80
Privacy of Information & Communications

Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

  • View
    223

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy of Information & Communications

Page 2: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

PrivacyPrivacy

freedom from unauthorized intrusion freedom from unauthorized intrusion <one's right to privacy><one's right to privacy>

Merriam Webster’s Collegiate DictionaryMerriam Webster’s Collegiate Dictionaryhttp://www.m-w.com/http://www.m-w.com/cgicgi-bin/dictionary-bin/dictionary

freedom from interference or intrusionfreedom from interference or intrusion

Oxford English DictionaryOxford English Dictionaryhttp://dictionary.http://dictionary.oedoed.com/.com/cgicgi/entry/00188918/entry/00188918

Page 3: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

AgendaAgenda

Computers and privacyComputers and privacy Threats to privacyThreats to privacy Protecting privacyProtecting privacy Three dilemmasThree dilemmas

Individuals and privacyIndividuals and privacy Organizations and privacyOrganizations and privacy Governments and privacyGovernments and privacy

Privacy policyPrivacy policy

Page 4: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy and ComputersPrivacy and Computers

Why so Important?Why so Important?

Page 5: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy and ComputersPrivacy and Computers

Computers are not necessary for Computers are not necessary for the invasion of privacythe invasion of privacy

Computers embody many threats Computers embody many threats to privacyto privacy

Computers make it faster and Computers make it faster and easier to violate privacyeasier to violate privacy

Much of our private information is Much of our private information is just ‘out there’ in computersjust ‘out there’ in computers

Page 6: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Government and private databasesGovernment and private databases

RisksRisks Unauthorized use by “insiders”Unauthorized use by “insiders” Inadvertent leakage through Inadvertent leakage through

negligence, carelessness, hackingnegligence, carelessness, hacking Propagation of errorsPropagation of errors Intentional: marketing, decision Intentional: marketing, decision

making, surveillancemaking, surveillance Cross-matching filesCross-matching files

Page 7: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Threats to PrivacyThreats to Privacy

Page 8: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Government and private databasesGovernment and private databases

Ministry of the InteriorMinistry of the Interior Ministry of HousingMinistry of Housing IDFIDF National Security National Security Pension FundsPension Funds Income TaxIncome Tax BanksBanks Hospitals and Sick FundsHospitals and Sick Funds Schools & universitiesSchools & universities

Page 9: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Government and private databasesGovernment and private databases

Libraries Club memberships Employers Airlines and travel agencies Car registration Telephone companies Census …

Page 10: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Government and private databasesGovernment and private databases

Individually, most do not pose much Individually, most do not pose much threat to privacythreat to privacy

Collectively, a lot!Collectively, a lot!

Page 11: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

HackingHacking

Hacking tips are widely availableHacking tips are widely available Threat to privacyThreat to privacy Trying different passwords is trivial Trying different passwords is trivial

hackinghacking use hard-to-crack password!use hard-to-crack password!

Page 12: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

MonitoringMonitoring

Employee Monitoring -Employee Monitoring -

how much should one tolerate?how much should one tolerate?

Page 13: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

MonitoringMonitoring

"Firms Crack Down on E-Mail"USA Today (06/28/00) P. 2B; Yaukey, John Employers are increasingly monitoring workers' email and Internet use due to concerns about liability and lost productivity. Roughly 45 percent of U.S. companies monitor employees' electronic activities such as email, Internet use, and voice mail, and that figure is expected to rise in the future, according to the American Management Association.

Page 14: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

MonitoringMonitoring

Some employees who view monitoring as an invasion of their privacy have taken the issue to court, but judges tend to uphold a company's right to monitor equipment that belongs to the firm.

Page 15: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

PrivacyPrivacy

Private data are used in matching Private data are used in matching and profiling to provideand profiling to provide Personal/group benefitsPersonal/group benefits

Loan - support applicationLoan - support application Job applicationJob application

Public interest protectionPublic interest protection Tax evasionTax evasion Criminal surveillance and Criminal surveillance and

identificationidentification

Page 16: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Consumer InformationConsumer Information Released through:Released through:

Marketing surveyMarketing survey Making donationsMaking donations Making purchasesMaking purchases ““Transaction-generated information”Transaction-generated information”

Data mining to find out moreData mining to find out more Often collected without awarenessOften collected without awareness

Invisible information gatheringInvisible information gathering cookiescookies

Page 17: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

DoubleClick Inc.DoubleClick Inc.

Page 18: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

DoubleClick Inc.DoubleClick Inc.

A leading provider of comprehensive A leading provider of comprehensive global Internet advertising solutions for global Internet advertising solutions for marketers and Web publishers.marketers and Web publishers.

Ties individuals' names, addresses, Ties individuals' names, addresses, phone numbers, and emails to phone numbers, and emails to information collected through cookies information collected through cookies ((on-line profilingon-line profiling) without consent) without consent

Page 19: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Consumer InformationConsumer Information

Result may cause inconvenience, Result may cause inconvenience, embarrassment and threatembarrassment and threat e.g. list of consumers who are e.g. list of consumers who are

likely to buy products for adults likely to buy products for adults who are incontinent was made who are incontinent was made publicpublic

junk mailjunk mail

Page 20: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Medical RecordsMedical Records

How much is protected?How much is protected? Can insurance company access Can insurance company access

everything? everything? Can one check on AIDS Can one check on AIDS

patients?patients?

Page 21: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

WiretappingWiretapping

Interception of a communication Interception of a communication in a telephone or computer in a telephone or computer networknetwork

Page 22: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

WiretappingWiretapping

Telephone bugging now extends to Telephone bugging now extends to wiretapping on fax transmission, wiretapping on fax transmission, email, voice mail and computer email, voice mail and computer networksnetworks

Account numbers, passwords, Account numbers, passwords, PINs used to be obtainable from PINs used to be obtainable from touch tones; now they are in touch tones; now they are in emails, or web communicationsemails, or web communications

Page 23: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Threats to PrivacyThreats to Privacy

Subject: Find Out (ANYTHING) About (ANYONE) !Date: Sun, 27 Aug 2000 18:03:58 +0300 (IDT)"CYBER INVESTIGATOR'S ASSISTANT (CIA)"

Shows you how to get the facts on anyone.

CONFIDENTIALThe SOFTWARE They Wanted BANNED In all 50 States! Why? Because these secrets were never intended to reach your eyes....Get the facts on anyone using the Internet!

It's absolutely astounding! Here's some of what you can learn:

Page 24: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Threats to PrivacyThreats to Privacy

License plate numbers!Get anyone's name and address with just a license plate number! (Find that girl you met in traffic!)

DRIVING RECORDS! Get anyone's driving record!

Social security number! Trace anyone by social security number!

ADDRESSES! Get anyone's address with just a name!

Unlisted phone numbers! Get anyone's phone number with just a name - even unlisted numbers!

LOCATE! Long lost friends, relatives, a past lover who broke your heart! Now with Full Internet Search.

E-mail! Send anonymous e-mail completely untraceable!

Page 25: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Threats to PrivacyThreats to Privacy

Dirty secrets! Discover dirty secrets your in-laws don't want you to know!

Investigate anyone! Use the source that private investigators use (all on the Internet) secretly!

Ex-spouse! Learn how to get information on an ex-spouse that will help you win in court! (Dig up old skeletons)

Criminal search-Background check! Find out about you daughters boyfriend! (or her husband)

Neighbors! Learn all about your mysterious neighbors! Find out what they have to hide!

Page 26: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Threats to PrivacyThreats to Privacy

People you work with!

Be astonished by what you'll learn about people you work with!

Education verification! Did he really graduate college? Find out!

CYBER INVESTIGATOR'S ASSISTANT (CIA)

Software will help you discover ANYTHING about anyone, with click able hyperlinks and no typing in Internet addresses!

LIMITED TIME OFFER: ORDER TODAY!

Only $19.95 USOnly $19.95 US

Page 27: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

PrivacyPrivacy

Page 28: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

PrivacyPrivacy

Three key aspects:Three key aspects: Freedom from intrusionFreedom from intrusion Control of information about Control of information about

oneselfoneself Freedom from surveillanceFreedom from surveillance

Privacy is given up for many Privacy is given up for many activitiesactivities

Page 29: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

PrivacyPrivacy

Factors to consider:Factors to consider: Safeguarding individual and Safeguarding individual and

group privacygroup privacy Collecting information for Collecting information for

rational decision makingrational decision making Conducting surveillance within Conducting surveillance within

laws to protect public order and laws to protect public order and safetysafety

Page 30: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

EncryptionEncryption

Cryptography – “the art and Cryptography – “the art and science of hiding data in plain science of hiding data in plain sight”sight”

To transform a message or To transform a message or data into a form that is data into a form that is meaningless to anyone who meaningless to anyone who might intercept it.might intercept it.

Page 31: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

EncryptionEncryption Uses:Uses:

Electronic transfer of fundsElectronic transfer of funds Passwords and PINs for consumer Passwords and PINs for consumer

transactiontransaction Credit card numbersCredit card numbers Bank records and financial dataBank records and financial data Sensitive business communicationsSensitive business communications Research and product informationResearch and product information Personal data and communicationsPersonal data and communications Test resultsTest results

Page 32: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

EncryptionEncryption

Cyphertext – the coded Cyphertext – the coded messagemessage

Decryption – the decoding Decryption – the decoding processprocess

Key – a specific sequence of Key – a specific sequence of characters for coding/decodingcharacters for coding/decoding

Page 33: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

EncryptionEncryption

Example of an encryption key:Example of an encryption key:qwertyuiopasdfghjklzxcvbnmqwertyuiopasdfghjklzxcvbnm

““a” becomes “q”a” becomes “q” ““b” becomes “w”b” becomes “w”Etc. Etc.

Page 34: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Public Key CryptographyPublic Key Cryptography

Beforehand, key must be known to Beforehand, key must be known to both partiesboth parties

Public key and private keyPublic key and private key Encrypting key is made publicEncrypting key is made public Public key (of the recipient) is used Public key (of the recipient) is used

to encrypt message sentto encrypt message sent Private key is used to decrypt by Private key is used to decrypt by

the recipientthe recipient

Page 35: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

PGP (Pretty Good Privacy)PGP (Pretty Good Privacy)

A program developed by Philip A program developed by Philip Zimmermann using public key Zimmermann using public key cryptography for emailscryptography for emails

Provides protection of emails Provides protection of emails from wiretappingfrom wiretapping

Widely and freely availableWidely and freely available

Page 36: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

PGP (Pretty Good Privacy)PGP (Pretty Good Privacy)

Welcome to the MIT Distribution Center Welcome to the MIT Distribution Center

for PGP (Pretty Good Privacy)for PGP (Pretty Good Privacy) http://web.http://web.mitmit..eduedu/network//network/pgppgp.html.html

Page 37: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Digital SignaturesDigital Signatures

Some public key cryptography Some public key cryptography schemes allow the reversal of schemes allow the reversal of public and private keys to provide public and private keys to provide digital signaturesdigital signatures A person accepts an electronic A person accepts an electronic

document and encrypts it with his document and encrypts it with his private key. Recipient can then private key. Recipient can then decrypt the document with the decrypt the document with the public key.public key.

Page 38: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy ProtectionPrivacy Protection

File wipingFile wiping simple ‘del’ or ‘rm’ removes only simple ‘del’ or ‘rm’ removes only

file name from index; trash leaves file name from index; trash leaves it in place until emptiedit in place until emptied

random over-writing with ‘0’ and random over-writing with ‘0’ and ‘1’ provides better protection‘1’ provides better protection

many ‘wipe’ utilities existmany ‘wipe’ utilities exist Empty cacheEmpty cache

Page 39: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy ProtectionPrivacy Protection

Choosing a good passwordChoosing a good password Never use common phrasesNever use common phrases RandomizeRandomize Change frequentlyChange frequently

Forgotten your passwordForgotten your password many websites offer services to many websites offer services to

recover lost datarecover lost data

Page 40: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy ProtectionPrivacy Protection Get a separate email account for Get a separate email account for

personal emailpersonal email Clear your memory cache after Clear your memory cache after

browsingbrowsing Make sure that online forms are secureMake sure that online forms are secure Reject unnecessary cookiesReject unnecessary cookies Opt-out of third party information Opt-out of third party information

sharingsharing Use anonymous remailersUse anonymous remailers

Page 41: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Three DilemmasThree Dilemmas

Page 42: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Maintaining PrivacyMaintaining Privacy

Three DilemmasThree Dilemmas For individuals: how to obtain good For individuals: how to obtain good

service without compromising their service without compromising their privacy?privacy?

For businesses: how to provide good For businesses: how to provide good service without offending service without offending customers?customers?

For governments: how to prevent For governments: how to prevent misdeeds without compromising misdeeds without compromising individual privacy?individual privacy?

Page 43: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

IndividualsIndividuals

Page 44: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy the reason for ‘off-line’?Privacy the reason for ‘off-line’?

Page 45: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate
Page 46: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

http://www.cdt.org/privacy/quiz/http://www.cdt.org/privacy/quiz/

Page 47: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Anonymity and PseudonymityAnonymity and Pseudonymity

Hide identity for self-protection:Hide identity for self-protection: voice out against governmentvoice out against government voice out against employervoice out against employer “ “off” the recordoff” the record

Use pseudonymous remailersUse pseudonymous remailers Programs available for anonymous Programs available for anonymous

Web browsing, email encryption, Web browsing, email encryption, and chat room anonymity and chat room anonymity

Page 48: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Anonymity and PseudonymityAnonymity and Pseudonymity

Allowing Allowing anonymity/anonymity/

pseudonymitypseudonymity

Free Free SpeechSpeech

== ??

Page 49: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

IndividualsIndividuals

Many Online Taking Privacy Into Their Own Many Online Taking Privacy Into Their Own HandsHands    

By JUBE SHIVER JR., Times Staff WriterBy JUBE SHIVER JR., Times Staff Writer

WASHINGTON--The nation's Internet users WASHINGTON--The nation's Internet users want stronger privacy protections in want stronger privacy protections in cyberspace and many resort to using fake cyberspace and many resort to using fake names, dummy e-mail accounts and data names, dummy e-mail accounts and data scrambling software to preserve their scrambling software to preserve their anonymity, a new study has found. anonymity, a new study has found.

August 21, 2000

Page 50: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

IndividualsIndividuals

The study, by the Pew Research Foundation in The study, by the Pew Research Foundation in Washington, reported that 84% of Internet users Washington, reported that 84% of Internet users said they are concerned about businesses said they are concerned about businesses invading their privacy online. By that count, invading their privacy online. By that count, commercial Web sites outranked even hackers, commercial Web sites outranked even hackers, considered a privacy threat by only 68% of those considered a privacy threat by only 68% of those surveyed. surveyed.

"There is broad-based concern about privacy "There is broad-based concern about privacy being compromised," said Lee Rainie, the director being compromised," said Lee Rainie, the director of the study. Americans, Rainie added, "'want the of the study. Americans, Rainie added, "'want the golden rule of the Internet to be: 'Don't do golden rule of the Internet to be: 'Don't do anything unto me unless I give you permission.' "anything unto me unless I give you permission.' "

Page 51: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

IndividualsIndividuals

Yet even as they express anxiety about being Yet even as they express anxiety about being monitored online, consumers' ability to protect monitored online, consumers' ability to protect their privacy is hampered by their unfamiliarity their privacy is hampered by their unfamiliarity with the basic mechanics of Internet data with the basic mechanics of Internet data collection. collection.

For example, 56% of Internet users surveyed For example, 56% of Internet users surveyed said they did not know what an Internet said they did not know what an Internet "cookie" is. So-called cookie files are unique "cookie" is. So-called cookie files are unique identifiers many Web sites place on visitors' identifiers many Web sites place on visitors' computers in order to be able to track their computers in order to be able to track their online movements. online movements.

Page 52: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

IndividualsIndividuals

Many computer users--even those who buy Many computer users--even those who buy goods online--are simply "unaware that their goods online--are simply "unaware that their computers' hard drives are implanted with computers' hard drives are implanted with cookies," the report said. cookies," the report said.

The study also noted that despite their The study also noted that despite their privacy worries, many Web surfers do a privacy worries, many Web surfers do a striking number of intimate and trusting things striking number of intimate and trusting things online, such as responding to e-mail from online, such as responding to e-mail from strangers or making their personal address strangers or making their personal address books or appointment schedules accessible books or appointment schedules accessible online. online.

Page 53: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

OrganizationsOrganizations

Page 54: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

The newest high-level position: Chief Privacy OfficerCompanies are hiring them to ease consumers' concerns in this

age of the Internet - and to prevent costly suits.By D. Ian Hopper

ASSOCIATED PRESS With consumers increasingly concerned about their privacy, and new technology able to track Internet users click by click, companies are rapidly hiring privacy officers, and giving them broad powers to set policies that protect consumers from invasion and companies from public-relations nightmares. In many cases, the privacy officers report directly to the chairman or chief executive officer. And their hiring has become a litmus test for a company's dedication to customer privacy.

OrganizationsOrganizations

Page 55: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

OrganizationsOrganizations

Page 56: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

OrganizationsOrganizations

Web advertisers strike privacy dealBy Andy Sullivan, 28 July 2000

A group of Internet advertisers announced Thursday a new set of industry standards crafted with the federal government to give Web surfers a say in how their personal data is used by online marketing firms.

The deal also bars Internet firms from using visitors' medical or financial data, Social Security numbers and online sexual behaviour to determine which advertisements to flash on their screens.

Page 57: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

OrganizationsOrganizationsThe FTC issued a report that praised the NAI deal but also called on Congress to pass a consumer-privacy law to cover firms the organization does not represent.

"Self-regulation is an important and powerful mechanism for protecting consumers, and the NAI principles present a solid self-regulatory scheme," the FTC said. "Nonetheless, backstop legislation addressing online profiling is still required to fully ensure that consumers' privacy is protected online."

Interest in consumer privacy on the Internet is growing in Congress. Yesterday, Arizona Sen. John McCain, the powerful chairman of the Senate Commerce Committee, introduced a bill that contained many of the provisions in the agreement.

Page 58: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

OrganizationsOrganizations

July 3, 2000 Not Enough Privacy? European legislators are about to vote on an online privacy deal with the United States. Guess where people will get more protection. By Keith Perine

Concerned about internet privacy? You might want to move to Europe. The European Parliament was scheduled to vote July 4 on a proposed agreement between the United States and the 15-nation European Union that would grant Europeans greater online protection from U.S. companies than they legally are required to provide to Americans.

Page 59: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

OrganizationsOrganizations

Under the terms of the agreement, U.S. companies that want to transfer personal data on Europeans must commit to detailed standards of notice, user choice, data access and security. Doing so would put the firms into "safe harbor" against regulation under the EU's omnibus Data Protection Directive.

"The Europeans have always stood their ground and demanded their privacy, and because of that the safe harbor principles improved enormously," says privacy advocate Jason Catlett, president of Junkbusters. "Americans are starting to ask, 'Why are Europeans getting better privacy protection than we are?'”

Page 60: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

OrganizationsOrganizations

The provisions of the EU law require businesses to collect private data only for clearly stated purposes and forbid data disclosure to third parties unless consumers grant permission. European consumers have the right to sue companies that don't adhere to the rules. European subsidiaries of U.S. companies already have to abide by the directive, which is enforced in many EU countries by government data commissioners.

The FTC used to champion pure industry self-regulation, as has the Commerce Department. But earlier this year, the commission changed course. While its first two annual online privacy reports to legislators in 1998 and 1999 touted pure self-regulation, this year's report recommended federal legislation.

Page 61: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernments

Page 62: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Governments

Grim Net Censorship Report Reuters 6:00 a.m. Apr. 27, 2000 PDT

New York -- Censorship of the Internet by governments is spreading and may become a threat to traditional media liberty, a report on press freedom said on Wednesday.

"The explosion of news and information on the World Wide Web is tempting governments, developed and developing, politically free and not free, to consider restricting content on the Internet," said the report conducted by human rights group Freedom House.

Page 63: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernments

A necessary tool for A necessary tool for fighting Internet fighting Internet crime or a violation crime or a violation of civil liberties?of civil liberties?

British Authorities May Get Wide Power to Decode E-MailBy SARAH LYALL

London: As the Clinton administration formally enters the debate about law enforcement surveillance in cyberspace, the British government is about to enact a law that would give the authorities here broad powers to intercept and decode

July 19, 2000

e-mail messages and other communications between companies, organizations and individuals.

Page 64: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernments

The measure, which goes further than the American plan unveiled on Monday in Washington, would make Britain the only Western democracy where the government could require anyone using the Internet to turn over the keys to decoding e-mails messages and other data.

Government officials maintain that the measure is essential if law enforcement agencies are to combat the sophisticated modern crime that is enhanced by access to the Internet, including pedophilia, drug smuggling, money laundering, terrorism and trafficking in refugees.

Page 65: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernments

But the measure has had a rocky time in Parliament, where lawmakers have vehemently objected to several provisions, including one that would give the government new powers to require Internet service providers to install "black box" surveillance systems that would sort and send a range of data and e-mail to a monitoring center controlled by the domestic security service, M.I.5.

Such systems are also being used in the United States by the Federal Bureau of Investigation, where the technology is known as Carnivore because it is able to extract the "meat" quickly from vast quantities of e-mail messages and other communications between computers.

Page 66: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernmentsIn contrast to the United States, Britain has a tradition of unfettered and often uncontested intrusion by the authorities into citizens' privacy.

In the United States, the F.B.I. must first obtain a search warrant before using the Carnivore technology, which is then installed and maintained by the bureau.

Under the British plan, failure to turn over a decryption key or to convert encrypted data or messages into plain text could result in a two-year prison sentence. Although many nationsare considering similar bills to deal with encrypted data, only Singapore and Malaysia have so far enacted them. A necessary tool for fighting Internet crime or a A necessary tool for fighting Internet crime or a violation of civil liberties?violation of civil liberties?

Page 67: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernments

Congress Takes on Internet Privacy Legislation

By Andy Sullivan Updated 3:12 PM ET January 23, 2001

WASHINGTON (Reuters) - Two U.S. lawmakers unveiled legislation on Tuesday providing some privacy protection for Internet users, adding yet another approach to what will likely be a major issue for the 107th Congress.

The bill ... Would require Web sites to notify visitors how personal data such as telephone numbers and ZIP codes are used, and allow visitors to limit its use.

Page 68: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernments

Today's Cartoon By Jerry KingSpecial to the E-Commerce Times

July 27, 2000

Page 69: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernments

From the editor-in-Chief| Michael Vizard"Should We Really Be Asking the Federal Fox to Guard the Online Privacy Henhouse?" InfoWorld (08/07/00") Vol. 22, No. 32,

… now may be the time to form an independent government body to create and enforce a privacy policy for the Internet. After all, allowing the government to create a privacy policy for the Internet when it has a vested interest in violating it is like asking a fox to guard a henhouse.

Page 70: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernments

The government has already spent years trying to limit encryption technologies so it can track criminals who use the technology. The government has also developed Carnivore technology so it can track an individual's email messages across multiple Internet service providers. “Clearly, there is going to be a requirement to give individuals some reasonable expectation of privacy on the Internet," writes Vizard. Having Congress create an impartial organization exclusively dedicated to setting privacy policy would be the challenge.

Page 71: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernments

The head of the privacy body would be nominated by the president and confirmed by Congress for a six-year term. Privacy, a commodity more precious than money, deserves such standards, Vizard contends.

http://www.infoworld.com/articles/op/xml/00/08/07/000807opvizard.xml

Page 72: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

GovernmentsGovernments

InternetNews - Business News July 17, 2000

U.S. Legal Body: Internet May Need New Cyber-Borders

The Internet makes such light work of geographical frontiers that new cyber-borders may be needed instead, top U.S. lawyers said on Monday as they presented a two-year report into preventing global online chaos.

Enthusiasts may love the Internet's scant regard for authority and borders but it presents a major headache for business, government and also consumers. a French customer buys a rug from Turkey via a website hosted in the United States and with a Swiss credit card, for example, there are risks all round -- the rug might be a dud, the payment might be faulty and taxes might not be paid -- but where should such matters be settled?

Page 73: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy PolicyPrivacy Policy

Page 74: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy PolicyPrivacy Policy

ELEMENTS of PRIVACY POLICIESKaren A. Forcht and Malik Ali

James Madison University

Organizations establishing privacy policies should incorporate the elements of the widely accepted Code of Fair Information Practice, which states that:

Page 75: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy PolicyPrivacy Policy

There must be a way for an individual to find out what information about him or her is in a record and how it is used.

There must be a way for an individual to correct or amend a record with information that is identifiable to him or her.

The existence of all data systems with personal information in them should be publicly disclosed, and the purpose for which information is gathered about people should be disclosed.

Page 76: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy PolicyPrivacy Policy

There must be a way for an individual to There must be a way for an individual to prevent information about him or her that prevent information about him or her that was obtained for one purpose (which was was obtained for one purpose (which was stated when the information was gathered) stated when the information was gathered) from being used or made available, either from being used or made available, either within the organization or outside, for a within the organization or outside, for a purpose that is incompatible with the purpose that is incompatible with the original purpose, without getting the original purpose, without getting the consent of the individual. This is the consent of the individual. This is the principle of secondary use. principle of secondary use.

Page 77: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy PolicyPrivacy Policy

The organization creating, maintaining, The organization creating, maintaining, using, or disseminating records of using, or disseminating records of identifiable personal data must assure the identifiable personal data must assure the reliability, accuracy, security and timeliness reliability, accuracy, security and timeliness of the data. In other words, the custodian of of the data. In other words, the custodian of information that is disseminated has an information that is disseminated has an obligation to the individual to make sure it obligation to the individual to make sure it is accurate, secure, and not misused. This is accurate, secure, and not misused. This obligation ought not be delegated to obligation ought not be delegated to another entity another entity

Page 78: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy PolicyPrivacy Policy

An organization must conduct periodic risk An organization must conduct periodic risk assessments, balancing the possibility or assessments, balancing the possibility or probability of unauthorized access or probability of unauthorized access or disclosure against the cost of security disclosure against the cost of security precautions and the expected effectiveness precautions and the expected effectiveness of the precautions. of the precautions.

An organization must make sure that other An organization must make sure that other entities handling personal information in entities handling personal information in behalf of the first organization are bound by behalf of the first organization are bound by these same principles. these same principles.

Page 79: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

Privacy PolicyPrivacy Policy

Organizations must take special Organizations must take special precautions in collecting and using precautions in collecting and using personal information about children for personal information about children for those 18 and younger. those 18 and younger.

An organization should openly disclose its An organization should openly disclose its policies and practices with regard to policies and practices with regard to electronic surveillance of its employees' electronic surveillance of its employees' and customers' telephone calls, electronic and customers' telephone calls, electronic mail, Internet usage, changing rooms, and mail, Internet usage, changing rooms, and rest rooms, and must articulate in advance rest rooms, and must articulate in advance the reasons for the surveillance. the reasons for the surveillance.

Page 80: Privacy of Information & Communications. Privacy freedom from unauthorized intrusion freedom from unauthorized intrusion Merriam Webster’s Collegiate

AgendaAgenda

Computers and privacyComputers and privacy Threats to privacyThreats to privacy Protecting privacyProtecting privacy Three dilemmasThree dilemmas

Individuals and privacyIndividuals and privacy Organizations and privacyOrganizations and privacy Governments and privacyGovernments and privacy

Privacy policyPrivacy policy