Original URL: https://www.theregister.com/2008/10/07/symantec_thompson_privacy_bunk/
'Overplayed' privacy concerns rile Symantec boss
'IP addresses are so not private'
Posted in Channel, 7th October 2008 17:25 GMT
Interview Consumers ought to accept that loss of privacy is the price they pay for using internet service, according to Symantec chief exec John Thompson.
Echoing Scott McNealy's opinion that "you have no privacy, get over it," the Symantec boss expressed surprise that information such as IP addresses is regarded as sensitive.
"Some people think of everything as private, including information such as IP addresses. I don't get that," Thompson told El Reg.
Quizzed about the furore raised when supposedly anonymised search result data was released by AOL and tied back to individuals making searches, Thompson stuck by his guns. "If someone is searching for cancer treatments there is nothing that links that search to the health status of an individual. They could be running the search on behalf of a friend."
Thompson questioned whether there was any likelihood of harm from the release of such information, in contrast to where financial details (for example) are exposed. People need to put privacy concerns in perspective, he contended.
"If you use the net, you are observed. Search results are tracked if you use a public search engine and even if you don't, cookies are placed on your machine to serve up ads by most websites."
Symantec's security products offer the option of deleting tracking cookies. Perhaps Symantec is simply providing customer choice, even to those its chief exec might regard as paranoid.
Thompson's essential argument is that some privacy concerns are overplayed which, he argues, gets in the way of building a more secure internet. He was quite adamant that his views go beyond a simple philosophical difference with the more privacy sensitive who he suggested "live in a cocoon not in the real world."
Symantec's chief exec is not against breach disclosure laws per se but reckons that the loss of encrypted data ought not to be covered by breach disclosure laws so that firms who have protected sensitive data are not affected by the "expense and brand damage" such public notifications bring.
"Businesses have a responsibility to protect sensitive data. The public should not expect the government to protect them," he added.
Follow the money
The Symantec boss made these comments during an interview at the Symantec Vision and ManageFusion EMEA conference in The Hague on Tuesday. Questions by journalists following Thompson's keynote presentation focused on the crisis in the financial markets and the impact it might have on IT spending in areas such as security that Symantec competes in.
"No company is immune if customers have tough times. But security technology is not something that you can just defer. Even in tough times firms don't stop caring about resiliency and recovery. They don't stop caring about about confidential data within their corporate networks."
"The depth and breath of our portfolio allows us to weather the economic storm as well as anyone if not better than most," Thompson argued, adding that regulatory pressure would deter organisations in financial service or health care from taking shortcuts on security spending. "These are highly regulated industries. They may delay new projects but they won't ignore their responsibility to manage sensitive information."
Changes in cybercrime also came up during the session. Malware-based information security threats have changed so that 70 per cent of malware samples are primarily designed to steal confidential and sensitive information. In 2003, Symantec wrote signatures for five different malware samples a day compared to the 10,000 a day it now processes.
"The security model has changed. We are moving towards that is risk based and information-centric instead of looking at device and networks. That makes data classification [assigning more importance to company financial reports than routine office memos, for example] much more critical," he added.
Largely in response to the sheer volume of malware currently been released, many of Symantec's competitors have talked up the benefits of a cloud-based computing approach. Trend Micro, McAfee, and Panda Security have all announced moves in this direction over recent months. Symantec is taking a more conservative approach, positioning security as a service as primarily of interest to smaller businesses or as an option for larger businesses. Other in the anti-virus industry, by contrast, talk about cloud computing as a historic shift in architecture.
Symantec does plan to roll out an online disaster recovery and backup service, currently available only in the US, worldwide by March 2009.
Thompson went on to downplay the significance of mobile malware, at least for the short term, in marked contrast to some of Symantec's competitors including McAfee and F-secure. "Mobile malware is still something that looms in the future rather than a problem now," he said. ®