The Cube - hack-reduce Launch - Governor Deval Patrick, with Dave Vellante EMC is a founding member of an initiative at MIT called bigdata@CSAIL, which I wrote about in a previous InFocus post. Kicked off over a year ago by Massachusetts Governor Deval Patrick, CSAIL is the Computer Science and Artificial Intelligence Lab at MIT, and bigdata@CSAIL demonstrates the state's interest in partnering with academic institutions to drive innovation in technology, specifically related to Big Data. bigdata csailCSAIL members I am fortunate to participate in bigdata@CSAIL's ongoing series of workshops, lectures, and research related to the emerging field, including the challenges, opportunities and ecosystem related to Big Data. One such session, on June 19, focused on the intersection of Big Data with Security and Data Privacy. Security and privacy are becoming bigger and bigger concerns as we are able to generate more intelligent and sophisticated analytics with Big Data. This session was attended by a senior-level group of thought leaders, many of whom were legislators (David Vladeck, Law Professor at Georgetown, formerly of the FTC), legal experts (Daniel Weitzner), faculty (Sam Madden and others), or doctoral research students at MIT. Although there was a tremendous amount of outstanding content at the session, which I will discuss in future posts, there were a few key takeaways and recurring themes from the day that I want to highlight immediately: 1) Security is complex and many times you still have to ask 'who guards the guards.' It's not enough to secure a database somewhere, sometimes you need to secure the data from your own people, such as system administrators who may have root level access to databases and may inadvertently see data that they shouldn't. Among the solutions offered to address this problem were performing queries against encrypted databases, and storing decryption keys elsewhere, away from the databases themselves. 2) As tricky as security can be, privacy is a completely different ball game. Many times people think of data security as having strong algorithms and ensuring that sensitive data is secured. One participant at the workshop remarked that the biggest threat to privacy is actually cryptographers. Some people believe that if they just have stronger and stronger encryption, their sensitive information will be kept private. This may be oversimplifying, but the nuance with privacy is that it's not just about securing personally identifiable information (PII), it's also about considering what other related pieces of information could be used together to infer PII. Therefore, you need to be very careful about the information you share, and the intentions of the people who collect it. Arnaud_Rousseau_Dress_Shirt_with_a_Modern_Spread_Collar For example, if you give Amazon.com your address to send you a shirt you ordered, you are giving them your permission to use your address information for the purpose of sending you that shirt. However, in doing this, you should not also be giving permission to resell that address information or to sell you other things from other vendors. Therefore, there needs to be shifts in the way people and organizations think about their private information— instead of sharing their information freely, people must consider whether they are leasing their information to a specific person or entity under certain conditions for a certain period of time. Providing this control on the part of the individual was a core theme of the privacy workshop. 3) Privacy = Technology + Social + Regulation. What I mean by this equation is that technology alone will not solve this issue. Privacy is a much more subtle problem, which requires a blend of these three components. Technology and new algorithms are certainly part of the solution, as there are techniques to have intelligent systems answer questions without sharing sensitive data. By "social," I mean that we need to incentivize accountability regarding privacy. Back to my Amazon example, how do you provide the right incentives (and disincentives) for a retailer or other organization not to use, sell or share your data inappropriately or without your permission? Remember the Google Buzz. privacy problem a while back? Google decided to do you the favor of sharing lots of information about you to your friends or people unknown to you in order to jumpstart social circles. This turned into a disaster and it was quickly shut down.