Roger Clarke's Web-Site © Xamax Consultancy Pty Ltd,  1995-2024
HOME	eBusiness	Information Infrastructure	Dataveillance & Privacy	Identity Matters	Other Topics
What's New		Waltzing Matilda	Advanced Site-Search

eConsumer Insecurity
Five Sensationalist Headlines, and Why They're True

Notes of 9 January 2013

For a presentation to the Wirtschaftsinformatik Forum
University of Koblenz-Landau, 17 January 2013

Roger Clarke **

© Xamax Consultancy Pty Ltd, 2013

This document is at http://www.rogerclarke.com/EC/eCIS.html

The accompanying slide-set is at http://www.rogerclarke.com/EC/eCIS.ppt

Background

As the eCommerce era began 15 years ago, I identified several factors which I argued would be significant impediments to adoption by consumers - an unwillingness to pay for invisible benefits; an inadequate basis for trust in the other party and in the value-transfer; privacy threats; enforced self-identification; and a lack of consumer protections (Clarke 1999a). B2C marketers were too excited to listen (Clarke 1999b), and as a result consumer adoption has always been one of the slowest-growing of all Internet metrics.

Fast-forward to 2013 ...

eConsumer Insecurity

Here's a cluster of propositions that at first sight may seem sensationalist, but that this presentation shows to be genuine assertions:

1. Software on consumer devices becomes dated and local data is often not recoverable; but
   eConsumer services are a very bad deal
   • The Cloudy Future of Consumer Computing (2011)
2. Mobile devices are irretrievably insecure
   • The Feasibility of Consumer Device Security (2007)
   • Re-Conceptualising Malware (2009)
   • Information Security for Small and Medium-Sized Organisations (2013)
3. That's not a Password; It's a Passéword
   Kennwort wurde schon Bekanntwort
   • What Everyone Ought to Know About Passwords (2011)
4. Web technologies are designed to be insecure
   • ActiveX (The Consipracy of Silence)
   • AJAX (2007)
   • Lyne J. (2011) 'HTML5 and Security on the New Web' Sophos Security, December 2011
5. The spy in your pocket leaks your location, 10 times per second, and
   to far more organisations than you thought
   • Location and Tracking Technologies (1999)
   • Location and Tracking Technologies - Relevant Characteristics (1999)
   • Location and Tracking Technologies (2008)
   • Internet Users' Second-Party Exposure (2010)
   • Location and Tracking Technologies (2013)
6. Unauthenticated payments are switching card risks from merchants to consumers
   • Can Mobile Payments be Secure Enough? (2007)
   • A Risk Assessment Framework for Mobile Payments (2008)
   • The Dangers of Contactless Payment: Visa PayWave and MasterCard PayPass RFID-Chip Schemes (2012)
7. Social media services have only one business model,
   and it's based on personal data exploitation and behaviour manipulation
   • Web 2.0 as Syndication (2007)
   • An Evaluation of the Terms of Service and Privacy Policy of the LinkedIn Professional Networking Service (2010)
   • Privacy as a Strategic Factor in Social Media: An Analysis Based on the Concepts of Trust and Distrust (2012)
   • Consumer-Oriented Social Media as Market Opportunity (2012)

Some Implications

Maybe it's time to re-visit the principles naively suggested to direct narketers many years ago (Clarke 1998, Clarke 1999b):

• Make Information Readily Available about the marketer's use of the technology, to anyone who seeks it, sufficient to enable people to understand how it works, and what it entails
• Provide Choice, such that each consumer can judge whether or not to engage in a relationship, or receive communications
• Act only with Consent, by each consumer, to the establishment of a relationship, and to the receipt of communications. Express consent is strongly preferable; but implied consent may be appropriate in some circumstances. Consent requires an 'opt-in' arrangement, such that the person agrees in advance to the activity. Consent needs to be informed, and freely-given, and granular not bundled. 'Opt-out' arrangements may be cheap, but they are not consumer-friendly, and require stringent justification, of a kind that consumers will be comfortable with (Clarke 2002)
• Set Fair Conditions, such that each consumer has grounds for being confident in the nature of the commercial relationship
• Provide Recourse, such that marketer behaviour that does not comply with these norms can be brought under control

Other constructive measures also seem to have the ring of 'wishful thinking' about them, such as:

• IT Security Risk Assessment (SRA) from the eConsumer Perspective
• IT Security Risk Management Planning (SRMP) from the eConsumer Perspective
• Designed-In Security Safeguards that are practicable and economic, that are on by fefault, that incur minimal trade-off against usability, and that are documented, with eConsumer-oriented tutorials

But the market rules, and avarice wins until eConsumers eventually recognise it, and find alternatives. So an alternative is for consumer-oriented services to be developed, such as Consumer-Oriented Social Media (Clarke 2012).

Some other ways to get there include:

• Recognise the emergence of the proactive and productive eProsumer (Clarke 2008)
• Impose liability for designed-in insecurity
• Impose liability for serious security errors (Clarke 1988)
• Develop eConsumer Protection laws (Clarke 2006).
• Impose minimum privacy undertakings (Clarke 2005).
• Impose standards for eConsumer services (Clarke 2011).

Why This Matters

Consumers are important in their own right - there are billions of us.

Consumers are employees, and their personal behaviour and habits are imported into the workplace.

With the growing implementation of BYOD (Bring Your Own Device) policies, not just eConsumers' behaviour and habits, but also their own devices, are being applied in the workplace.

So eConsumer Insecurity directly translates into eOrganisational Insecurity.

Author Affiliations

Roger Clarke is Principal of Xamax Consultancy Pty Ltd, Canberra. He is also a Visiting Professor in the Cyberspace Law & Policy Centre at the University of N.S.W., and a Visiting Professor in the Research School of Computer Science at the Australian National University.

The content and infrastructure for these community service pages are provided by Roger Clarke through his consultancy company, Xamax. From the site's beginnings in August 1994 until February 2009, the infrastructure was provided by the Australian National University. During that time, the site accumulated close to 30 million hits. It passed 65 million in early 2021. Sponsored by the Gallery, Bunhybee Grasslands, the extended Clarke Family, Knights of the Spatchcock and their drummer

Xamax Consultancy Pty Ltd ACN: 002 360 456 78 Sidaway St, Chapman ACT 2611 AUSTRALIA Tel: +61 2 6288 6916

Created: 5 January 2013 - Last Amended: 9 January 2013 by Roger Clarke - Site Last Verified: 15 February 2009
This document is at www.rogerclarke.com/EC/eCIS.html
Mail to Webmaster   -    © Xamax Consultancy Pty Ltd, 1995-2022   -    Privacy Policy