Opinion: Where’s my data and who owns it?

A long time ago I worked for an information security firm. In one of the classes that I took – an animated and spunky instructor asked “what is the most secure computer system in the world?” Me and the other participants answered with technical solutions involving things like firewalls and encryption systems and the instructor stood there smiling and waiting with a Cheshire grin.

Once we all finished he paused for a few seconds and then answered the question with “the most secure computer system in the world is a system that is in a bunker connected to an isolated power source with a closed door and a soldier standing in front that door with an M-16 rifle”. One of my peers protested with “that’s not fair – if the system is not connected to a network, then what’s the point?”

That was the ‘aha’ moment for me about data security and the tug of war between data security and connectivity/usefulness. At the time of this class there were very few networks and the Internet as we know it today did not fully exist.

Fundamentally, there is no data security when you are surfing around the net. Your browser is a speed boat that moves from one information island to another, and data sucking barnacles keep collecting on the bottom under the waterline and out of sight. The difference of course from real barnacles is that you ‘data barnacles’ are quickly connected and stored (cookies, super cookies, trackers, etc…). Unfortunately, you can never wash/scrub/scrape them out like physical equivalents.

Surfing is one thing – but what about a specific relationship with a company? What about a ‘paid’ customer relationship versus a ‘free’ one? I’ve been thinking about this recently when interacting Evernote.

I started using Evernote as an alternative to del.icio.us when del.icio.us went downhill but I never became a paid user. My data usage was always below the max allowed for free users and as time passed I used Evernote less and less.

Recently, I came across the possibility that Evernote would go out of business and this made me think of the data the I accumulated over time. What would happen if they got purchased by another company…how would my data be treated? Who would it be sold to?

So I went down the rabbit hole of trying to get my data deleted. I wanted to email Evernote support but there was no way to do it from their website nor from my logged in account. Twitter saved the day and I got into their ticketing system through the Evernote Twitter responder. Through this person I received an email from a support person (Ms. S). I emailed back and forth about removing my account and my data. Below is my communication with Evernote.

The back and forth with Evernote in pictures

Initial ‘contact’ pages on website did not provide access to any support person

Maybe the ‘support’ page will have something.

Initial 'contact' pages on website did not provide access to any support person

‘Support’ page provided no mechanism to contact a support human

Support page was a dud. Onto Twitter.

'Support' page provided no mechanism to contact a support human

Twitter rules in reaching someone at Evernote

Evernote’s Twitter human responder rocks!

Twitter rules in reaching someone at Evernote

I finally have a ticket to Evernote due to Twitter

I finally have a ticket to Evernote due to Twitter

OK – so I followed your procedures for account deletions but…

“Hard deleting data” – interesting? So how many storage and back-up storage mechanisms does Evernote have?

OK - so I followed your procedures for account deletions but...

But wait….what…so where’s my data? Did you delete my data? What happens if someone acquires your company?

But wait....what...so where's my data?  Did you delete my data?  What happens if someone acquires your company?

Conclusion

This whole interaction left me in this fuzzy territory of feeling that my data is still out there regardless of my request for its removal. I suspect the same support path would apply even if I was a paid customer.

I suppose that my hypocrisy was in thinking of Evernote as a library rather than a company. Whereas librarians care about their user’s privacy companies don’t because that’s not their business model. This doesn’t make Evernote ‘evil’ or ‘good’. Google typically gets the good/evil arguments though it applies to companies in general (though as a sidenote – Google’s Data Liberation Front is an interesting approach in dealing with this very issue…kudos to Google for addressing this upfront).

If I willingly gave my data to Evernote then what does make me? I could claim ignorance…’I didn’t know you guys would never let my data go’ but that’s a stupid excuse. My data is only safe in a locked room on a computer that’s connected to an isolated power supply and nothing else. But when my data is this safe it is also pretty useless. How many pages could I have stored on Evernote without a network connection? Zero pages of course. Was the utility of Evernote worth it? This is the same question that can be applied to all other ‘free’ services:

  • Is the utility of Gmail worth it?
  • What about Google docs?
  • What about Office 365?
  • What about all the free services that I use all over the web?

I don’t know if there’s any good solution to any of this. Perhaps I should have chosen Pinboard as my post-del.icio.us bookmarking service. Maybe a dude developing in his underpants is more trustworthy than a corporation. Then again – maybe not.