I struggle with being _comfortable_ with that idea, but I don't have a problem believing the technical accuracy of it.

The argument is that even if everybody has access to all information, only a small group is able to exploit that access effectively.

So, you still end up with a small group abusing their access to the information. You should therefore aim for privacy of sensitive information.

Technically, this is not taking advantage of any public information. It is just capturing images of things happening in public. Anyone could set up a camera and capture license plates as they drive through an intersection.

So is it totally fine for a police force to scan license plates at every intersection?

The question is complicated, because the effect on people changes when you do something that is not worrisome on a small scale in an automated way at a large scale. When you add in that the people doing it have a large amount of power over people and it changes it even more.

I’d imagine it would be relatively easy to figure out where someone works and/or lives and just go find them.

Correlating across multiple public databases might make things even easier.

But I don’t think this is the point of the argument. The point is that those in power can gain more benefit from the information than the general population.

Let’s say all votes in elections become public. That information is more useful to a powerful political party than to the public at large, or a small unfunded group. If you don’t want that information abused, the argument goes, you should make sure it’s kept private.

-- Yonatan Zunger, chief architect, Google+

https://plus.google.com/+YonatanZunger/posts/WegYVNkZQqq

Published in 1998, I think it's probably still the most fascinating work on privacy of the post-internet age.

More fun fictional explorations of the subject can be found in his novels Kiln People and Earth.

I asked them what protections they took against hacking, and they told me that nobody would be interested in what they do, so they didn't have to spend any money on protecting themselves.

https://www.businessinsider.com/hacker-us-nukes-report-2016-...

A counter-example is something like Stuxnet; that likely leapt an air gap, but it was exquisitely targeted for that scenario. I'd worry about this as a nuclear component manufacturer.

An ancient piece of air-gaped hardware is pretty bulletproof. I bet the NSA would have more trouble hacking it than a fully up to date install of <modern OS> that is on the Internet.

It's very possible the biggest threat vector is leaving the door unlocked.

[0] Which, why should we? The world has moles.

Anything with a network port was plugged into the lan, which was plugged into the free router that came with the business broadband package.

Which was also the only firewall and it was still on factory defaults other than the wireless password.

As far as I can tell this is more or less standard business practice in the small to medium enterprise sector here, which is to say, the vast majority of specialist engineering companies in the UK.

Inadvertent data breaches are inevitable.

The very best you could possibly do is access logs and auditing. Which of your customers do any kind of auditing?

I'm advocating Translucent Database techniques, where patient data is encrypted at the field and row (document) level. Much like a salted password file.

System level encryption still means the admins can still see the data. Therefore, breaches remain inevitable.

Translucent Databases http://a.co/d/5855TYO http://wayner.org/node/46

Think of how password databases don't actually store passwords. Instead they (should) be storing salted and hashed passwords.

---

Please see my other comment about plaintext demographic data vs using unique identifiers.

Your conclusion is correct.

Medical records cannot be encrypted so long as demographic data must be stored in plaintext. Otherwise how would we do record matching (linking) across heterogenous systems?

The fix is to use universal identifiers. Once you moot the record matching problem, you can use translucent database techniques to anonymize patient data.

I don't expect the USA to adopt an official centralized universal identifier for people any time soon. And none of the 3rd party solutions (NSA, LexisNexus, ChoicePoint, Facebook, etc) are acceptable, for various reasons.

I mean, sure it has a cost, some of this stuff is new, but to say "cannot be encrypted"... that's where the fun is- working out how to do it.

Obviously, some admins/sres still need to have full access to the key store, but that can be a very small group, as compared to a situation where "every Gmail engineer can read every user's email".

Edit: on reading the summary blurb from the "translucent databases" book link that @specialist posted, what I described above is very much along those lines.