Blog 11: Complete Delete
Published on:
The following case study discusses the current solutions regarding the erasure of data from devices/online storage solutions, and the shortcomings of not being able to completely delete things.
Read The Case Study Here:
Complete Delete: In Practice, Clicking ‘Delete’ Rarely Deletes. Should it?
My Thoughts
While the case study proposes solutions that involve permanently wiping data/revoking access in one way or another, I believe that solutions that don’t immediately delete data can be extremely useful, so long as the user knows about it. I for one have had multiple situations in which I’ve needed to recover data off of drives that were otherwise not stored anywhere else, and being able to recover them despite them being seemingly long gone was a life saver. Touching on that last point though, there needs to be a disclaimer when deleting things if that data is truly going to be deleted, and in such cases users should also be notified of how to properly erase things if they wish to do so. Beyond that, it needs to actually be possible to ensure that if a user wishes, that they can irrevocably delete data that’s stored by official means which is most likely to be effective utilizing cryptographic erasure (though cases in which the data becomes saved in other formats, it obviously can’t be removed via this method). If their data is stored in the cloud, for example, they must be allowed to determine themselves if that data persists even after they delete something, not letting companies decide whether or not to hold onto potentially extremely private data.
Cryptographic erasure does have some potential downsides though, as is seen with DRM implementation with online games/software. Though DRM is usually implemented to prevent cracking games and distributing them illegally, it clearly has no reason to continue being in software once it is successfully cracked. It also has the downside of affecting performance of games and requiring periodic internet connection to re-verify them, and it’s for those reasons that some people boycott any game with DRM implementation. As someone who has paid full price for multiple ATLUS games on steam, I can understand where they’re coming from as it’s quite baffling that the offline games I paid full price for are inaccessible without an online connection.
Tangent aside, I think that so long as users are appropriately educated on the matter that not immediately overwriting data is generally a better solution, as it doesn’t come at the cost of performance and can allow for better data recovery solutions. Without education, however, there is a real danger in users not knowing that data they think is gone is not actually fully erased, and especially in the cases of reselling/giving away technology do they absolutely need to know how to completely erase their data and protect their private information. This is all to say that a solution to whether or not indeterminant deletion is better or worse than iterations of complete delete is less about the functions of the solutions themselves, but whether or not the user knows how the specific solution they’re presented with works.
Consider the following
Do you believe DRM implementation in software is generally a good and just solution to preventing piracy? What could be some other solutions that developers might be able to implement (or have already implemented) that could be more effective?
This question isn’t entirely related to the case study, but it has a lot to do with what I wrote in my blog post so I wanted to include it. As for my answer, I agree wholeheartedly with Gabe Newell who states that piracy is a services issue, as I believe that if software is available to purchase already then those who want to buy it will and those who don’t won’t; the purchasers shouldn’t be the ones that have to suffer because of the ones who don’t.
Final Reflection
I didn’t expect this to be as interesting of a read as I thought, but learning about this kind of stuff when my knowledge is pretty limited on it was pretty cool. I am definitely aware of some cases of previously ‘deleted’ things still being stored in cloud services that ultimately leaked to the public (especially the iCloud incident), but never really considered why they happen beyond the simple thought that “these companies aren’t actually deleting anything”. I also didn’t really have as much to say regarding the later discussion questions, but one of them talked about cryptographic erasure so I used it as an opportunity to rant about DRM. Overall, I got quite a bit out of this case study and felt I had some good things to say because of it.