IEEE Technology and Society Magazine - Summer 2014 - 28

VIEWPOINT

GREGORY
CONTI

LISA SHAY

WOODROW
HARTZOG

Deconstructing the Relationship
Between Privacy and Security

rom a government or law-enforcement perspective, one common model of privacy and
security postulates that security and privacy
are opposite ends of a single continuum.
While this model has appealing properties, it is overly
simplistic. The relationship between privacy and
security is not a binary operation in which one can be
traded for the other until a balance is found. One fallacy common in privacy and security discourse is that
trade-offs are effective or even necessary. Consider
the remarks of New York Police Department Commissioner ray Kelly shortly after the Boston Marathon bombing, "I'm a major proponent of cameras. I
think the privacy issue has really been taken off the
table" [1].
Poorly-designed security measures can consume
significant resources without achieving either security
or privacy; others can increase security at the expense
of privacy. However, with careful consideration, there
are solutions that benefit privacy and security.
Organizational consideration of privacy and security is skewed by organizational missions, leadership
opinions, current events, and media coverage, among
numerous other factors. As a result, institutions are
tempted to view either security or privacy as having
an overwhelming importance. Businesses apply economic analyses to determine the appropriate balance
Digital Object Identifier 10.1109/MTS.2014.2319897
Date of publication: 4 June 2014

for their organization. Law enforcement and government officials often heavily weight security. Citizens'
opinions will vary, but are influenced by media coverage, such as the public outcry surrounding the revelations of Edward Snowden.
Those charged with defending national infrastructure are aware of the importance of privacy and
civil liberties. For example, recent policy from the
u.S. Department of Defense seeks to mitigate cyber
security risks, while at the same time "protect and
respect the principles of privacy and civil liberties,
free expression, and innovation that have made cyberspace an integral part of u.S. prosperity and security"
[2]. unfortunately, it is easy to compromise privacy
and civil liberties when seeking to improve security.
Yet, the difficulty in achieving a balance should not
prevent officials from striving for this harmony. We
present a model to guide stakeholders in finding solutions that improve both security and privacy.

Four Quadrants
One reason privacy and security cannot be considered
direct tradeoffs is that implementation is not always
effective. Thus, we conceptualize the effectiveness
of security solutions and their impact on privacy and
civil liberties on continuous spectra ranging from
harmful to beneficial using perpendicular axes as
shown in Fig. 1. The resultant figure contains four
quadrants, each representing a major class of security solution. We describe each class in the following
IEEE TECHNOLOGY AND SOCIETY MAGAZINE

SuMMEr 2014

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - Summer 2014