The illusion of privacy and protection … Legal, Privacy, Ethical Issues Barbara Endicott-Popovsky INFO498

Agenda  I.The Basic Issues  II. The Law  III. Privacy  IV.Ethical Issues  V. Remedies

The Basic Issues Source: Laudon and Laudon. Management Information Systems, 6 th ed. New Jersey, Informatio n Technolog y and Systems Ethical Issues Political Issues Social Issues Information Rights and Obligations Property Rights and Obligations Accountability and Control Systems Quality Quality of Life Individual Society Polity

The Law

The Legal Structure: Criminal vs. Civil Law Criminal Law Civil Law Defined byStatutesContracts Common law Cases brought by Government Individuals Companies Wronged Party SocietyIndividuals Companies RemedyJail, fine Damages, usually monetary

The Legal View of Information  As an object Not depletable Can be replicated Has minimal marginal cost Value is often time dependent Can be transferred intangibly  Legal issues Information commerce Electronic publishing Protecting data in DB e-Commerce Source: Pfleeger & Pfleeger

Complexity of the Legal Issues Tap the keyboard Read the screen? Monitor emissions? Scan the hard drive? Trojan program? Tap communications? Is the data stored? Encrypted? Routed? Has the recipient read it? Stored it? Deleted it? Recovery possible? Who owns the system? Who “gives consent”?

Protecting Intellectual Property (IP)  Copyrights—works of the mind Intellectual Property Digital Millennium Copyright Act  Patents—tangible objects  Trade Secrets—competitive edge info Source: Pfleeger & Pfleeger

Comparing Copyright, Patent and Trade Secret Protection CopyrightPatentTrade Secret Protects Expression of idea, not idea itself Invention—way something works A secret, competitive advantage Protected Object Made Public Yes, intention is to promote pub. Design filed at Patent Office No Requirement to Distribute YesNo Ease of filingVery easy, do-it- yourself Very complicated; specialist lawyer suggested No filing Duration Individual’s life + 70 years 19 yearsIndefinite Legal Protection Sue if unauthorized copy sold Sue if invention copied Sue if secret stolen Source: Pfleeger & Pfleeger

IP Rights of Employees/Employers  Ownership of Products  Ownership of a Patent  Ownership of a Copyright  Work for Hire  Licenses  Trade Secret Protection  Employment Contracts Source: Pfleeger & Pfleeger

Product Liability  Selling correct software  Reporting software flaws Vendor interests User interests Responsible vulnerability reporting Quality Software Source: Pfleeger & Pfleeger

Cryptography Restrictions  Controls on export  Controls on use  Free speech issues  Key escrow issues

Computer Crime  Rules of Property  Rules of Evidence  Threats to Integrity and Confidentiality  Value of Data  Acceptance of Computer Terminology  Hard to Define  Hard to Prosecute US Computer Fraud and Abuse Act US Economic Espionage Act US Electronic Funds Transfer Act US Freedom of Information Act US Privacy Act US Electronic Communications Privacy Act USA Patriot Act

Computer Crime (cont’d.)  International EU Data Protection Act Restricted Content Cryptography Use  Criminals are hard to catch  Law is not precise

Emergence of Computer Forensics  Technology  Law Enforcement  Individual and Societal Rights  Judiciary  …

Privacy

Threats to Privacy  Identity Theft  Aggregation and Data Mining  Poor System Security  Government Threats  The Internet  Privacy vs. Security Concerns  Corporate Rights and Private Business  Privacy for Sale  Controls Authentication Anonymity Computer Voting Pseudonymity The Law—EU Protection Act, HIPAA, Graham-Leach-Bailey Source: Pfleeger & Pfleeger

Examples  Buying and selling confidential information from Social Security files.  Browsing IRS files.  Buying and selling bank account name lists.  : A Princeton University student stole ~1800 credit card numbers, customer names, and user passwords from an e-commerce site. House Ways and Means Committee, 102nd Congress, , Washington Post, S. Barr, 2 Aug (4) Freeh, Testimoney 2000

Skimming – from ABC.com

The FTC Suggests…  Contact the 3 major credit agencies –Check credit –Put “stop” on unapproved new cards –Issue “fraud alert”  Close all accounts –Open new ones w/o mother’s maiden name (use password)  File report in the appropriate jurisdiction  Keep copies of those records –… and now there’s an ID Theft Affidavit, too

Ethics

Ethical Issues  Law vs. Ethics  Ethics vs. Religion Universality ?? Pluralism ??  Ethical Approaches Consequence-based—i.e. utilitarianism Rules-based—deontology Source: Pfleeger & Pfleeger

Codes of Ethics  IEEE  ACM  Computer Ethics Institute  10 Commandments of Computer Use Brookings Institute Source: Pfleeger & Pfleeger

Remedies

Current Business Environment  Legislation is beginning to shape corporate and personal liability. –HIPAA –Gramm-Leach-Bliley –Sarbanes-Oxley –21 CFR part 11 –California Senate Bill 1386

HIPAA  Health Insurance Portability and Accountability Act  Noncompliance = fines  Deliberate noncompliance = fines and imprisonment  Doctors hate compliance

Gramm-Leach-Bliley  “Interagency Guidelines Establishing Standards for Safeguarding Customer Information”  Identify reasonably foreseeable internal and external threats  Assess the likelihood and potential damage of these threats  Assess the sufficiency of policies, procedures, etc…

Sarbanes-Oxley  Increases regulatory visibility and accountability for public companies  Holds CEOs and CFOs personally responsible for accuracy  “Management Assessment of Internal Controls”  ISO – encryption and digital signatures recommended  Why is this a security thing? (hint: lifetime imprisonment)

21 CFR part 11  FDA guidelines on encryption and digital signatures  Integrity of audit trails  Non-repudiation for sign-off  Drug performance liability

California Senate Bill 1386 “Any business or agency that uses a computer to store confidential personal information about a California resident, must immediately notify that individual, upon discovering any breach to the computer system on which this information is stored. Failure to notify the individual(s) could subject the business/agency to civil damages and lawsuits.” Failure to deal with these risks could trigger violations of Sarbanes-Oxley.

Where is all this going?  Government regs never decrease  Universal definitions of “standard of care”  Computer/Electronic security seen as a differentiator  E-risk will be significant for insurance profile  Opportunities !!!

Less Ad Hoc, More Discipline  "Security will be approached not from a bottom-up approach, but rather from a top- down, business-driven philosophy based on risk assessment, policy analysis and then, and only then, technical application," Placer says.  "The days of simply doing a vulnerability scan analysis of hardware will be replaced by a comprehensive analysis for procedural security weaknesses with regards to a company's business practices." Cost/Benefit