Wednesday, February 24, 2016

Encryption, Apple, the FBI, and Digital Citizenship

Heck of a title right? Wait til you read the story!

Let's face it, Apple, Inc. and the FBI are in the news a lot lately. You'd be hard pressed to visit a major news outlet and not see something about their dispute on the front page.

However, I'm not going to talk about it at any great length. I will say that I side with Apple, and I believe in the security of personal data, plain and simple. I believed this long before I became a librarian, but now I will say that I believe it even more. Encryption is the way to accomplish this, and kudos to any major tech company or online service provider that goes the extra mile to protect their customer's data. Stepping off of my soapbox now.

So how does it tie into Digital Citizenship? Well the connections are there if you look for them, but as I've read about this story I was reminded of a similar moment that happened to me over a year ago.

In my current district, I'm one of a "handful" of folks seen as an "Apple guy". By this, most have identified me as a go to person for questions regarding Apple products. I'm a big fan, use them on a daily basis, so sure, I've been called much worse.

So imagine my surprise when an unsuspecting blue iPhone 5C wound up on my desk with a note. Now, don't get me wrong I love it when Apple products cross my path, but this phone literally came out of nowhere. It didn't look the best, but nonetheless I was intrigued. So like any good librarian, I read the note.

The note was simple;
"Found this in the woods, looks like it had been there a while. We're not Apple people really, but I knew you were. Wondering if you might be able to do something so that we can get this phone back to the right person."

I was floored. Generosity in this day and age is few and far between, but it is there. So I emailed the teacher who'd left the note, asking for a few more details just in case I was successful, and set to work.

I found the proper charger, looked for any debris in the lightning port, and plugged it in, and hoped for the best. To my surprise, 30 minutes later, the home screen flashed to life with the signature Time/Date, default color wallpaper, and the all too familiar "Slide to Unlock" message. There was no cell signal, which told me the owner had disconnected it from their account, but I was still encouraged.

To my surprise, I slid the screen to unlock it, and voila, I was in. Now I was flabbergasted at this point. There was NO security on this device, nothing. After about 5 minutes I was able to find the owner through some amateur investigation. I mean think about it, who doesn't have "Mom" or "Dad" in their contacts? I called one of the parents, told them the story, and they put me in touch with the owner of the phone. They were at my office 2 days later to pick up the device, and thanked me profusely, and told me how the phone had been lost. But now, to paraphrase Paul Harvey, here is "the rest of the story..."

By not putting a pin number on that phone, I had unrestricted access (had I wanted it) to text messages, email, browser history, social media, photographs, all of it. It was all there, ripe for the taking. For all intents and purposes, I could have impersonated that person to some degree. Frightening isn't it?

I stayed only in the contacts, but that information was all right there. These devices have inserted themselves in our lives SO MUCH that we now see them as an extension of ourselves. Phone separation anxiety is a real thing, "phantom vibrations" are real, and insomnia related to notifications are all documented, and let's not forget "digital rehab", these are all real world scenarios that we now face.

When the person came to claim their phone I relayed all of this to them. I was grateful to hand them back their device, as I didn't want that responsibility. I told the person that while it was in my possession I put a pin number of my own on the device to protect it, and kept it in a locked drawer. By the time our conversation was over, their attitude had changed from "happy to get their phone back" to "this could have really done some harm to me" in about 5 seconds, flat.  Keep in mind that I didn't do this to "scare" them, that was not my intent, AT ALL. All I was wanting to do was inform them, and I think I did that. We talked about steps they could take in the future, I told them about "Find My iPhone" and a few other important features for them to know, and sent them on their way.

That was a moment that I will forever refer to as my "Digital Citizenship" moment. Now I know that each and everyone treats their phones differently, and that is fine. But please people, if you're reading this ask yourself this "How much of my life would a person have access to if they got into my phone?". Once you've answered that question, do some research, and take the steps necessary to protect your digital self.