ISOC Urges Multistakeholder Approach to Security; EC Official Calls Trust Key

Trust and access are the "existential issues" for the internet, Internet Society President Kathy Brown said Thursday at a webcast European Dialogue on Internet Governance event in Brussels. ISOC is focused on access and security this year, which must be tackled through a multistakeholder approach, she said. Governments generally have bought into the idea of a multistakeholder rather than a top-down process to address online issues, but not in the area of security, she said. Brown urged "collaborative security," where internet problems are fixed at the smallest place where the centralized community is connected.

Universal internet access won't happen if data localization continues, said Pearse O'Donohue, European Commission Directorate General Connect head of software and services-cloud computing. Users worried about privacy mustn't insist on localization because geographic restrictions on data in cloud computing, for example, work against data security, he said. The EC will unveil proposals later this year to remove geographic restrictions, he said.

Trust is key to realizing the full potential of the digital era, said Digital Economy and Society Commissioner Günther Oettinger in a keynote. New technologies such as navigation services for connected cars demand more functions that can't be provided by a sole provider in a single territory, he said. The EC initiative will tackle restrictions on the free movement of data and address the legal uncertainties around data ownership, liability and switching providers, he said.

Oettinger confirmed the EC and U.S. are finalizing improvements to Privacy Shield, the proposal for personal data flows that could replace safe harbor, to address concerns by EU data protection regulators. He said the system could be up and running by summer.

Too few companies are engaged in the multistakeholder dialogue despite their instrumental stake in how the internet develops, said Ross LaJeunesse, Google global head of international relations. Multistakeholder engagement is a valid way of building trust in the internet, but Google has focused on the issue from the beginning by putting users first, he said. People who don't trust an internet company will go elsewhere, he said.

Online risks exist, and people who don't have evidence of a high level of protections won't use the internet, said O'Donohue. The EC has "no embarrassment" about saying there should be a high level of personal data protection, he said. Europe's internet economy is open to all, but its data protection rules must be respected, he said. Much of the privacy debate has centered on mass government surveillance, but the biggest problem is cybercrime and other criminal behavior, O'Donohue said.

There's a clear distinction between government surveillance and business use of data, said LaJeunesse. Government monitoring isn't transparent, while Google gives users complete transparency about the information it collects, he said. While users always have had the option of using Google services as anonymously as possible, most choose to share their data because it makes the site's tools work much better, he said. As to why Google retains the right to scan users' emails on Gmail, LaJeunesse said people sometimes must take responsibility for their actions online. He disagreed with comments that he said implied the search engine doesn't take privacy seriously.

Trust lies in openness, transparency and accountability, but because most people can't understand the terms used in company privacy policies, there must also be "intelligibility," said journalist Matthias Spielkamp, a founder of AlgorithmWatch, an initiative that evaluates algorithmic decision-making processes to predict human actions. Users also have a responsibility to protect their privacy, said Ana Kakalashvili, an attorney who deals with internet governance issues. Companies like Google offer significant measures to safeguard privacy and it's up to users to take advantage of them, she said.