When surveillance is a feature, not a bug

There’s a saying you’ll hear in certain tech circles: There is no cloud, just other people’s computers.

The cloud is, of course, the vast collection of distant databanks we use to back up our vacation photos, search the Web, make online purchases, find the quickest route home and do pretty much everything else. It is owned by unaccountable corporations, is regularly accessed by police and intelligence agencies and creates a convenient gold mine of credit card numbers, nude photos and other private data for malicious hackers to steal.

And increasingly, using it is no longer optional.

With the July release of its Windows 10 operating system, Microsoft has made the border between using your computer and using other peoples’ computers blurrier than ever before. Privacy advocates are warning about a host of default settings that make automatic sharing of data the new normal — from your voice and typing patterns to unique machine IDs that help advertisers identify, track and target you with personalized ads, even on your device’s lock screen. Basically, all the privacy worries of your smartphone and Web browser are now a regular part of a major desktop operating system.

This isn’t really a surprise. Microsoft’s previous iteration, Windows 8, laid the groundwork for a fully cloud-integrated operating system that phones home an alarming amount of user information and activity. Windows isn’t alone either: By default, users of Mac OSX and Ubuntu Linux unwittingly transmit local search terms to their respective companies as well as to third parties. Unless these settings are changed (learn how for Mac and for Ubuntu), these companies analyze everything users type into the search box to find a file or app on their hard drives, along with unique IDs and location data.

Windows 10 suggests that this trend is here to stay. Take Cortana, the operating system’s personal digital assistant, similar to Apple’s Siri. Cortana uses a feature called Getting to Know You — enabled by default — which allows Windows to automatically record, analyze and share your speech and typing patterns, as well as your location, contacts, calendars and more. We’re told this is for our own good because these kinds of apps, Siri and Google Now included, need our personal data in order to be useful. When the data are sent to Microsoft (or Apple or Google, plus any law enforcement agency or third party that the companies’ arcane terms of service agreements allow) they’re used to improve the algorithm that responds to our queries. There’s no way around this; it’s simply how the app was designed to work.

It’s the ultimatum that mainstream technology companies keep offering us: Either we give up our privacy to use the latest apps and features or we opt out and miss out. Accept the defaults or get left in the dust. Conform or die.

Even when people choose the former, in reality, they’re hardly ever consciously choosing anything. Defaults are powerful decisions that software companies make for us, and it’s always easier for users to do nothing — especially when they’re told it’s for their benefit. Studies have consistently shown that users rarely change their default settings, and companies that design software know it.

Companies rarely make changing these defaults easy. All of Windows 10’s privacy settings are hidden during the setup process unless a difficult-sounding customized installation is chosen. (The recommended setup is called Express.) Similarly, users who want to use their Windows PC without attaching it to a cloud-based Microsoft login need to click through two additional options to use a local account.

Even with Cortana disabled and all options toggled for maximum privacy, closer inspection shows that Windows 10 is still reporting some of your keystroke data to Microsoft. Additional behavioral data collection can be disabled only by editing system files — something no average user would do. Others can’t be disabled unless you’re using an enterprise version of Windows 10. These design choices that intentionally make desirable user behaviors easy and undesirable ones difficult are known as dark patterns.

Telling nontechnical, privacy-concerned people to stop using the cloud is thus not only misguided but also implausible. What consumers deserve (and what developers should be giving them) are cloudless alternatives that deliver the same convenience and features that Microsoft, Apple, Google and other companies offer.

The current options are sadly lacking, but some developers have started building systems that challenge the centralized cloud model. Cloud-free file storage and backup have gotten easier in recent years, thanks to apps such as BitTorrent Sync and SyncThing, which allow users to create a private peer-to-peer network that keeps files in sync among all their devices. Other projects are more ambitious. A software platform called Ethereum hopes to eventually offer applications that run entirely on distributed peer-to-peer technology similar to the digital currency bitcoin, rather than on centralized servers. Key to Ethereum’s plans are so-called smart contracts and decentralized autonomous organizations, entities that act like corporations but are entirely governed by machine logic and immune to human interference.

The basic idea is that smart contracts can mediate and notarize transactions (a business deal, for example) without the need for a human or corporation in the middle. They can also be used to run distributed applications that fill the same roles as the current cloud-based ones. With strong encryption and no corporate middleman, these applications could offer the same functionality as cloud apps such as Cortana and Siri, with fewer privacy concerns.

These ideas are still in their infancy, but we need to consider them seriously now if we want an alternative to personal devices that are dependent on corporate-controlled clouds. New technology shouldn’t offer a choice between giving up our privacy to live like the Jetsons and defending it to live like the Flintstones. For now, the quest to stay current without surrendering our privacy and autonomy remains elusive.