On a digital privacy crusade

Best known as the former chief technology officer of Network Solutions, the 45-year-old former cryptographic analyst with the U.S. Navy during the Vietnam War oversaw the growth of the commercial Internet from 500,000 domain names to more than 20 million. He watched in amazement as technology made it easier for marketers to collect and distribute vast amounts of data--everything from the value of homes and stock options to arrest records and death certificates.

Early last year, Holtzman became CEO of Opion, a market research start-up that scoured newsgroups and message boards to determine which anonymous participants were the most influential trendsetters. But $7 million in venture funding dried up by the fall, and the company couldn't raise more money. The Herndon, Va., resident took a hiatus from the daily grind and is teaching an online marketing course at American University, working on a book about privacy, and trying to encourage legislators in the United States and around the world to think creatively about privacy vs. security.

Holtzman fears that, in an effort to protect their reputations and guard their privacy, people who participate in digital society will become polarized into two camps: the "vanilla politicians" and the security-obsessed "curmudgeons." Holtzman talked with CNET News.com reporter Rachel Konrad about virtual schizophrenia, online dating and other facets of the privacy debate.

Why is the privacy debate your pet issue?
I have a degree in philosophy and was an intelligence analyst on submarines for a number of years. Then, I got into computers 15 years ago and built a lot of large-scale information systems. I went to (Network Solutions) and started a company, and now I'm on a bunch of boards and I'm writing. I'm in an interesting position to see a lot of different things.

The conclusion I've come to is that privacy is being treated like a regulatory issue in some parts of the world, but really it's being driven by technology. Technology makes new things available every day--not just blue-sky stuff like nanotech...but Sony digital recorders and Tivo. It's not clear to me what it means if AOL says they won't share information with any third party. Does that include the entire AOL Time Warner family? That's a large portion of the media world. Do I want my information from AOL shared by HBO or Time magazine? We need to find answers to these questions.

Give me an example that most people can relate to about how technology is changing privacy.
You go to a grocery store and swipe your courtesy card. It's clear to me what they could do with that. It's not too bad--it feels like there might be a relationship between you and your grocery store, and maybe they'll give me a special coupon or give me a discount on my bill the next time I come to the store.

But it's another situation altogether if they take that list and merge it with the cell phone list of another company, or they check it with my car's (global positioning satellite) system and get a triangulation map on me. I don't want my grocery store to know that I'm in the neighborhood, even if they send me a coupon to my cell phone. Keep in mind that I don't know who "they" are, but "they" could do that. Technology makes some ugly things that were never before violations doable and simple.

How do you define privacy?
I've been struggling with this. I think it's the ability to control information about yourself to some extent--your personal, private information. It applies to people, communities, governments and companies.

In the 1700s, you probably could have predicted that Pittsburgh and Baltimore and San Francisco would eventually become big cities because of their positions on rivers and lakes and oceans. But relatively few people did that at the time. Now the big issues are privacy, technology and marketing and research. I'm trying to understand what that will mean for us and how they will change our lives.

How much privacy do you personally want or need?
Enough that by simply exercising the right to have it you don't call attention to yourself. There's this peer problem now. When somebody sifts through your data in a grand jury, it doesn't mean you're guilty. But it sure sounds like it. If you send e-mail to somebody and you've got PGP (Pretty Good Privacy file and desktop encryption products) all over it, unless you're (Electronic Freedom Foundation co-founder) John Barlow, it's like you're walking around with tin foil on your head. People think you're a creep and you must be up to no good because you want privacy.

How much privacy does the average online user have?
(Sun Microsystems CEO Scott) McNealy said, "Privacy is dead. Get over it." He's right--in the sense that privacy is complete control over your information. If you think of young college kids, the people who do everything online all the time, everything they're doing leaves a digital footprint, and they won't be able to sweep it away. They may be looking at their thesis papers 30 years from now. That's pretty scary.

So what? Would people behave any differently if they knew a term paper on drug legalization would surface when they're 45 years old?
Yeah, lots of people probably would. It causes people to start acting the way politicians act, trying to hide their tracks...We've seen what's happened to presidential candidates in the past 40 years: They've gotten vanilla. You don't see the extreme people anymore because they're afraid.

I was a child of the late '60s and '70s. I could live lifestyles that I couldn't live now because the consequences weren't very bad. There weren't any records or diseases you could get. But if I were growing up today, and everything I did left a record...well, I probably wouldn't live differently, but I'm on the fringe. Most people probably would do things differently.

You sound like someone who says, "Back in my day, things were better." Doesn't the generation that was raised in a wired world think differently about privacy?
You're right. I have five kids 14 to 22, and I raised them by myself as a single parent until I remarried two years ago. Three of them hit puberty in the same three-year period. That's why my hair's gray.

Here's the difference: They don't use e-mail. They use instant messenger. My one daughter will be talking to the other daughter downstairs on IM. My other daughter is going to college in Pittsburgh, and they know what she's doing at any given time because they're all on IM together. And then there's me: I feel IM is repugnant. It's intrusive, and I couldn't get any work done if I had it on.

This is the new kind of digital divide--those who opt into this culture and those who get into all the privacy stuff. Each one is a different species. The cultures are predicated on privacy, or more accurately, online identity. It's easy to see looking at my kids and me.

What are your thoughts on Passport, Microsoft's controversial strategy to compile personal data such as credit card numbers, addresses and purchase logs?
Microsoft products have this tendency in which the longer you wait to use them, the harder your life becomes. People who used Netscape kept crashing until they finally used Internet Explorer. That's how it's going to be with Passport. It's not going to be a "bang your fist on the table" command from Microsoft to use it; it's going to be the annoyance of rebooting and typing in your credit card numbers in over and over that drives people to use it.

The curmudgeons who don't want to do digital things or give away their privacy are going to be in for a rough ride. It's going to be like trying to live without a credit card today. You couldn't even rent a car.

So we're all going to cave on privacy?
Yeah, I think we're all going to cave. I hate to say that, but we're going to have to deal with it. Because of that, we need to start asking questions and have a cultural understanding of what it all means.

Presumably people who don't use the Internet will still have some shred of privacy. Anyone else?
There are three types of people who will not leave footprints: the very poor, who don't have access to the Internet; the curmudgeons--the men and women who for one reason or another refuse to opt in; and the very wealthy. The very wealthy don't use their own credit cards. If I were a senator or a CEO or movie star, I'd have somebody with me all the time solely for the purpose of using their credit cards. If I were a senator, I'd be pretty damn careful about not using my credit card at a hotel or online.

There's going to be a whole new job--I don't know what you'd call them, maybe credit gophers? They're going to go with the Gordon Gekkos of the world and slap down their credit cards at the hotel and online so their employer doesn't leave a trace. (Gordon Gekko is the acquisitive, unscrupulous arbitrageur who declares, "Greed is good!" in the Oliver Stone classic "Wall Street.")

How do politicians make laws about privacy and online rights? How would you do it differently?
First, there are virtually no laws about privacy and identity. Everyone thinks there are; it's one of the few places where there is a mismatch between intuition and reality. In this case, this is a pretty egregious difference. You have the Judge (Robert) Bork video tape law (which forbids a video rental or sales outlet from disclosing information concerning what tapes a person borrows) but otherwise it's scattershot.

One of the real problems with regulatory issues is that politicians take the extreme fringe issues and form their opinions from there. Take child protection--they mean well, but it results in draconian legislation. Instead, let's go down the middle.

If marketers strip our online identities of privacy, what's to stop us from creating new online identities--or even detaching our online identities from our real identities?
Isn't that what Hotmail is for--free accounts so you can pretend you're not the person you really are and keep evading the spammers? To some extent we already do have different identities online. That's exactly what's happening.

Would that cause a society of schizophrenics--people who toggle divergent personas whenever they turn the computer on and off?
People who are dating online, the gamers, the people who are really rabidly political online--they already have their own virtual identities. It's a question of age and flexibility. Some of us won't make that gap and will go schizo, but others will be able to fade in and out. We already toggle between religion, family, profession. We all swap these masks, and we're OK with that.

The masks aren't necessarily bad, by the way. I met my wife on an Internet dating service. It's an unusual experience when you're dating online. First the person is in digital format, then on paper, then on the telephone, then it's for real. It's pretty effective because you don't have the judgment at first whether they're fat or thin, tall or short. You only hear their voice--whether they're articulate or not. Their soul comes through much more easily.

You don't have an official job these days. What do you do?
I'm in transition now--working with VCs, doing board stuff, writing a book on privacy and digital identity. I'm trying to appreciate what happens when information changes a culture and society. I'm trying to take polarized issues like privacy and clear my head of the garbage everyone is throwing around and ask, "What does this really mean?"

How would you describe yourself politically, at least when it comes to the digital privacy issue?
I'm a forceful moderate. I say that because plain old moderates always sound like wimps. I don't want to call myself a liberal or libertarian; I don't want to take extreme polarized stances on issues like privacy. There's a middle ground, and it's not for wimps. But no one seems to want to take it.