on the internet than ever before and so much information about us is being collected by companies. There are many gains and benefits from this massive analysis of personal information, or big data, but there are also complex trade-offs that come with giving up the protection of our personal data. And my story is about those trade-offs. We begin with an observation, which, in my mind, has become increasingly clear in recent years, that any personal information can become sensitive information.
In 2000, about 100 billion photos were taken worldwide, but only a tiny percentage of them were uploaded online. In 2010, 2.5 billion photos were uploaded to Facebook alone in a single month, most of them identified. In the same period, the ability of computers to recognize people in photos improved by three orders of magnitude.
What happens when you combine these technologies: increasing availability of facial data, improving the ability of computers to recognize faces, but also cloud computing, which gives anyone in this room the kind of computing power that a few years ago was only the domain of three-letter organizations, and ubiquitous computing technology, which allows my phone, which is not a supercomputer, to connect to the internet and do hundreds of thousands of facial measurements there in a matter of seconds.
So, we speculate that the result of this combination of technologies will be a radical shift in our understanding of privacy and anonymity. To test this, we ran an experiment on the Carnegie Mellon campus. We asked students who were walking by to take a survey, and we took a picture with a webcam, and we asked them to fill out a survey on a laptop. As they filled out the survey, we uploaded their picture to a cloud computing cluster, and we started using facial recognition to match that picture to a database of a few hundred thousand pictures that we had downloaded from Facebook profiles. By the time the person reached the last page of the survey, the page had dynamically refreshed with the 10 best-matching pictures that the recognizer had found, and we asked them to indicate whether they saw themselves in the picture. Do you see the person? Well, the computer saw it, and it actually saw it for one in three people. So, essentially, we can start with an anonymous person, online or offline, and use facial recognition to give that anonymous person a name thanks to social media data. But a few years ago, we did something else. We started with social media data, we statistically combined it with data from the U.S. government's Social Security, and we ended up predicting Social Security numbers, which in the United States is extremely sensitive information. See where I'm going with this?
So, if you combine the two studies, the question that arises is, can you start with a person and using facial recognition, find a name and publicly available information about that name and that person and from that publicly available information identify non-publicly available information, much more sensitive information that you associate with the person? And the answer is, yes, we can, and we did. Of course, the accuracy gets worse and worse. [Found the first 5 digits of the IKA number in 27% of the people (with 4 attempts)] But in reality, we decided to develop an iPhone app that uses the phone's internal camera to take a picture of the person and upload it to the cloud and then do what I just described to you in real time: search for an identity, find public information, try to identify sensitive information, and then send it back to the phone so that it overlays the person's face.
An example of augmented reality, a creepy example of augmented reality. In fact, we didn't develop the app to sell, just as a proof of concept. Basically, take these technologies and push them to their logical limits. Imagine a future where strangers around you are looking at you through Google Glass or, one day, their contact lenses and using seven or eight data points about you to find out everything else that might be known about you. What would that future be like without secrets? And should we care? We might want to believe that a future with so much data will be a future without bias, but in reality, having so much information doesn't mean that we're going to make choices that are more objective. In another experiment, we presented participants with information about a potential job candidate. We included some recommendations in this information - some funny, perfectly legal, but perhaps slightly embarrassing information that the participant had uploaded online.
Now it's very interesting that among our participants, some had uploaded similar information, and some hadn't. Which group do you think was more likely to judge the participant more harshly? Surprisingly, it was the group that had uploaded similar information, an example of moral dissonance. Now you might be thinking, this doesn't concern me, because I have nothing to hide. But, in fact, privacy is not about having something negative to hide. Imagine that you are the human resources manager of a particular company and you receive resumes and you decide to find out more information about the candidates. So, you Google their names and in some universe, you find this information. Or in a parallel universe, you find this information.
Do you think you would be just as likely to call one of the candidates for an interview? If you do, then you're not like the American employers, who are, in fact, part of our experiment, which means that's exactly what we did. We created profiles on Facebook, manipulated features, then we started sending resumes to companies in the U.S. and we tracked, tracked, whether they were looking for our candidates, and whether they were acting on the information they found on social media. And they were. They were discriminating through social media against equally experienced candidates. Now marketers like us want to believe that all the information about us will always be used in a way that's favorable to us. Think again. Why should it always be that way? In a movie that came out a few years ago, “Minority Report,” there was a famous scene where Tom Cruise was walking through a shopping mall and personalized hologram ads appeared around him. Now, this movie is set in 2054, about 40 years from now, and as exciting as this technology seems, it already grossly underestimates the amount of information that companies can collect about you and how they can use it to influence you in ways you won’t even realize.
So, as an example, this is another experiment that we're doing right now, which is not yet complete. Imagine that a company has access to your list of friends on Facebook, and through some algorithm, they can figure out which two friends you like the most. And then they create, in real time, a composite of the faces of those two friends. Studies, before ours, have shown that people don't even recognize themselves in composites of faces, but they react to those composites in a positive way. So the next time you're looking for a particular product and an ad suggests you buy it, it's not just a typical representative. It's one of your friends, and you don't even know it's happening. Now the problem is that the existing policy mechanisms that we have to protect ourselves from abuses of personal information are like putting a knife in a gun. One of those mechanisms is transparency, telling people what you're going to do with their data. In principle, this is a very good thing. It's necessary, but it's not enough. Transparency can go in the wrong direction. You can tell people what you're going to do, but then you keep pushing them to reveal arbitrary amounts of personal information. In yet another experiment, this time with college students, we asked them to provide information about their behavior on campus, including very sensitive questions, like this one. [Have you ever cheated on a test?] To one group we said, "Only other students will see your answers." To the other group we said, "Students and faculty will see your answers." Transparency. Notification. And of course, it worked, in the sense that the first group was much more likely to disclose than the second. Understandable, right? But then we added deception. We repeated the experiment with the same two groups, but this time we added a delay between the time we told the participants how we would use their data and the time we started answering the questions. How long of a delay do you think we had to add to nullify the inhibitory effect of knowing that the teachers would see your answers? Ten minutes? Five minutes? One minute? How about 15 seconds? Fifteen seconds was enough to get both groups to reveal the same amount of information, as if the second group no longer cared whether the teachers would read their answers.
Now I have to admit, this talk so far may sound very pessimistic, but that's not my point. In fact, I want to share with you the fact that there are alternatives. The way we do things now is not the only way they can be done, and certainly not the best way they can be done. When they tell you, "People don't care about protecting their privacy," ask yourself if the game is designed and set up so that they don't care about protecting their privacy, and when they realize that these manipulations are being done, they are already in the middle of protecting yourself. If they tell you that protecting your privacy is incompatible with the benefits of big data, consider that over the past 20 years, researchers have created technologies that allow almost every electronic transaction to be done in a way that protects personal data more. We can surf the Internet anonymously. We can send emails that can only be read by the intended recipient, not even by the National Security Agency. We can even have privacy-preserving data mining. In other words, we can have the benefits of big data while protecting personal data. Of course, these technologies imply a shift in costs and revenue between data owners and data subjects, which is why you may not hear much about them. And I return to the Garden of Eden.
There is a second interpretation of privacy in the Garden of Eden story that has nothing to do with Adam and Eve feeling naked and ashamed. You can find an echo of this interpretation in John Milton's Paradise Lost. In the garden, Adam and Eve are materially satisfied. They are happy. They are content. But they lack knowledge and self-awareness. The moment they eat what has been aptly called the fruit of knowledge, that is when they discover themselves. They have a conscience. They are able to have autonomy. But the price is persecution from the garden. So privacy, in a way, is both the way and the price of freedom. Again, marketers tell us that big data and social media are not just a profit paradise for them, but a Garden of Eden for the rest of us. We get free content. We can play Angry Birds. We get targeted apps. But in reality, in a few years, companies will know so much about us that they will be able to infer our desires before we even form them, and perhaps buy products on our behalf before we even know we need them. There was an English writer who predicted such a future where we would trade our autonomy and our freedom for our comfort. Even more than George Orwell, the writer is, of course, Aldous Huxley. In "Brave New World," he imagines a society where the technologies we originally created to free us end up coercing us. But in the book, he also offers us a way out of this society, similar to the path that Adam and Eve had to take to leave the garden. In the words of the Wild One, it is possible to regain autonomy and freedom, but the price is high. So I believe that one of the defining battles of our time will be the battle for control of personal information, the battle over whether big data will become a force for freedom, rather than a force that will manipulate us in secret. Now, many of us don't even know that this battle is going on, but it is, whether you like it or not. And at the risk of playing the snake, I will tell you that the tools for the battle are here, the awareness of what is happening, in your hands, just a few clicks away.
Thank you.
