Date: Mon, 23 Nov 1992 02:54:26 GMT
From: Robert Grumbine <rmg3@grebyn.com>
Newsgroups: comp.society.privacy
Subject: Small town versus computer privacy
Organization: Grebyn Timesharing
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 103, Message 6 of 7

  In this group, posters have suggested that in times before major
urbanization people lived mostly in small towns where the grapevine
effectively meant that everything was known about everyone.  This is 
mentioned in connection with the present developments with computers 
and privacy issues they may raise, where even with large populations 
it becomes again possible for everything to be known.  The people who 
put this forward tend to believe that the proper conclusion is that since 
it was once (stipulated to be) true in small towns with people as the 
medium, that there is nothing to be concerned about with it (again 
stipulated) true for large groups with computers as the medium.  I've 
thought about this for some time now, and have refined my thoughts a
bit.

  The important differences between the old time (postulated) small 
town (lack of) privacy and the computer age counterpart lie in  scope 
(both space and time), and reciprocity.  Consider the small town situation.  
Everybody (all several hundred) in the town knew what books you were 
checking out of the library, how much alcohol you were drinking, how 
often you went to church, and so forth.  Anything you did that seemed 
worth talking about, was, and to anyone in the town.  (I question whether 
this was ever really the case, and I've lived in small towns, but we'll 
take this picture as given.)

  But, the scope in space was limited.  Although everybody _in_ the town 
knew that you read questionable books (Marx, say), nobody _outside_ the 
town knew.  The spatial scope was limited.  The temporal scope was also 
limited in that only things which seemed worth talking about _at the 
time_ were propagated into the grapevine.  So if everybody in town is 
reading Marx, then the fact that you did too was not passed along especially.  
If, ten years after the fact, it becomes undesirable to have read Marx, 
everyone can individually deny it since it was never worth remarking on.  
The memories are limited.  There was also the element of reciprocity.  
Even though everybody knew that you read Marx, say, you knew that Fritz 
was fooling around, Enid was stringing along several guys, and the like.  
You knew who knew your failings, and you knew theirs.  A balance could 
then be struck (and usually was, I submit).  If someone decided to vandalize
your house because you were X, you knew most likely who had done it and
could respond one way or another.

  If the balancing methods failed, you could leave town.  In the 'old' 
days, this represented a fresh start (and accounted for no trivial part 
of the westward migration in the US) as nobody in the new town knew you.

  The computerized lack of privacy presently developing in the US is 
missing the balances that were available in the old small towns.  The 
spatial scale is unlimited.  There's no place to go where people can not 
look up your 'misdeed'.  The temporal scale is also unbounded.  Your 
actions, regardless of their present triviality, can be recorded and 
used ex post facto at some time when the activity is deemed improper.  
There is no reciprocity either.  You do not know specifically who has 
electronically investigated you, nor do you know anything about them.  
Should someone vandalize your house because of information from the 
electronic files, you have no means of specific response.  (Theoretically 
you still have the usual recourse to the police, but they have no way to 
follow up as there is no way for them to narrow the search either.)

  The simplistic response is to say that everyone should simply live 
their lives so that they are always above reproach.  This, even for
saints, is impossible.  If nothing else, the range of feelings on the
part of the people passing judgement ensures that there will be situations
in which you are certain to have transgressed (in somone's judgement)
the realm of acceptable behavior.  With respect to the war in Vietnam,
it is obvious that the (now) proper thing to have done is to neither
have registered or avoided registration, and to neither have fought 
in the war, nor avoided fighting in the war, nor to have protested the 
war.  Every US man who was draft age during the war has therefore done 
the wrong thing.  Nor are the things which may excite hostility 
necessarily things you have control over.  In Nazi Germany, it was
fatal to be Jewish or have Jewish relatives.

  Back to the obvious difference between the small town and the 
electronic domain.  Scale.  The small town contained only a few 
hundred people.  Extremists of a type that represent only, say,
one in a thousand of the population (say 250,000 people in the US)
would likely not be present in the town.  If they were in your town, 
then you could either leave the town, or rely on the fact that there 
was only one of them in the town (and therefore they would be less
active).  Either way, scope combined with scale to limit the effective-
ness of the extremist.  In the electronic domain, your 'village' 
contains millions of people.  Chances are that there are hundreds
of one in a thousand extremists who can know about you.  Further,
the extremists are linked by the electronic network so that they
are no longer being dissipated by the community.  

  A brief argument might be raised that this also links the would be 
targets.  In practice, I doubt it is effective.  This becomes a case 
where the defense against extremists is something that should be done 
by everyone, and could be done by anyone.  In those situations, it is 
generally done by noone.  (A mundane example is cleaning the office coffee pot, 
check the frequency with which this is done in decentralized situations 
versus the number of people involved.  It drops the more people there are.)

  This is offered as a problem statement.  I don't have the solutions.
The things that leap to mind, informing people who requested what
information about them (at the expense of the requestor), imposing a
statute of limitations on databases, and such, I don't see any good
way of implementing.  In the case of the databases, I'm skeptical that
it is even possible.  Organizations which have payed to collect data
are unlikely to be inclined to destroy it just because somebody else
thinks it is too old.  Enforcement also seems difficult to impossible. 

  Your thoughts?
  
Bob Grumbine
rmg3@grebyn.com