What are they doing with our data?

With the 'breach' at Facebook they won't get my trust back again.  They can call it anything they want, but, from my point of view it is a 'breach'.  MY data was taken and used in ways I did not give MY permission for.  It isn't just Facebook, but, anyone who offers services over the internet that we need to be more aware of what they know about us and are willing to share to others.  It doesn't matter that it is 'free' like Facebook or a paid service we need to demand that they treat our personal information like crown jewels and do their best to make sure that it isn't taken without our knowledge and permission.

I don't know what they put into the document for data analysis by that 'researcher', but, here are a few things I can quickly think of for anyone who is thinking about people getting access to our data.

• Where is the data stored?
• What is the data you need, why do you need it, and, for how long will you require to keep the data for?
• How is the machine secured both from a physical access point and software?
• Does the system which holds the data accessible from your LAN and/or internet?
• What software tools are being used for data storage and analysis and are they up-to-date for patching?
• Has your hardware been patched for the latest identified vulnerabilities?
• How did you test the security of your systems?
• Who has access to the machine?
• Do you limit access to 'need-to-know' and only the data required?
• Do you limit how the data is moved off the system when 3rd parties have access?
• If so, how?
• What agreements do you have in place for 3rd party access and what do the agreements say?
• If law enforcement or government request access to the data what is the process you follow to grant them access?  
• Do you notify the original owner of the data for such data requests?
• What is the process you follow when there is a network or physical breach of your system?
• How are the backups done and secured and who has access to those backups?
• When you are done with the analysis how is the data deleted?  
• Does that include all backups?
• How do you prove that the data was deleted and can never be recovered?

I understand that they need to make money, but, when the data leaves their control then anything can happen and they need to do a better job documenting what was requested, why it was requested, how it was secured and how it was deleted when done.  For myself I have downloaded my Facebook data to see what they have and I am now looking at other services that respect my privacy more.  It will be hard as Facebook has a massive population, but, other communities in the past have fallen (MySpace, AOL come to mind).

Ontario ombudsman is a good thing

For a number of years Ontario has had an ombudsman working on the behalf of all people in Ontario.  For most of that time I was not aware of the office.  Last year I saw articles talking about Bill 8 and after a very quick read I liked what I saw.  It expands who falls under his(or her) eyes.  There are those who feel threatened by OO (Ontario Ombudsman) or think they should not be subjected to OO scrutiny. 

Personally I believe if they are a provincial agency, funded by the province or a municipality they MUST be open to the ombudsman.  They should not feel threatened by the OO, but, look at it as an opportunity to have an outside set of eyes reviewing something they are doing.  At the end there will be a report that can be used to help improve what is being done or not being done and better serve the people of this province. 

Some municipalities believe they should be the ones to define the role and hire their own ombudsman, but, there can be problems with that.  They can craft the role in such a way that the ombudsman is a toothless entity restrained from doing anything useful.  Another point is how secure is their position after making a report or series of reports critical of that municipality?  One last point is how would they keep the names of the complainants confidential if they are told to surrender that to the municipality?  An outside independent entity with real powers granted by legislation (including privacy/confidentiality) would be able to do the job without too many worries and would actually give the municipality credibility when they go to the people asking for a bit more money as this is the cost of providing good services to the people as recommended by the OO. How can we get better if we don't know what is being done right, what can be improved upon, what is not being done right or not done at all?

When I was doing volunteer work teaching high school students how to start and run a business I had a good definition of success that I think more businesses and agencies should look at.  It is a few simple questions I ask the students:

• what are you doing right and why is it right?
• what are you doing wrong, why, and how to fix.
• what are you not doing and why?
• do you like what you are doing, if not, why are you doing it?
• can you do it better, faster and cost effective?

At the end of the program the students have the answers to those and I believe the OO can provide something similar to the people so that we have effective government and government agencies that are more aware of their roles and responsibilities.

I hope the current Ontario provincial government proclaims Bill 8 ASAP so that the OO can work on behalf of the people covering a larger section of government and government funded agencies.