Put it online and it will live forever (Image: Aldo Sperber/picturetank)
They thought they could get away with it. The 37 million people who put nude photos and intimate details of their sexual fantasies on the Ashley Madison website (which has the slogan 鈥淟ife is short. Have an affair鈥�) had a get-out clause.
Advertisement
Ashley Madison, like some other sites, offers a hard delete 鈥� a guarantee that for a certain amount of money, your data will be scrubbed from all of its internal records. To permanently destroy all traces of your affiliation with the adultery social network costs 拢15 in the UK.
However, a hacker collective called Impact Team has revealed that customers鈥� details aren鈥檛 entirely deleted. Compliance with auditing requirements means that the credit card details and name used to scrub the account , rather defeating the point.
Serves them right, some might say. But this should be a reminder that there is a big gap between what web sites do with our data and what they tell us they will do. And that there is a lot of wiggle room in the technical details. That鈥檚 true even if you haven鈥檛 been having an affair on the internet.
Your digital remains
Take Facebook, for example. The site advises that 鈥溾��. However, just because you can remove your account from the public-facing servers doesn鈥檛 mean no data about you remains in Facebook鈥檚 coffers.
鈥淔acebook鈥檚 data policy is ambiguous on what exactly it promises to delete after you delete your account,鈥� says Brendan Van Alsenoy, a legal researcher at the Catholic University of Leuven (KUL) in Belgium. 鈥淚t mentions 鈥榠nformation associated with your account鈥�,鈥� he says, but 鈥渋t鈥檚 unclear whether this covers any information other than the information that is immediately visible to users themselves鈥�. So while Facebook is legally bound to delete things like status updates, the same legal protections may not apply to internal business information of the sort that Ashley Madison kept.
鈥淐opies of some material may remain in our database for technical reasons,鈥� a Facebook representative told New 杏吧原创. However, 鈥渨hen you delete your account, this material is disassociated from any personal identifiers鈥�. According to European Union law, says Van Alsenoy, 鈥渋f the data has been sufficiently anonymised, the individual will not be able to insist on deletion鈥�.
Back from the dead
The precise workings of deleting accounts or history with other companies is similarly unclear. A Google spokeswoman directed us to the company鈥檚 fine print, which reveals similar caveats: 鈥溾��, but 鈥渋f you deleted your Gmail account but want it back, we work to help you recover your deleted account whenever we can.鈥�
鈥淏ecause we maintain backup systems to make sure we don鈥檛 lose users鈥� data,鈥� she said, 鈥渢he deletion process may take time.鈥�
This makes business sense given the calamity associated with hacked and . While the company lets you delete your search history, it does keeps those search logs, but dissociates them from your Google account: anonymised.
However, data anonymisation is becoming increasingly unrealistic. 鈥淩e-identifying supposedly anonymised data has been demonstrated many times,鈥� says information privacy legal scholar Paul Bernal of the University of East Anglia, UK, and it will only get easier as re-identification techniques become more sophisticated.
Unfortunately, the law often either misunderstands or lags behind technological developments. In health law, for example, squabbles are ongoing over the definition of 鈥渟ufficiently鈥� anonymised.
Some say full anonymisation is simply impossible. EU regulators have issued , however, that are sensible, says Van Alsenoy. 鈥淲hether or not somebody is 鈥渋dentifiable鈥� or not is a question of fact,鈥� he says.
And the proposed reform of the EU Data Protection regime includes an explicit 鈥溾�� motivated by the frustration of Viviane Reding, the European commissioner for justice, fundamental rights and citizenship, with the difficulty of deleting social media profiles.
The bottom line
Perhaps the real reason companies bury their promises in caveats has to do with the bottom line. Facebook accounts are replicated across geographically distributed data centres. 鈥淚t would cost Google and Facebook money to delete all data 鈥� just setting up the systems would be complex, I suspect, and tracking down all data might be a little hard too,鈥� says Bernal.
For the time being, no one knows what data is kept, how identifiable it is, or how it could eventually be strung together. Plenty of people have been convicted of murder partly on the basis of web searches such as and .
But even if your search queries are more anodyne, they or other online traces might come back to haunt you. 鈥淧eople tend to think short term, accurately believing that the threat over exposure of 鈥渏ust one post鈥� over a small time frame is rather minimal,鈥� says David Dunning, who studies cognitive biases at Cornell University in Ithaca, New York. 鈥淚t鈥檚 this neglect of the long term that often gets people into trouble.鈥�
So how would such information come to light? A hack would do it. But even if every company were scrupulous about storing your information far from a hackable internet connection, there are still other avenues for your information to find its way back into the open internet.
鈥淭he notion of a defunct Facebook seems preposterous today,鈥� says Bernardo Huberman, director of the Social Computing Lab at Hewlett Packard. But many other social networks like Orkut and Friendster fell to the fickle winds of Silicon Valley. In the future, Facebook鈥檚 valuable data may become its most valuable commodity.
What guarantee does anyone have that someone can鈥檛 one day use Facebook鈥檚 or Google鈥檚 log files to construct a damning narrative about you?
Whether it鈥檚 an incriminating Facebook back-and-forth from 2004 or a series of late-night Google searches on erectile dysfunction, 鈥渕any people likely don鈥檛 know just how long their material stays on the internet, what companies can do with it, or how open it is to hacking鈥�, says Dunning.
