To see the video here.
Sunday 30 October 2011
Viktor Mayer-Schönberger presents "Delete: The Virtue of Forgetting in the Digital Age"
To see the video here.
Thursday 27 October 2011
"Custodial sentences should be introduced for breaches of the Data Protection Act"
"Using deception to obtain personal information – sometimes known as blagging – or selling it on without permission are serious offences that can cause great harm.
Fines are used to punish breaches of data protection laws, but they provide little deterrent when the financial gain exceeds the penalty.
Magistrates and Judges need to be able to hand out custodial sentences when serious misuses of personal information come to light. Parliament has provided that power, but Ministers have not yet brought it into force - they must do so."
The report is available here.
Wednesday 26 October 2011
ECJ decision in Martinez case
I've yet to read the decision, but it looks to be an interesting one. The court's press release (here), which provides a useful overview for those not wishing to read the full decision, describes the outcome as:
"Victims of infringements of personality rights by means of the internet may bring actions before the courts of the Member State in which they reside in respect of all of the damage caused. However, the operator of an internet website covered by the e-commerce directive cannot be made subject, in that State, to stricter requirements than those provided for by the law of the Member State in which it is established."
Fortunately - in my opinion - the UK does not (yet?) recognise a "personality right."
Monday 24 October 2011
Facebook audit set to begin amidst claims of unlawful personal data storage
I doubt that Data Protection Commissioner in Ireland will find evidence against Facebook-Irland !
see full text.
Privacy blunders by UK biz soar, websites least trusted
Friday 21 October 2011
Every movement of Syrians online is monitored
Wednesday 19 October 2011
German states defend use of 'Federal Trojan'
...
Samples of the so-called R2D2 (AKA "0zapftis") Trojan came into the possession of the Chaos Computer Club (CCC), which published an analysis of the code last weekend.
....
Local government officials said the Trojan was used within the law, contrary to CCC's claims. Bavarian Interior Minister Joachim Herrmann said local authorities had acted within the law but nonetheless offered to review the use of the technology. Full text here
Tuesday 18 October 2011
more on this on here.
Nokia Near Field Communications and privacy study project
Amongst the conclusions reached, the research team opines that:
The current approach to choosing between “opt in” and “opt out” is inadequate for NFC applications. Although consent is an important part of the perception of having control of one’s privacy, users cannot adequately asses how effective and at what point the individual knows when there is a default opt in or opt out...
The key danger is that the discussion of privacy in this domain will degenerate into debates over ‘regulation’ vs. ‘innovation’, as we have seen in so many other technology policy debates. For NFC to thrive, privacy must be considered in the design of the technology, the platforms, and the services.
"Markey to Amazon: Don’t Hold a Kindle Fire Sale on Privacy "
Of course, using server-side technology to speed up browsing is nothing new - Opera, for example, does it, as does RIM in its BlackBerry system, and there are likely more BlackBerry users than there are / will be of the Kindle Fire, but, given Amazon's clout, it could be an interesting debate, especially given the pressure on network operators / ISPs around use of customer browsing data.
Update: I had forgotten something on which I was asked to advise a few years back - Vodafone's UK operating company implemented a network-based rendering engine / proxy for Novarra for re-rendering webpages - a self-titled rant about the issue here. Many similar, and probably wider, issues.
Monday 17 October 2011
Defense Department Sued Over Security Breach
this may be of your interest. An interesting case of data breach (of sentitive...real sensitive!) data leaked from an US organization.
Regards,
Salva
http://www.computerworld.com/s/article/9220874/Defense_Dept._hit_with_4.9B_lawsuit_over_data_breach
*********
The lawsuit seeks $4.9 billion, or $1,000 for each of the 4.9 million people affected.
Computerworld - The U.S. Department of Defense has been hit with a $4.9 billion lawsuit over a recently disclosed data breach involving TRICARE, a healthcare system for active and retired military personnel and their families.
The lawsuit, filed in federal court in Washington D.C. this week by four people whose data was allegedly compromised, seeks $1000 in damages for each of the 4.9 million individuals affected by the breach.
The suit charges TRICARE, the Department and Defense Secretary Leon Panetta with failing to adequately protect private data and of "intentional, willful and reckless disregard" for patient privacy rights.
TRICARE did not respond immediately to a request for comment.
In the complaint, the four plaintiffs faulted TRICARE for failing to properly encrypt the private data in its possession and for taking too long to notify victims of the breach.
The four plaintiffs are Virginia Gaffney, a Hampton, Va.-based individual who described herself in court papers as the spouse of a decorated war veteran; her two children; and Adrienne Taylor, a Glendale, Az. Based Air Force veteran.
TRICARE in September disclosed that sensitive data including Social Security Numbers, names, addresses, phone numbers and personal health data belonging to about 4.9 million active and retired U.S. military personnel may have been compromised after unencrypted backup tapes containing the data went missing.
The information on the tapes was from an electronic healthcare application used to capture patient data. The backup tapes were stolen from the car of an employee at Science Applications International Corp. (SAIC), a TRICARE contractor. The breach affects all those who received care at the military's San Antonio area military treatment facilities between 1992 and Sept. 7. 2011.
Lawsuits such as this one have become increasingly common in the immediate aftermath of a major data breach.
Earlier this month, for instance, Stanford Hospital and Clinics was hit with a $20 million proposed class action lawsuit for a data breach involving a third-party contractor. And major breaches such as the ones at Heartland Payment Systems, TJX and Hannaford Bros. have all prompted their share of consumer lawsuits charging the companies with negligence, breach of contract and other charges.
In many cases, courts however have tended to dismiss lawsuits in data breach cases. Several courts have held that consumers cannot claim compensatory or punitive damages in data breach cases unless they can demonstrate that they have suffered actual monetary damage as the result of a breach.
The notion that someone might become the victim of ID theft in future because of a data breach cannot be used as a basis for claims, courts have held.
One exception was in the Heartland case, where the company agreed to pay $4 million to settle claims stemming from several class-action lawsuits.
"Assessing the Privacy Impact of Deep Packet Inspection"
A pre-print version of the paper is available from Alissa's website, here.
Sunday 16 October 2011
Perhaps jumping ahead
The tale is perhaps more relevant to the computer crime part of the module. I know though that I have received a good number of emails of this kind. Being perhaps rather cynical, I've always taken the view that there are mechanisms for a genuine victim to get help without emailing hat are often casual acquaintances.
I think the story (and many others like it) does illustrate how we are struggling to fit our lives into the new patterns of behaviour associated with the Internet. We know that it is not wise to walk through a strange city carrying large amounts of money or wearing expensive watches or items of jewellery. Its more difficult on the Internet and perhaps also we are more dependent on intermediaries such as Google. Maybe we all need to have back up email accounts? And back ups of back ups?
Friday 14 October 2011
Undermining the respect for Privacy – a hidden agenda?
I thought that other students particularly US nationals may find this of interest. Whilst I was researching privacy I came upon the New-born Screening for Genetic and Metabolic Disorders Act (I think that is the correct title or something very similar). What I found interesting is that the Act, intended to be used to establish genetic abnormalities in new-borns, may have a more sinister application. Although US legislation is not my forte it appears prima facie that this Act gives unprecedented access to the DNA profiles of all US New-borns (born after 2007/8). Furthermore, it appears that parents/guardians do not have to give consent for the clinicians to take samples.
What surprises me is the apparent lack of protest against such a database. If a government body is to administer the database, what is to stop other agencies in the future such as the FBI using the database for criminal investigation? If all new-borns have their DNA profiles taken then eventually the US will have an absolute DNA database excluding only those who are born without medical supervision.
In Europe the ECtHR case – S and Marper v United Kingdom [2008] ECHR 1581 was a clear indication of the illegality of collecting such databases. For example, in Scotland if you commit a non-serious crime your DNA profile taken at the police station will be destroyed within a set period. Although, in England and Wales the Home Office is much more unsure on how it should proceed.
Should information which is derived from a biological source be of greater importance for protection? And if so should the state face specific legal obligations for its safe and secure eradication? Most of the Home Office literatures are guidelines.
Wednesday 12 October 2011
Freedoms Bill may infringe on individuals' privacy rights, Parliamentary committee says
Parts of a proposed civil rights law threaten the UK's compliance with human rights obligations and infringe on individuals' rights, Parliament's Human Rights Joint Committee has said.11 Oct 2011
http://www.out-law.com/en/articles/2011/october/freedoms-bill-may-infringe-on-individuals-privacy-rights-parliamentary-committee-says/
Monday 10 October 2011
Privacy protections in Act apply to all electronic communications stored in the US, court rules
I would like to share with you this topic, related to US law privacy (source Out-law.com);
A law which gives US citizens certain rights to privacy over their electronic communications also gives protection to non-US citizens if their data is stored on US servers, a US court has ruled. (06 Oct 2011)
you can find the full text on:
http://www.out-law.com/en/articles/2011/october/privacy-protections-in-act-apply-to-all-electronic-communications-stored-in-the-us-court-rules/
I would argue that this law may apply to US and non-US citizens as long as the data is stored in the US domain.
any other views?
Ban
A little bit gory
Comments?
Sunday 9 October 2011
Starting work in earnest
The time has come to talk about subjects in more detail. The first part of this posting is generic to all the modules and if you are connected to other blogs you will see it repeated there. The second part will be specific to Legal Aspects of Information Security.
Let me start by talking a little about what we expect of you and the way in which the course is structured. Each module lasts for 12 weeks and is divided into 4 themes. At the end of the theme we ask you to submit a reflective report on your experiences of and thoughts on the topics covered. Specific dates will come out later in the week.
There might appear to be a daunting amount of material in each theme. If it is of comfort, you are not expected to read it all at this stage. When we move to the middle of the semester you will be given topics for the end of semester essays. At the risk of giving away state secrets, there will be 4 topics. With 4 topics and 4 themes you might draw an obvious and correct conclusion. If you choose to write an essay on a particular topic, you will be expected to do a good deal of research and the materials will be of great value to you then.
I suggest that you listen first to a podcast. For information secuirity there are about 15 in total, slightly more than one per week k of the semester. You might then look at the chapters in my book and the course notes (often the same). I'll try either in the podcasts or in postings here to indicate key items of reading. I would like you to start (if you are not already used to) reading cases and statutes. Don't worry, especially if you do not have formal legal qualifications if you don't understand everything. It does take time and for now you will be fine with secondary sources, such as my book, which will summarise materials for you.
Very importantly, if you feel you don't understand something, ask. The teachers are here to help you. By all means email me privately although I will tend to post replies - without identifying people - to this blog. Almost invariably, if one student has an issue, others will have the same difficulty. I really would encourage you to post queries to this forum. There is no shame in admitting to doubt. I near constantly send off (and receive) emails from colleagues along the lines 'I've been looking at this case and am not sure if I understand what it is about. This is what I think, but it may be nonsense'. Two or more minds are always better than one.
I'm often asked how much time you need to spend on the course and that is always a very difficult question to answer. There are so many variables in terms of experience and language skills and also, quite important, your own expectations. What I would say is that you need to spend a lot of time on your end of module essay (which will count for 60% of the final mark). The bulk of that work will have to be carried out in December and January. If you can book some holiday for that period, it might be helpful.
You were admitted to the course because we believe that you can pass. We believe that you can pass without giving up every other aspect of your life. Indeed you will probably damage your studies if you try to devote every spare waking moment to them. Do your honest best, take some time off, and I think it will be good enough.
Turning to Information Security, we have a fairly gentle introduction although many of the issues are quite complicated. How do we strike a balance between rights of privacy and the right to receive an impart (publish) information. We have had something of a watershed moment in the UK with the ongoing controversy about phone hacking carried out by newspapers. One example included the hacking of a voice mailbox from a phone belonging to a missing teenager who was subsequently found murdered. Although I think the evidence is a bit limited, it appears that the hackers had erased messages giving a false impression that the unfortunate woman might still have been alive and possibly hindered the police investigation.
What you might think about, is what privacy means to you. I tend to think that the term anonymity is perhaps more appropriate. We live large parts of our lives in public spaces - and there is an issue whether the Internet is public space - and we can have limited expectations of absolute privacy. We may not wanted to be identified as individuals, however.
Lots of issues then. For your reading I do commend the reports on the Surveillance Society and Wnat price privacy?
Please do post your thoughts and comments.
Best
Ian
Youtube lectures of surviellance and public places.
Friday 7 October 2011
The Legal Aspects of Information Security Blog
All students on the module can post their own comments and also respond to postings made by other members.
Please try to do both.
Best
ian