EPIC - Willis Ware

Willis Ware

A Message from EPIC |
Biography |
Papers by Willis Ware |
The HEW Report |
News Articles |

Willis Ware

Willis Ware

August 31, 1920 - November 22, 2013

A Message from EPIC

"This is a report about changes in American society which may result from using computers to keep records about people. Its central concern is the relationship between individuals and recordkeeping organizations. It identifies key issues and makes specific recommendations for action."

- Willis Ware, chairman, Secretary's Advisory Committee on Automated Personal Data Systems
reprinted in "Records, Computers and the Rights of Citizens" (1973)

With those few sentences, Willis Ware began the most influential report on privacy and technology ever published. Following extensive research, study, meetings, debate, and interviews with people from all walks of life, the Ware committee concluded that it would be necessary to enact a comprehensive privacy law in the United States. It was a recommendation without precedent, ambitious and also prescient. The next year, Congress enacted the federal Privacy Act, still the most extensive privacy law in the United States.

Although the law was complex, it was based on a simple insight that Ware set out in the HEW report — the assignment of rights and responsibilities in the collection and use of personal data in the computer age. Those organizations collecting the data would take on the responsibilities. Those individuals who gave up personal information would get the rights. The principles were called “Fair Information Practices,” and they provided the conceptual foundation for almost all of modern privacy law. Among the key contributions to modern privacy law were the beliefs that there should be no secret record-keeping systems, that individuals should be able to control how information about them is used by others, that information should be accurate, timely, and reliable, and that organizations should use personal information only for appropriate purposes.

Ware was not a critic or skeptic of technology. In fact, he was one of the original architects of the modern-day digital processing device. He worked closely with Dr. John von Neumann at the Princeton Institute for Advanced Studies and helped design one of the first electronic computers. He later worked with Paul Baran on packet switching and distributed communications, which made possible the Internet.

Ware anticipated the personal computer and the smart phone. In the 1960s he wrote, “a small computer may conceivably become another appliance in the home.” He wrote about the impact that the computer revolution would have on employment, education, mobility, and many other aspects of modern life.

Ware also recognized the growing importance of cryptography, the key technique for Internet security, for the emerging network. As chair of the Security and Privacy Board, established by Congress in 1987, he helped loosen controls on the public use of cryptography in the 1990s at a time when many in the defense community sought to maintain harsh restrictions.

Ware drew a sharp distinction between privacy and security. He understood security well. It was critical for the protection of networks and terminals that he helped design. But privacy was his core concern. Security was about protecting machines. Privacy was about protecting people.

Ware joined the EPIC Advisory Board when the organization was established in 1994 and received the EPIC Lifetime Achievement Award in 2012.

Willis was a good friend of EPIC. An active advisor, a generous supporter, and a good mentor, Willis could see the larger picture and still take the time to help us revise Congressional testimony and sharpen a key argument. A few years ago, when Willis’s health was not good and he no longer had an Internet connection in his home, he sent a brief update by fax with this closing line: “Take care and keep going for privacy.”

— Marc Rotenberg

Biography

Willis H. Ware (Ph.D., Princeton University, 1951) was a senior computer scientist emeritus with the RAND Corporation in Santa Monica, California. An electrical engineer, he devoted his career to all aspects of computer technology - hardware, software, architectures, software development, networks, federal agency and military applications, management of computer-intensive projects, public policy and legislation. In 1952 he joined Rand to help build the Johnniac computer, a machine weighing 2.5 tons and comprising 5,000 vacuum tubes. He chaired a Department of Defense committee in the late 1960s that created the first definitive discussion of information system security and treated it as both a technical matter and a policy issue. Later, in the early 1970s he chaired the cabinet-level HEW Committee, whose report was the foundation for the United States Federal Privacy Act of 1974.

Subsequently, President Gerald Ford appointed him to the Privacy Protection Study Commission, whose report remains the most extensive examination of private sector record-keeping practices. Most recently his interests turned to the vulnerabilities of highly automated and computerized information-oriented societies, and the technical and policy aspects of protecting their national information infrastructure.

Dr. Ware was the first and past chairman of the (U.S.) Information System and Privacy Advisory Board, which he chaired for eleven years following its creation. It is a statutory body created by the Computer Security Act of 1987 and advises the United States government on societal impacts of computer technology and broad aspects of the government's information system infrastructure. He also served as the Vice Chair of International Federation for Information Processing (IFIP) Technical Committee 11 from 1985-1994. At the time of his death, he was still serving as a member of the EPIC Advisory Board. EPIC presented Dr. Ware with the Champion of Freedom Lifetime Achievement Award in 2012.

Papers and Interviews by Willis Ware

David Walden, Interview with Willis Ware (pdf), The RAND Corporation, Reprinted with permission from IEEE Annals of the History of Computing, Vol. 33, No. 3, July-September 2011

Willis Ware, RAND and the Information Evolution: A History in Essays and Vignettes (pdf), The RAND Corporation, 2008

Nancy B. Stern, Oral history interview with Willis H. Ware (pdf), Charles Babbage Institute, January 19, 1981

Privacy Protection Study Commission, Personal Privacy in an Information Society, July, 1977

Rein Turn and Willis Ware, Privacy and Security Issues in Information Systems, The RAND Corporation, 1976

Willis Ware, Records, Computers and the Rights of Citizens: Report of the Secretary's Advisory Committee on Automated Personal Data Systems, July, 1973

Willis Ware, Security Controls for Computer Systems: Report of Defense Science Board Task Force on Computer Security - RAND Report R-609-1, originally published 1970, reissued October 1979

Willis Ware, Future Computer Technology and Its Impact, March, 1966

The HEW Report

In 1973, as the chair of the HEW (Health, Education, Welfare) Advisory Committee on Automated Data Systems. The HEW was established under President Eisenhower as part of Reorganization Plan No. 1 of 1953. In 1979, the HEW was split into the Department of Health and Human Services (which encompassed the Social Security Administration until 1995) and the Department of Education.

As chair of this influential and wide-reaching government committee that was wrestling with the increased automation of record keeping, Dr. Ware conceived of "Fair Information Practices", the allocation of rights and responsibilities in the collection and use of personal data.

The Fair Information Practices are based on five core principles:

There must be no personal data record-keeping systems whose very existence is secret.
There must be a way for a person to find out what information about the person is in a record and how it is used.
There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the person's consent.
There must be a way for a person to correct or amend a record of identifiable information about the person.
Any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take precautions to prevent misuses of the data.

Dr. Ware's report that organized these principles, "Records, Computers and the Rights of Citizens," became the foundation of the Privacy Act of 1974. The Privacy Act is the most comprehensive privacy law ever enacted in the United States.