OpenLife

October 23, 2008

Archiving your social life for posterity

Filed under: IT and computer law, IT-security, Internet policy — mhg @ 5:36 pm

A Danish newspaper – Metroxpress – reported on 17 October 2008 (article via Google translate) that the Danish State Library and the Danish Royal Library are archiving all sorts of information posted by users on the Danish social networking sites such as Arto.dk (a service used primarily by children and teenagers) and dating.dk (a site used primarily for netdating).

The article reported that all publicly available material from these sites is archived, but that private mails remained private and thus not archived. Archiving of all Danish webpages (how a “webpage” is defined as being “Danish” is not explained) takes place four times a year, but certain news sites and the content of dating and other social network sites are archived every day, it is reported.

As could be expected, immediately a discussion has emerged in the Danish media as to whether such archiving is permissible, or not. People against this type of archiving argue that it is an intrusion into people’s privacy, and that it is not acceptable that your children or grandchildren 70 years after your death should experience the exposure - either through direct access or through other’s access - of your personal information about dating preferences and such.

First of all I think that it is important that it is underlined that there are indeed obvious privacy considerations to take into account with respect to the security measures in place the archiving institutions in order to prevent unauthorised access to the archived information during the lifetime of those whose personal information is possessed and stored as part of the archiving.

Worries about security breaches and unauthorised access can by themselves be sufficient reasons to stop archiving such personal information. However, in the following I assume (possibly without sufficient grounds) that the security is adequate.

Second I also think that it is important to emphasise that it is only relevant to discuss whether archiving of information is a problem or not, if the information is covered by with what we normally by common sense and by legal definition consider as personal information. When we are talking about information relating to dating sites, I think that most people would agree that such information is personally sensitive and thus covered by the need for some sort of privacy even though that this information is made publicly available by the profiled persons.

It is probably a different situation with respect to much of the information published on other social networking sites such as Facebook, LinkedIn and alike. Again from a legal point of view much of this information will without doubt be considered as personal information covered by privacy protection.

It is however my opinion that the need for protection of such information from privacy law is not that important, when you consider that people voluntarily and without any inhibitions publish this information on publicly available websites. But this is, as I mentioned, a policy view from my side, not a legal view.

Back to the question: Is it a problem that the Danish state archives such information, which in many cases is personal information covered by data protection regulation and makes it available after 70 years for the general public and maybe also available before in certain special cases for research purposes?

I think that this question has to be answered as all other questions related to calls for protection of private individuals’ privacy. The need for privacy has to be carefully balanced against the need for openness in a democratic society. And In this case I think that the decision should come out clearly in favour of the need for openness!

I must say that I am very excited about the hugely increased possibilities for research within history and sociology, and probably also other scientific areas that are enabled in a world where a lot of information can be stored digitally and used by future generations.

Such digital archives create completely new data that historians or other researchers or scientists did not have access to before. Imagine how much interesting insight into our ancestors’ life we would have, if our historians had access to similar information about the lives of ordinary and extraordinary people, e g 100 years ago.

As for the privacy of those people whose personal information might be used for such research, I do not think that there is very much concern here. These people are long dead, and their feelings are thus not relevant anymore.

As for the privacy of their children or grandchildren I do not think that these are relevant interests to take into consideration. Privacy laws as we know them right now clearly only take into consideration the privacy of those whose personal information is in question.

So let us get more archiving for the public good, and let us focus our attention to securing that the archives are not accessed by the wrong people or used for the wrong purposes.

Technorati Tags:
,

July 31, 2008

“Everything The US Government is Doing About Security is Wrong”

Filed under: IT-security — mhg @ 11:43 pm

I just had a chance yesterday to relisten to the April 2007 R.U. Serious Show #98: Everything The US Government is Doing About Security is Wrong, where Bruce Schneier gives a very lucid explanation on what matters with respect to security in the face of the terrorist threat. It is excellent and definetely word the listening time.

Technorati Tags:
, ,

July 28, 2008

Adeona - Open source laptop protection

Filed under: IT-security — mhg @ 11:13 pm

Adeona looks live very useful laptop security:

Adeona is the first Open Source system for tracking the location of your lost or stolen laptop that does not rely on a proprietary, central service. This means that you can install Adeona on your laptop and go — there’s no need to rely on a single third party. What’s more, Adeona addresses a critical privacy goal different from existing commercial offerings. It is privacy-preserving. This means that no one besides the owner (or an agent of the owner’s choosing) can use Adeona to track a laptop. Unlike other systems, users of Adeona can rest assured that no one can abuse the system in order to track where they use their laptop.

I will give it a try. I just hope that it is not at trojan horse or similar.

UPDATE: More on Adeona.

Technorati Tags:

July 20, 2008

Bruce Schneier on the FARC rescue operation and MITM attacks

Filed under: IT-security — mhg @ 11:21 am

Bruce Schneier draws a very illuminating analogy between the recent rescue of among other Ingrid Betancourt from the FARC guerillas and phising attacks on the Internet in his essay How a Classic Man-in-the-Middle Attack Saved Colombian Hostages.

Technorati Tags:
, ,

May 8, 2008

IT-security in Electronic voting system

Filed under: IT-security, Open source — mhg @ 6:00 pm

Here is a very interesting - and scarry - story of the Diebold voting systems possible influence on the fatal result of the Florida votes in the 2000 US presidential election.

I am not sure what to make of these conspiracy theories. But I think that it is pretty obvious that the public needs to have full insight into the workings - and that means the source code - of the electronic voting software and hardward that we here in Denmark eventually will use in our electronic elections.

Technorati Tags:
,

May 2, 2008

Public fingerprint

Filed under: IT-security — mhg @ 9:59 am

Kim Cameron has an excellent post on his Identity Weblog - Fingerprint charade - where he points attention to the inherent lack of security of those computers that uses the user’s fingerprint for access.

As can be seen on the photo above it is pretty easy to reproduce the exact fingerprint of the user just from photographing the mousepad in high resolution from a particular angle in a light.

I understand that this option indeed makes it possible for a clever hacker to copy the exact feutures of your fingerprint and somehow use this to get access to the computer through its fingerprint recognition facilities. But this option is not realistically available to the unsophisticated computer user such as me.

But I acknowledge Kim Cameron’s conclusion

The net of all of this was to drive home, yet again, just how silly it is to use a “public” secret to identify someone. What kind of a lock was this? It was a lock which conveniently offered any thief the key.

It hit me that in the age of digital photography, a properly motivated photographer could probably find fingerprints on all kinds of surfaces, and capture them as expertly as Dale did. I realized it was no longer necessary to use special powder or inks or tape or whatever. Fingerprints have become a thing of “sousveillance”.

Technorati Tags:
, ,

May 1, 2008

Microsoft serves the police a cup of COFEE

Filed under: IT-security — mhg @ 8:43 pm

Microsoft device helps police pluck evidence from cyberscene of crime:

The COFEE, which stands for Computer Online Forensic Evidence Extractor, is a USB “thumb drive” that was quietly distributed to a handful of law-enforcement agencies last June. Microsoft General Counsel Brad Smith described its use to the 350 law-enforcement experts attending a company conference Monday.

The device contains 150 commands that can dramatically cut the time it takes to gather digital evidence, which is becoming more important in real-world crime, as well as cybercrime. It can decrypt passwords and analyze a computer’s Internet activity, as well as data stored in the computer.

It also eliminates the need to seize a computer itself, which typically involves disconnecting from a network, turning off the power and potentially losing data. Instead, the investigator can scan for evidence on site.

Read more at http://seattletimes.nwsource.com/html/microsoft/2004379751_msftlaw29.html.

Is a COFEE a threath to civil liberties? In my opinion, not really. Maybe quite the contrary. With COFEE the police may loose the reason to actually and physically deprive you of your computer during a seizure.

But obviously, investigators’ use of COFEE must always by subjected to having firm legal grounds for such an invasion of your privacy. Thus, I don’t see the use of COFEE as problematic, if the police is using it under a court order or the like.

And what about us Mac users? Does COFEE only do the trick on Windows PC?

Technorati Tags:
,

April 7, 2008

Appointment to the Danish IT-security committee

Filed under: IT-security — mhg @ 3:20 pm

ishot-8

I have been appointed by the Danish Minister of Science, Technology and Innovation as member of the newly established IT-security committee.

Here is some information on the announcement (in Danish)

http://www.computerworld.dk/art/45166?a=block&i=205&pos=12

http://videnskabsministeriet.dk/site/forside/nyheder/pressemeddelelser/2008/ny-it-sikkerhedskomite-udpeget

Technorati Tags:

March 9, 2008

Artikel om compliance (in Danish

Filed under: IT and computer law, IT-security, Press coverage, Resources — mhg @ 11:51 pm

ishot-46

Her er en lille artikel om IT compliance for dem, der er perverse nok til at finde interesse heri :-)

Technorati Tags:

February 27, 2008

The Law of Full Disclosure

Filed under: IT and computer law, IT-security, Press coverage, Resources — mhg @ 7:52 pm

ishot-40

I am quoted in an article by Federico Biancuzzi in SecurityFocus on disclosure of security breaches:

Full disclosure has a long tradition in the security community worldwide, yet different European countries have different views on the legality of vulnerability research. SecurityFocus contributor Federico Biancuzzi investigates the subject of full disclosure and the law by interviewing lawyers from twelve EU countries: Belgium, Denmark, Finland, France, Germany,Greece, Hungary, Ireland, Italy, Poland, Romania, and the UK.

Read the article at http://www.securityfocus.com/columnists/466/1

Technorati Tags:
, ,

Next Page »

generiert in 2.383 Sekunden. | Powered by WordPress