Following the endorsement of the data retention bill by the Parliamentary Joint Committee on Intelligence & Security Nic Hodges looks at why it won’t work and the impact it will have on marketing and journalism.
In the last week of February, the Parliamentary Joint Committee on Intelligence & Security endorsed the data retention bill. While most media coverage has rightly focused on the significant threat this bill poses to journalism, there is also the potential for damage to the Australian advertising and media industry, through data breaches and an increase in usage of privacy tools.
What does the data retention bill do?
The bill means that Australian ISPs must collect and store two years’ worth of customer metadata.
While the Attorney-General can’t actually explain what metadata is, the bill states that it does not include IP addresses (which would reveal the exact websites visited by every Australian). The metadata that will be collected are one-to-one communications – who’s talking to who, when, and where. There’s no targeting of individuals; this is blanket collection of the details of every online communication made in Australia.
Why won’t it work?
Except it’s not. The bill is full of holes. While the stated aim is to fight crime (particularly terrorism), non-Australian companies do not have to collect people’s data. So if you use Gmail, no data collection. Facebook? No data collection. The trivial loopholes don’t end there, though, as the bill doesn’t actually cover shared public networks such as public libraries and cafés (ironically, including the Parliament House public WiFi). Internal corporate networks won’t be monitored, and if you use a VPN (which 340,000 Australians already using Netflix seem rather adept at) your metadata cannot be collected.
The arguments for blanket monitoring of a population are just as shaky as the implementation. The “nothing to hide argument” falls apart the moment you remove the myopic assumption that privacy is about secrecy. Any evidence that the metadata of an entire population would actually result in less crime has yet to be produced. Australia’s National Security Hotline received 18 calls regarding Man Haron Monis in the days before he walked into the Lindt Cafe; it’s hard to imagine that metadata could have helped law enforcement do their job better. Even the NSA has admitted that mass surveillance of this kind has not prevented a single terror attack.
On top of the poor implementation and questionable effectiveness of data retention, there’s also the financial consideration. It is estimated that the cost of collecting and retaining people’s metadata will add around $5 per month to the average Australian household’s Internet bill. And although PwC has compiled a report on the estimated costs of data retention, that report has not been made public.
How does the data retention bill affect the marketing industry?
So data retention on an entire population is a bad idea. But how might this bad idea specifically impact brands, agencies, and the marketing industry? Two things marketers should be concerned about are a potential data breach, and an increase in consumers’ use of privacy tools.
The increase in media coverage of data retention has also resulted in increased coverage of privacy tools. Wickr – a mobile app which offers self-destructing, secure messaging – has experienced a 200 per cent surge in Australian Google searches over the past month. In February this year, the revelation that your new Samsung TV might be capturing your private conversations and transmitting them ‘to the cloud’ was front page news in Australia.
Digital advertising today relies on the collection and analysis of metadata in order to deliver more relevant ads. Higher relevance results in higher yields for publishers.
As the Australian public become more aware of the reality and seriousness of privacy issues, the use of tools to regain personal privacy will increase – a potentially costly outcome for Australian publishers and advertisers.
With the introduction of data retention in Australia, privacy tools such as Ghostery, Disconnect and Privacy Badger will become far more widespread. As they do, the ability for brands to connect with relevant digital audiences at scale will drastically decrease.
Data breach is inevitable: start worrying
While the impact of privacy tools will be a slow burn, a data breach will be a sudden explosion.
Some form of data breach is inevitable. In collecting and storing so much personal data, the government is creating a huge target for criminals, foreign intelligence agencies, and bored hackers. The fact that the storage of all this data is the responsibility of ISPs, not the government, makes it even more likely we will see a breach. Big companies get hacked; in the past 12 months alone we’ve seen huge data breaches at companies like Target, Apple, and American Express.
For Australian brands, there are several ways such a breach could be damaging. Using metadata to identify an individual is trivial, and a breach would reveal the customer lists of any brand using, email to communicate. Any eCommerce businesses in Australia communicating with Australian customers will suddenly have a very valuable part of their business visible to anyone who cares to look.
It also wouldn’t be completely paranoid for media executives to worry about a data breach. $12 billion of media is traded every year in Australia in what is still very much a relationship-driven business. While corporate networks won’t be monitored, there will still be plenty of metadata showing which agency buyers are talking with which media vendors, when, and where.
Customer data and agency relationships laid bare are just two potential outcomes from a large data breach. The reality is that it’s hard to predict the outcome until it happens – after all, nobody predicted that the hacking of Sony’s data would result in a global diplomatic crisis.
Data retention will have a significant impact on Australia. It will have a huge impact on journalism. It will have a significant impact on many industries in ways we already know and ways we’re yet to realise. Unfortunately, the only thing it won’t impact is the effectiveness of our law enforcement agencies.
Nic Hodges is the founder of creative technology consultancy Blonde3