October 28, 2013
Disclosures regarding massive National Security Agency data monitoring have focused substantial attention on the challenge of protecting information privacy. In an effort to offer a more secure data sharing environment, many different companies now provide a variety of products and services that emphasize content security. Yet, even those offerings remain subject to government surveillance and can not provide a totally secure data environment for consumers and businesses.
Snapchat is an example of a product that attempts to provide enhanced security for the content of its users. The Snapchat app enables users to capture photos and videos (“Snaps”) on mobile devices and send them to others through a system that is designed to be more secure than conventional mobile networks.
Within a few seconds after a Snap has been viewed by its recipient, the Snap is automatically erased. The Snap is removed from the mobile device of the recipient. It is also deleted from the Snapchat server which processed it. The only copy of the file that remains is the one on the mobile device of the sender.
The Snapchat system attempts to provide greater data security and privacy by reducing the number of copies of a digital file that are retained in the network. The system is intended to make it more difficult for recipients to share the content. It is also designed to reduce the risk of content access by hackers, criminals, and governments.
Although the Snapchat app offers more security for users, it is not a totally secure environment. A potential vulnerability in the Snapchat system is the ability of Snapchat to retrieve Snaps. Snapchat is able to retrieve Snaps that have been delivered to a recipient’s device but have not yet been accessed by the recipient. Once a Snap has been opened by a recipient, it will be erased and can not be retrieved, but until then, Snapchat can recover the Snap.
It has been reported that government authorities have already begin to make use of the Snap retrieval capability. Apparently, now that government authorities recognize that Snapshot can retrieve unopened Snaps, they routinely seek court orders requiring Snapchat to retrieve targeted Snaps and deliver the snaps to them to assist their investigations. By targeting unopened Snaps, governments can circumvent the enhanced security offered by the Snapchat system.
Snapchat’s experience illustrates the difficulties associated with efforts to provide greater content security and privacy. Even networks and services specifically designed to provide greater security remain vulnerable to monitoring and unauthorized access.
A key component of data security and information privacy is the ability to delete content rapidly and conveniently. Systems such as Snapchat enhance the ability of users to limit access to their content, however, we now see that even these more secure operations can not provide total privacy for businesses and consumers.