Resources

• Read detailed information on Windows Azure's security, privacy, and compliance practices
• Read detailed information on Office 365's security, privacy, and compliance practices
• For more on this and similar topics, read John Weigelt's blog

John Weigelt

As the National Technology Officer for Microsoft Canada, John Weigelt is responsible for driving Microsoft Canada's strategic policy and technology efforts. In this role, Mr. Weigelt helps business and governments innovate with technology while avoiding the unintended consequences that might arise.  He leads Canadian outreach for Economic Development, Environmental Sustainability, Accessibility, Privacy, Security, Critical Infrastructure Protection, Government 3.0, Interoperability and other policy related activities.

Podcast

This episode is also available as a podcast.

Listen Now >>
Download as MP3 >>
Subscribe with Zune >>
Subscribe with RSS Feed >>
Subscribe with iTunes >>

About AlignIT Manager Tech Talk
The AlignIT Manager Talk is a monthly live streamed video series hosted by Ruth Morton (LinkedIn) and Jonathan Rozenblit (LinkedIn). Each Tech Talk episode airs on the 2nd Thursday of the month from 12:00pm to 12:30pm EST. The show focuses on a range of topics for both infrastructure and development managers and is interactive, taking questions via a live chat and providing answers on air

About AlignIT
The AlignIT program is dedicated to keeping IT leaders informed about what really matters in business and technology. We do that through in-person events, web casts, our blog and of course, this podcast series. You can find more information about the Align IT program at www.alignit.ca. If you have comments, suggestions, and ideas for future topics please let us know by connecting with us via email, Twitter, or LinkedIn.

Visit the AlignIT site >>
Follow AlignIT on Twitter >>
Join the conversation on LinkedIn >>

Today, consumers have very little awareness or control over who can track their online activity. With the release candidate:

1. IE9 will offer consumers a new opt-in mechanism (“Tracking Protection”) to identify and block many forms of undesired tracking.
2. “Tracking Protection Lists” will enable consumers to control what third-party site content can track them when they’re online.

More info: http://blogs.msdn.com/b/ie/archive/2010/12/07/ie9-and-privacy-introducing-tracking-protection-v8.aspx

To add the custom button to your menu bar, download the contents of this zip file. The file contains 4 files: InP.ico, Private.htm, PrivateLink.htm and Registry.reg. You’ll want to unzip the contents to a new folder you create called “Tools” and located at C:\Program Files\Internet Explorer\Tools.

After extracting the files, double-click on the Registry.reg file. Then open IE and customize your toolbar to add the new In Private button.

If you want to customize this even further or install the button manually, you can view the detailed instructions here (PDF link).

IE 8 Beta 2 is almost out of the oven. Given this, we of course want to find out all about it straight from the horse’s mouth, so to speak. Enter General Manager of Team Internet Explorer, Dean Hachamovitch, and Program Manager Andy Zeigler. The topic of this particular conversation (other IE8 interviews are in the pipeline) is a complex and important one: User Privacy and what IE 8 will do to inform users and protect their personal information when surfing the Internet.

Dean and the IE team are very passionate (and very serious about) user privacy. It’s a hard problem for a browser to solve, but a browser is the first line of defense and can therefore supply users with helpful information regarding what websites are involved with a particular session. Andy Zeigler is the Program Manager of the new Privacy features in IE 8. Dean and Andy shed light onto exactly what's been done in the realm of Privacy in IE 8 Beta 2. Two core new Privacy mechanisms are present in IE 8: InPrivate Browsing and InPrivate Blocking (with InPrivate Subscriptions, a feed-based blocking service). We of course address more than the What, however, as you'd expect from Channel 9. Is true privacy on the Internet even achievable (is anonymity possible given the architecture and implementation of the Internet)? What role can a web browser play in protecting a user's personally identifiable data?  

Tune in. This is a great conversation.

Companies like Yahoo!, Microsoft, and (especially) Google depend on being able to track your browsing habits to better target you with advertisements.  In the past 2 years, the proportion of ads being served through ad tracking networks has climbed from 5% to more than 30%, so these tracking networks like Doubleclick (Google), BlueLithium (Yahoo!) and aQuantive (Microsoft) are the lifeblood of the top web properties.  DoubleClick touches more than 80% of the addressable Internet population.

Tracking people's behavior on the web is incredibly lucrative, so everyone wants a piece of the action:

• FireFox, the popular web browser, has announced plans to track your browsing habits directly from the browser, without needing to use tracking cookies.
• AT&T has announced that they can track your browsing behavior directly off of the wire, without needing to extend the browser or use tracking cookies.  They will sell this information to ad networks, or use it to target their own ads.
• Several other ISPs have already embarked on projects to track people's behavior for ad tracking, supported by startups like NebuAd and Phorm.

With all of these companies fighting over you like a piece of meat, you'd think someone would ask you what you think.  Historically, the companies profiting from tracking your behavior have pointed out that people often say that they want privacy, but then give it up easily.  Google has gone so far as to say that there is "no such thing as complete privacy" and they don't get a lot of credit from the critics for sincerity.

So, must we resign ourselves to this trend?  Five years from now, will your web browser, ISP, and everyone else spy on you with impunity?

The answer seems to be "no".  The first volley was the class-action suit last week against Facebook for the abortive "Beacon" feature.  Facebook's "Beacon" feature wasn't actually intended to invade privacy, and didn't go nearly as far as the examples cited above -- but this case demonstrates that people actually *do* care about privacy, and are willing to take action to protect it.  Likewise, people almost immediately raised the privacy red flag when Yahoo! announced Fire Eagle location tracking service.

Far more interesting to me is the news yesterday that Congress will be taking up legislation to protect privacy online.  This legislation is aimed directly at web tracking networks and software or network operators who track your behavior.

This is huge.  The legislation would require companies to get your permission before spying on you.  A stronger proposal would require that those spying on your behavior allow you to opt-out at any time, and establish the equivalent of a "do not call" list.  There are many details to be worked out, and some well-funded parties with strong incentive to weaken the legislation, so I'm tempering my optimism.  But this is a huge step in the right direction.

What do you think?  Do we need legislation, or will the industry self-regulate?  And do you think that this proposed legislation stands a prayer of making it through the process with teeth intact?

The New York Times opines that people (especially people in "terrorist" countries) need to get accustomed to having their activities recorded and judged by concerned fellow citizens.  Their thesis is that privacy is dead, and that this is a "good thing" (tm) because we can all spy on each other and stop bad guys.  This is the same argument against privacy that is made every time a stunned neighborhood in a privacy-loving culture discovers that a predator has been doing bad things in his house next door.

Conversely, the Times of London argues that too little privacy and too much spying by "fellow citizens" leads to mob justice.  They cite the recent example in China of a girl who impulsively recorded herself saying some disrespectful things about the Sichuan quake victims, and was tracked down and harrassed by angry citizens.

As more details of our lives become public and instantly indexed in powerful search engines, such questions are sure to arise again and again.  But I think that both the NYT and Times of London are missing the point.  They both presume that cultural norms and expectations about privacy can be swayed through a process of discourse and debate, or that negative outcomes can be avoided by prescribing policy correctly.

In reality, different cultures have different attitudes toward privacy, and these professed attitudes remain remarkably constant over time.  NYT lecturing Arabs or Austrians to be more like Chinese, or Times of London lecturing Chinese to be more like Austrians, are pointless wastes of ink.

Furthermore, we've learned that a group's cultural attitudes toward privacy are often a poor predictor of how they will behave when presented with specific new technological challenges to privacy.  Austrians may love privacy in principle, but they still give Doubleclick massive amounts of data about their personal browsing habits.  One could argue that this is because they are unaware of the level of tracking that's done, but I suspect that it's in large part because they don't really care as much as they say they do.

Study after study has shown that the attitudes toward privacy which people adopt and profess, do not necessarily translate to action in given situations.  People know how they *should* feel about privacy, and will happily parrot those beliefs -- but they all too often will give up their privacy at a moments whim and ignore warnings when their privacy has been compromised.  One partiularly sobering study showed many New Yorkers giving away their social security number and password to a stranger on the street after being told the information was for an "I Love New York" survey.  The participants' desire to contribute to the "New York Love" led them to eagerly give away very sensitive information.  We find that people readily give away personal information for many similarly impulsive payoffs, such as free access to download some tool or try a hot web site, or to mail a humorous video to a friend.

So, when it comes to privacy, why do so many people profess one thing and do another?  And what can be done about it?  I would love to hear your thoughts.

As a physician, I know how important it is to have access to my patient's health information.   As a patient, I know how frustrating it is to have my health information scattered across multiple doctors, ambulatory clinics and hospitals.  As a care manager for my elderly parents, I've experienced firsthand how difficult it is to keep track of their doctor appointments, medications, and medical problems.

Today, in Washington, D.C., Microsoft is announcing a new tool that will begin to bring order to this chaos.  It's called HealthVault; an environment of new online services to help people SEARCH, STORE and CONNECT their health information, putting them in control of  their, and their family’s health and wellness.

HealthVault, designed with security and privacy in mind, is built on the principle that people should have a copy of their own health information, have control over it, and be able to share their information with whomever they choose.  I think many people are going to proclaim, "It's about time!".

Using HealthVault, people will be able to store and control an array of health information, including prescription medication lists, health histories, hospital discharge summaries, lab results, fitness data and search results.

In addition to being a place to securely store and share personal health information, people can also use HealthVault to access and put to practical use a variety of new health services and home health medical devices.

Microsoft HealthVault Connection Center will make it possible for people to upload health-related data, such as that taken from blood-pressure cuffs, heart rate monitors, blood glucose monitors and peak flow meters. The technology is straightforward and makes it easy to confidently share health information with family, caregivers or physicians. With the support of partners that will develop these services and devices, Microsoft has committed to a platform that is free to consumers, inclusive of industry standards and trusted through robust privacy and security safeguards.

Speaking of privacy and security, I know that nothing is more important when it comes to your personal health information.  The HealthVault platform is underpinned by the following clear, strong health privacy commitments:

• The Microsoft HealthVault record you create is controlled by you.
• You decide what goes into your HealthVault record.
• You decide who can see and use your information on a case by  case basis.
• Microsoft does not use your health information for commercial purposes unless you are asked and you clearly tell Microsoft they may.

Rest assured, we know that transforming healthcare is an incredibly complex challenge – one which no single organization can solve alone. It will require the participation of leaders in every sector of the healthcare ecosystem if success is to be achieved.  However, with Microsoft's broad customer reach, extensive software platform and broad partner community, we believe that we have the depth and breadth required to help transform the way people and providers connect with health information and  services. 

You can learn more about today's launch of HealthVault by clicking on this video clip with Microsoft Health Solutions Group Corporate VP, Peter Neupert and Dr. Deborah Peel, founder of the Patient Privacy Rights Foundation.

I'm pleased to announce that more than 40 other innovative organizations – from leading medical providers, health management device manufacturers, and national health agencies are embarking with us on this challenge to bring the health industry into the Internet age.  We invite the rest of the health industry to join us. 

Bill Crounse, MD   Worldwide Health Director   Microsoft Corporation

Click below to access the programs

Exchange Hosted Services: Secure email communication and collaboration in healthcare
This program is also available in MP3 for download.

Program Introduction and Guests:

E-mail communication has become the norm for consumers and business people. And when it comes to healthcare, consumers have a growing expectation that they should be able to communicate electronically with their doctor or hospital, just as they do with their bank, retail store, or other service industry provider. Striving to increase efficiency and curb rising costs, healthcare providers are turning to e-mail to replace paper-based communications. But healthcare poses some special challenges when it comes to maintaining confidentiality and privacy. To address issues raised by the Health Insurance Portability and Accountability Act (HIPAA) and other regulatory requirements, healthcare organizations must evaluate and implement organization-wide security best practices and technologies—adding potential complexity and expense to the equation. Finally, there’s a solution for more secure e-mail communication for healthcare: Microsoft Exchange Hosted Services.

Panel guests:

Additional resources

Microsoft Exchange Hosted Services

I hope you enjoy the program!

Bill Crounse, MD         Healthcare Industry Director        Microsoft