Building trust in digital infrastructure

All of us have a digital self, an online persona who engages with the cyber world.

Even those without internet access often have a digital identity created for them by a third party. You could live in a village without electricity, for example, but if you’ve received assistance from a Non-Governmental Organisation (NGO), that organisation has likely created a digital record for you.

Nowhere in the Sustainable Development Goal (SDG) manifesto is the term ‘digital’ used. Yet in aiming to achieve Target 9.1 – quality, reliable, sustainable and resilient infrastructure – we must ensure the world’s digital infrastructure can also uphold these qualities.

Often our dealings with banks, the tax department, airlines, even something as innocuous as buying a sandwich at our local café, requires us to hand over phenomenal amounts of digitised personal information. Increasingly, our data is held by third parties standing between us and the actual service provider: when booking an appointment with a doctor we can be obliged to do so via an organisation that is not a medical facility, but which demands all manner of deeply personal information, including a summary of our health concerns. How securely is this information held, for how long, and ultimately, by whom?

I research how organisations can strengthen their data related communication to help ensure individuals’ information can be rendered more resilient against theft, misuse, and exploitation by bad actors.

Cybersecurity is now a major infrastructure challenge for every organisation. Small business and NGOs are particularly weak portals, often lacking sufficient resources to install resilient systems, whilst at the same time dealing with the most vulnerable members of our community.

As customers, consumers, or unwilling cyber participants, we are all at risk of a data breach. Generally, there is an asymmetry in the power relations between individuals and the organisations demanding our personal information.

Our research is looking at two changes that would improve the security of data infrastructure. These focus on the issue of appropriate disclosure with the aim of facilitating public conversations that elevate people’s sense of safety and participation. A well-designed disclosure regime is also likely to encourage improved data practices as organisations work to maintain trust.

The first improvement would be to mandate annual public disclosure of data breaches and digital risks. This annual digital health check would contribute to a historical repository, serving as a central portal of information that all organisations could reference for self-assessment.

The second improvement would require hacked organisations to inform their customers precisely which of their personal information has been breached, enabling individuals to take appropriate remedial actions. Currently individuals are at the mercy of the organisations regarding the information shared with them about the cyber breach. This includes whether or not the breach reaches the legal threshold that requires individuals be informed if the information used to establish their digital identity has been stolen.

We need to move to a situation where once an organisation has verified a person’s identity, that information is wiped from the organisation’s database. This will limit the amount of information available to criminal networks and hence their ability to identify (and exploit) individuals. A legislated limit on the length of time organisations can hold identification data will also help reduce the amount of personal information that can be stolen by bad actors.

The primary means of improving infrastructure resilience is via legislation. Governments must compel organisations to deal more robustly with our data. That includes requiring organisations practice good digital hygiene and exercise a duty of care in helping their customers, in the event of a data breach.

Our future will be digital. We need agile digital infrastructures backed by robust regulation to participate safely in that future. To achieve that, data related disclosures that encourage informed public discussions about organisational practices will be critical.

Resources