Financial Times: "EU eyes big fines for privacy breaches"

An interesting piece on the FT website, about the upcoming review of the DP directive.

5% of turnover is a substantial fine...

Businesses breaching European Union privacy rules will face fines of up to 5 per cent of their global turnover under sweeping proposals to be unveiled next month.

In the first significant update of data protection legislation since 1995, companies found to have mishandled any personal data they hold – be it of their customers, suppliers or their own employees – will face the highest levels of fines, which could extend to billions of euros for large multinationals.

EU Seeks to Simplify Cross-border Data Protection Compliance

At a conference in Paris organized by the International Association of Privacy Professionals, Viviane Reding has suggested that companies can set their own privacy rules, as long as they do not contradict with one national data protection authority.

See full text here

'Unenforceable' right to be forgotten should not be included in new EU data laws, ICO says

Revisions to EU data protection laws should not give individuals a general 'right to be forgotten', the Information Commissioner's Office (ICO) has said.

Giving individuals the right to force organisations to delete the personal information they store them about would be misleading, unenforceable and have "implications" for free speech, the UK's data protection watchdog said.


Interesting !  also there is text which says that:

The European Commission recently announced that it plans to publish formal proposed changes to the EU Data Protection Directive by the end of January. EU Justice Commissioner Viviane Reding has said that a qualified 'right to be forgotten' would be included in the proposals.

For full text see here

Web standards body proposes universal 'do not track' system

The body responsible for making sure components of the world wide web work together has published plans to help create a universal 'do not track' mechanism in web browsers that would give users control of their privacy settings across all sites.
:
:
W3C said it hopes its DNT standards will be in operation from the middle of next year and that they will provide an "exceedingly straightforward" way for internet users to control their privacy.

for full text see here.

F.T.C. Said to Be Near Facebook Privacy Deal

After Google's 20y of external privacy audit, now it's time for Facebook.

Interesting stuff, although not more than common sense.

Under the agreement, Facebook would agree to privacy audits for 20 years, one of the people said. It would also prohibit Facebook from making public a piece of information that a user had originally shared privately on the site without express permission, the person said. The

I am wondering if there is need for a settlement to enforce what would be probably implicit in EU regulations?

http://www.nytimes.com/2011/11/11/technology/facebook-is-said-to-be-near-ftc-settlement-on-privacy.html

Have a nice weekend,
Salva

An overview of the different cybercrime laws

Hi,

while googling for something different I've found this overview of the different laws (world wide) related to cybercrime. This may be useful for the ones of you dealing with the cybercrime theme now (or soon).

regards,
Salva

http://ec.europa.eu/enlargement/taiex/dyn/create_speech.jsp?num=16431

Police must justify use of communication interception technology, lawyer says

The Metropolitan Police Service (MPS) has bought technology that will allow it to intercept and shut-off communications without the help of telecoms companies, according to media reports.

:

Police and other law enforcement bodies have the power to intercept communications under the Regulation of Investigatory Powers Act (RIPA) subject to approval by the Home Secretary.

:
Under the Human Rights Act individuals are guaranteed the right to privacy surrounding their communications other than if a public authority, such as the police, believe it necessary to interfere with that right "in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others".

:

Full report here

Having these equipments owned by the Police would allow them to perform surveillance on any telephone they may consider (the tel. number) belongs to a suspect... !

Explicit prior consent needed for personal data processing, EU Commissioner says

Organisations that want to process personal data will have to obtain explicit prior consent from individuals to do so under new EU data protection laws, the EU Justice Commissioner has said.

for full text see here

It also talks about the right for the individuals to remove data, they posted, from the Internet..

Data loss

Sorry I've not posted lately, I have been unwell. I hope to post more this weekend. Anyway, here is a website I have found very interesting:

https://www.annualcreditreport.co.uk/identity-theft/data-loss/1094/great-western-hospital-wiltshire.htm

It lists a lot of recent and historic data losses many of which I was unaware of. I think it's useful to know and relevant as a reference.

Hope everyone is well.

600K facebook accounts hacked daily + study on social network's data scraping

Facebook has released an official communication regarding the way it secures the data of its users.
from these data, it can be inferred that about 600.000 accounts are hacked daily ! (isn't this... HUGE?)

http://www.pcmag.com/article2/0,2817,2395402,00.asp#fbid=auDt9W2DPrZ

Also it's interesting their concept of "trusted friends" that can help the user to recover its authentication data if he loses access to its account.
However, interesting to see that the concept of "friend" is personal and 10% of users keep accepting requests from anyone (including the bots created by the authors of this paper in order to scrape personal use data).

http://www.theregister.co.uk/2011/11/01/facebook_infiltration_bots/

Also, the fact of having a friend in common would raise the % of people accepting a new connection to 50%... definitely to be kept in mind if facebook wants us to rely on friends to ensure the accounts security ;)

Regards,
Salva

Should Huawei Do Business in Iran?

Interesting to see that to achieve privacy of individuals, technology should not be provided to the government of Iran and facilitate the surveillance of their nation!

 A pressure group called United Against Nuclear Iran has called on Huawei Technologies Co. Ltd. to immediately end its business in Iran because, according to the group, the vendor has been "been providing the Iranian regime with cellular and electronic technology that it has used to conduct surveillance on its citizens, and track down human rights activists and dissidents."

Here is the full text

Viktor Mayer-Schönberger presents "Delete: The Virtue of Forgetting in the Digital Age"

A book talk with professor Viktor Mayer-Schönberger who examines the technology that is facilitating the end of forgetting in his book, "Delete: The Virtue of Forgetting in the Digital Age". Mayer-Schönberger argues that in our quest for perfect digital memories where we can store everything from recipes and family photographs to work emails and personal information, weve put ourselves in danger of losing a very human quality—the ability and privilege of forgetting.

To see the video here.

"Custodial sentences should be introduced for breaches of the Data Protection Act"

The Justice Committe - a committee of the House of the Commons - has published a report arguing in favour of custodial sentences for breaches of the Data Protection Act 1998, with considerable input from Christopher Graham, the current Information Commissioner:

"Using deception to obtain personal information – sometimes known as blagging – or selling it on without permission are serious offences that can cause great harm.

Fines are used to punish breaches of data protection laws, but they provide little deterrent when the financial gain exceeds the penalty.

Magistrates and Judges need to be able to hand out custodial sentences when serious misuses of personal information come to light. Parliament has provided that power, but Ministers have not yet brought it into force - they must do so."

The report is available here.

ECJ decision in Martinez case

The ECJ has ruled in the joined Martinez and eDate cases (joined cases C‑509/09 and C‑161/10) - you can find the judgment here.

I've yet to read the decision, but it looks to be an interesting one. The court's press release (here), which provides a useful overview for those not wishing to read the full decision, describes the outcome as:

"Victims of infringements of personality rights by means of the internet may bring actions before the courts of the Member State in which they reside in respect of all of the damage caused. However, the operator of an internet website covered by the e-commerce directive cannot be made subject, in that State, to stricter requirements than those provided for by the law of the Member State in which it is established."

Fortunately - in my opinion - the UK does not (yet?) recognise a "personality right."

Facebook audit set to begin amidst claims of unlawful personal data storage

A group calling itself Europe v Facebook is claming that Facebook-Irland's processing and storage of personal data violates EU data protection laws. Also they claim that Facebook-Irland is building 'shadow profiles' of individuals not registered in Facebook (ex.being invited to join Facebook).

I doubt that Data Protection Commissioner in Ireland will find evidence against Facebook-Irland !
see full text.

Privacy blunders by UK biz soar, websites least trusted

Interesting article on a survey findings from the UK Information Commissioner, that more violation of data protection was reported in 2011, in both private and public sectors.

The ICO report mentioned below:

Businesses ‘waking up’ to data protection responsibilities

Privacy blunders by UK biz soar, websites least trusted

Surprise! Public confidence in data protection declines

By Kelly Fiveash

Data security breaches within the private sector are rapidly increasing, the UK's Information Commissioner warned today.

Information Commissioner Christopher Graham said that the number of such violations reported to the ICO was up 58 per cent so far in 2011/12, compared with the same period last year.

The watchdog revealed those findings following a survey of 2,500 UK-based individuals and 800 businesses.

A disconnect between the private sector's greater understanding of its data protection responsibilities and a drop in public confidence of the handling of such information was unsurprisingly uncovered in the survey.

“I’m encouraged that the private sector is waking up to its data protection responsibilities, with unprompted awareness of the [Data Protection] Act’s principles higher than ever," said Graham.

"However, the sector does not seem to be putting its knowledge to good use. The fact is that security breaches in the private sector are on the rise, and public confidence in good information handling is declining."

He reminded businesses that a fine of up to £500,000 could be slapped on companies that fail to comply with the Data Protection Act.

Graham also pointed out that a brand's reputation could be damaged "when data is not handled properly".

The ICO, in its report, pinpointed web-based outfits where public concern about personal data was at its highest. It said "almost three-quarters of individuals believe that online companies are not keeping their details secure". ®

Every movement of Syrians online is monitored

In the context of repression in the Middle East and North Africa, surveillance technology has played a key role in providing authoritarian regimes with the tools necessary to track citizens online. Among these companies, BlueCoat has proved to be the most efficient in helping the Syrian regime control every movement of Syrians on the Internet

Check the whole article here

Aside from the political side of the story, any comments?

German states defend use of 'Federal Trojan'

Five German states have admitted using a controversial backdoor Trojan to spy on criminal suspects.

...

Samples of the so-called R2D2 (AKA "0zapftis") Trojan came into the possession of the Chaos Computer Club (CCC), which published an analysis of the code last weekend.
....
Local government officials said the Trojan was used within the law, contrary to CCC's claims. Bavarian Interior Minister Joachim Herrmann said local authorities had acted within the law but nonetheless offered to review the use of the technology. Full text here

"Cloud computing and data protection"

Watch out for this new technology of Cloud computing:

Cloud computing is more than simply a technical challenge. By putting our personal data on remote servers, we risk losing control over that data. Because the right to the protection of personal data is a fundamental right in the EU, this demands several actions. Fundamentally, the Commission believes that we need further research to enhance the security features of these technologies. And indeed we are funding such research at European level – which looks at "privacy-by-design" and "privacy-enhancing technologies".

more on this on here.

Nokia Near Field Communications and privacy study project

Last night, the LSE and Nokia released the Nokia Near Field Communications and privacy study project - you can download the final report here.

Amongst the conclusions reached, the research team opines that:

The current approach to choosing between “opt in” and “opt out” is inadequate for NFC applications. Although consent is an important part of the perception of having control of one’s privacy, users cannot adequately asses how effective and at what point the individual knows when there is a default opt in or opt out...

The key danger is that the discussion of privacy in this domain will degenerate into debates over ‘regulation’ vs. ‘innovation’, as we have seen in so many other technology policy debates. For NFC to thrive, privacy must be considered in the design of the technology, the platforms, and the services.

"Markey to Amazon: Don’t Hold a Kindle Fire Sale on Privacy "

US congressman Ed Markey has written an interesting letter to Amazon, about its Silk browser (and, more importantly, its back end servers), focussing on the privacy implications of its design - his letter is available here.

Of course, using server-side technology to speed up browsing is nothing new - Opera, for example, does it, as does RIM in its BlackBerry system, and there are likely more BlackBerry users than there are / will be of the Kindle Fire, but, given Amazon's clout, it could be an interesting debate, especially given the pressure on network operators / ISPs around use of customer browsing data.

Update: I had forgotten something on which I was asked to advise a few years back - Vodafone's UK operating company implemented a network-based rendering engine / proxy for Novarra for re-rendering webpages - a self-titled rant about the issue here. Many similar, and probably wider, issues.

Defense Department Sued Over Security Breach

Hi,

this may be of your interest. An interesting case of data breach (of sentitive...real sensitive!) data leaked from an US organization.

Regards,
Salva


http://www.computerworld.com/s/article/9220874/Defense_Dept._hit_with_4.9B_lawsuit_over_data_breach
*********

The lawsuit seeks $4.9 billion, or $1,000 for each of the 4.9 million people affected.

Computerworld - The U.S. Department of Defense has been hit with a $4.9 billion lawsuit over a recently disclosed data breach involving TRICARE, a healthcare system for active and retired military personnel and their families.

The lawsuit, filed in federal court in Washington D.C. this week by four people whose data was allegedly compromised, seeks $1000 in damages for each of the 4.9 million individuals affected by the breach.

The suit charges TRICARE, the Department and Defense Secretary Leon Panetta with failing to adequately protect private data and of "intentional, willful and reckless disregard" for patient privacy rights.

TRICARE did not respond immediately to a request for comment.

In the complaint, the four plaintiffs faulted TRICARE for failing to properly encrypt the private data in its possession and for taking too long to notify victims of the breach.

The four plaintiffs are Virginia Gaffney, a Hampton, Va.-based individual who described herself in court papers as the spouse of a decorated war veteran; her two children; and Adrienne Taylor, a Glendale, Az. Based Air Force veteran.

TRICARE in September disclosed that sensitive data including Social Security Numbers, names, addresses, phone numbers and personal health data belonging to about 4.9 million active and retired U.S. military personnel may have been compromised after unencrypted backup tapes containing the data went missing.

The information on the tapes was from an electronic healthcare application used to capture patient data. The backup tapes were stolen from the car of an employee at Science Applications International Corp. (SAIC), a TRICARE contractor. The breach affects all those who received care at the military's San Antonio area military treatment facilities between 1992 and Sept. 7. 2011.

Lawsuits such as this one have become increasingly common in the immediate aftermath of a major data breach.

Earlier this month, for instance, Stanford Hospital and Clinics was hit with a $20 million proposed class action lawsuit for a data breach involving a third-party contractor. And major breaches such as the ones at Heartland Payment Systems, TJX and Hannaford Bros. have all prompted their share of consumer lawsuits charging the companies with negligence, breach of contract and other charges.

In many cases, courts however have tended to dismiss lawsuits in data breach cases. Several courts have held that consumers cannot claim compensatory or punitive damages in data breach cases unless they can demonstrate that they have suffered actual monetary damage as the result of a breach.

The notion that someone might become the victim of ID theft in future because of a data breach cannot be used as a basis for claims, courts have held.

One exception was in the Heartland case, where the company agreed to pay $4 million to settle claims stemming from several class-action lawsuits.

"Assessing the Privacy Impact of Deep Packet Inspection"

With so many debates at the moment about the sancitity of browsing data, and in particular with reference to ongoing discussions about net neutrality, the issue of deep packet inspection keeps cropping up. Alissa Cooper, of the Centre for Democracy and Technology and the Oxford Internet Institute, has just published a paper on the subject, which "assess[es] how the privacy impact of DPI varies depending on the context and attempt[s] to outline a practical definition of DPI" - it might be of interest.


A pre-print version of the paper is available from Alissa's website, here.

Perhaps jumping ahead

Many of you may already have seen this report from the Guardian newspaper.  It concerns a case where a third party obtained access to a GMail account and, inter alia, sent emails to everyone on the account owner's contact list claiming that she had been robbed in Madrid and pleading for them to lend her money.

The tale is perhaps more relevant to the computer crime part of the module. I know though that I have received a good number of emails of this kind. Being perhaps rather cynical, I've always taken the view that there are mechanisms for a genuine victim to get help without emailing hat are often casual acquaintances.

I think the story (and many others like it) does illustrate how we are struggling to fit our lives into the new patterns of behaviour associated with the Internet. We know that it is not wise to walk through a strange city carrying large amounts of money or wearing expensive watches or items of jewellery. Its more difficult on the Internet and perhaps also we are more dependent on intermediaries such as Google. Maybe we all need to have back up email accounts? And back ups of back ups?

Undermining the respect for Privacy – a hidden agenda?

I thought that other students particularly US nationals may find this of interest. Whilst I was researching privacy I came upon the New-born Screening for Genetic and Metabolic Disorders Act (I think that is the correct title or something very similar). What I found interesting is that the Act, intended to be used to establish genetic abnormalities in new-borns, may have a more sinister application. Although US legislation is not my forte it appears prima facie that this Act gives unprecedented access to the DNA profiles of all US New-borns (born after 2007/8). Furthermore, it appears that parents/guardians do not have to give consent for the clinicians to take samples.

What surprises me is the apparent lack of protest against such a database. If a government body is to administer the database, what is to stop other agencies in the future such as the FBI using the database for criminal investigation? If all new-borns have their DNA profiles taken then eventually the US will have an absolute DNA database excluding only those who are born without medical supervision.

In Europe the ECtHR case – S and Marper v United Kingdom [2008] ECHR 1581 was a clear indication of the illegality of collecting such databases. For example, in Scotland if you commit a non-serious crime your DNA profile taken at the police station will be destroyed within a set period. Although, in England and Wales the Home Office is much more unsure on how it should proceed.

Should information which is derived from a biological source be of greater importance for protection? And if so should the state face specific legal obligations for its safe and secure eradication? Most of the Home Office literatures are guidelines.

Freedoms Bill may infringe on individuals' privacy rights, Parliamentary committee says

Ian talks in his podcast how the UK is not fully complying with the European Convention on Human Rights directives in relation to privacy rights.  Here is a related article on which areas requires reforms:

Parts of a proposed civil rights law threaten the UK's compliance with human rights obligations and infringe on individuals' rights, Parliament's Human Rights Joint Committee has said.11 Oct 2011
http://www.out-law.com/en/articles/2011/october/freedoms-bill-may-infringe-on-individuals-privacy-rights-parliamentary-committee-says/

Privacy protections in Act apply to all electronic communications stored in the US, court rules

Hi All,

I would like to share with you this topic, related to US law privacy (source Out-law.com);

A law which gives US citizens certain rights to privacy over their electronic communications also gives protection to non-US citizens if their data is stored on US servers, a US court has ruled. (06 Oct 2011)

you can find the full text on:
http://www.out-law.com/en/articles/2011/october/privacy-protections-in-act-apply-to-all-electronic-communications-stored-in-the-us-court-rules/


I would argue that this law may apply to US and non-US citizens as long as the data is stored in the US domain.

any other views?

Ban

A little bit gory

But for anyone interested in the trails we leave behind on the Internet this story from the BBC Website   makes fairly compelling reading.

Comments?

Starting work in earnest

Dear All,

The time has come to talk about subjects in more detail. The first part of this posting is generic to all the modules and if you are connected to other blogs you will see it repeated there. The second part will be specific to Legal Aspects of Information Security.

Let me start by talking a little about what we expect of you and the way in which the course is structured.  Each module lasts for 12 weeks and is divided into 4 themes. At the end of the theme we ask you to submit a reflective report on your experiences of and thoughts on the topics covered. Specific dates will come out later in the week.

There might appear to be a daunting amount of material in each theme. If it is of comfort, you are not expected to read it all at this stage. When we move to the middle of the semester you will be given topics for the end of semester essays. At the risk of giving away state secrets, there will be 4 topics. With 4 topics and 4 themes you might draw an obvious and correct conclusion. If you choose to write an essay on a particular topic, you will be expected to do a good deal of research and the materials will be of great value to you then.

I suggest that you listen first to a podcast. For information secuirity there are about 15 in total, slightly more than one per week  k of the semester. You might then look at the chapters in my book and the course notes (often the same). I'll try either in the podcasts or in postings here to indicate key items of reading. I would like you to start (if you are not already used to) reading cases and statutes. Don't worry, especially if you do not have formal legal qualifications if you don't understand everything. It does take time and for now you will be fine with secondary sources, such as my book, which will summarise materials for you.

Very importantly, if you feel you don't understand something, ask. The teachers are here to help you. By all means email me privately although I will tend to post replies - without identifying people - to this blog. Almost invariably, if one student has an issue, others will have the same difficulty. I really would encourage you to post queries to this forum. There is no shame in admitting to doubt. I near constantly send off (and receive) emails from colleagues along the lines 'I've been looking at this case and am not sure if I understand what it is about. This is what I think, but it may be nonsense'. Two or more minds are always better than one.

I'm often asked how much time you need to spend on the course and that is always a very difficult question to answer. There are so many variables in terms of experience and language skills and also, quite important, your own expectations. What I would say is that you need to spend a lot of time on your end of module essay (which will count for 60% of the final mark). The bulk of that work will have to be carried out in December and January. If you can book some holiday for that period, it might be helpful.

You were admitted to the course because we believe that you can pass. We believe that you can pass without giving up every other aspect of your life. Indeed you will probably damage your studies if you try to devote every spare waking moment to them. Do your honest best, take some time off,  and I think it will be good enough.


Turning to Information Security, we have a fairly gentle introduction although many of the issues are quite complicated. How do we strike a balance between rights of privacy and the right to receive an impart (publish)  information. We have had something of a watershed moment in the UK with the ongoing controversy about phone hacking carried out by newspapers. One example included the hacking of a voice mailbox from a phone belonging to a missing teenager who was subsequently found murdered. Although I think the evidence is a bit limited, it appears that the hackers had erased messages giving a false impression that the unfortunate woman might still have been alive and possibly hindered the police investigation.


What you might think about, is what privacy means to you. I tend to think that the term anonymity is perhaps more appropriate. We live large parts of our lives in public spaces -  and there is an issue whether the Internet is public space -  and we can have limited expectations of absolute privacy. We may not wanted to be identified as individuals, however.


Lots of issues then. For your reading I do commend the reports on the Surveillance Society and Wnat price privacy?


Please do post your thoughts and comments.


Best


Ian

Youtube lectures of surviellance and public places.

I usually play a video while eating my lunch. That increases my appetite to some level. While I was browsing youtube looking for a good catch, I found few lectures for Lewis R. Katz and other professors from Case Western Reserve University, titled as Surveillance and privacy in an age of national insecurity, given in 4 panels.

As a comparative study, that added much to my knowledge in such field and it worked very well for my appetite today.

Thought of sharing this with my distant classmates & everyone.

http://bit.ly/qBf96s

from such link, it would be easy to follow the other 3 panels

Thank you all

Welcome

A warm welcome to this blog.

Regards

Steve Saxby

The Legal Aspects of Information Security Blog

Welcome to this new site.

All students on the module can post their own comments and also respond to postings made by other members.

Please try to do both.

Best

ian