Bob Young<p>Over the weekend I set up an air-gapped computer for use with certain clients. The increasing use of Artificial Intelligence (AI) to analyze data of all types warrants this new operational procedure for my clients with Non-Disclosure Agreements (NDAs).</p><p>Examples of privacy violations are too numerous to count. To give you one example (that doesn’t even use AI), companies have been found guilty of violating user preferences regarding location tracking. Another example: so-called anonymized data has been connected back to the associated sources many times through the use of many methods. The analysis of anonymized data with AI tools makes it even easier to de-anonymize information.</p><p>Major software companies, operating system companies, device manufacturers, and cloud service providers are all actively working to obtain your data.</p><p>Legal protections are lagging behind technology advances.</p><p>Privacy policies are written to confuse. They deliberately include doublespeak and ambiguity.</p><p>Default opt-in is normalized.</p><p>AI systems are leaky. They have information they obtain without your informed consent, and they leak that information in ways the system owners can’t even predict.</p><p>You cannot avoid working with AI-enabled networks, hardware, software, and systems. Even when you try to minimize it, disable it, or reject it, your information is at risk.</p><p>For these reasons, I’m applying the following operational policies for information from any company for which I’ve signed an NDA: </p><p>1) I’m making available file transfer systems that are end-to-end encrypted. The use of these systems is at the client’s option. If they want to send a document as an unencrypted email attachment, they can still do that. I’ll support, and work with, any encryption methods the client chooses.</p><p>2) All information received under an NDA will be moved to the air-gapped system for processing. Even if they send me a document as an unencrypted PDF, I won’t open it with any application until it’s on the air-gapped system.</p><p>These steps don’t protect the client from all risks, but they do allow me to prove due diligence in protecting information provided to FIFO Networks under an NDA.</p><p><a href="https://infosec.exchange/tags/CallMeIfYouNeedMe" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CallMeIfYouNeedMe</span></a> <a href="https://infosec.exchange/tags/FIFONetworks" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FIFONetworks</span></a></p><p><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> <a href="https://infosec.exchange/tags/NDA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NDA</span></a> <a href="https://infosec.exchange/tags/NetworkArchitecture" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NetworkArchitecture</span></a> <a href="https://infosec.exchange/tags/policy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>policy</span></a></p>