Transcript Gift of Fire

Ethics in Information
Technology
• Public concern about the ethical use of
information technology includes:
1.
2.
3.
4.
5.
6.
E-mail and Internet access monitoring
Peer-to-peer networks violation of copyright
Unsolicited e-mail
Hackers and identify theft
Plagiarism
Cookies and spyware
Book Page a
Ethics in Information Technology, Second Edition
1
Ethics in Information
Technology (continued)
• The general public has not realized the critical importance of
ethics as applied to IT
• Important technical decisions
are often left to technical
experts
• General business managers must assume greater
responsibility for these decisions.
Book Page b
Ethics in Information Technology, Second Edition
2
Topics to be cover
1.
2.
3.
4.
Personal data Privacy
Freedom of Speech
Internet communications
Protection of intellectual property rights
through patents, copyrights, and trade
secrets
5. Computer crime
Book Page c
Ethics in Information Technology, Second Edition
3
A Gift of Fire
Third edition
Sara Baase
Chapter 2: Privacy
Slides prepared by Cyndi Chie and Sarah Frye
Topics
1. Privacy Risks and Principles
2. The Fourth Amendment, Expectation of
Privacy, and Surveillance Technologies
3. The Business and Social Sectors
4. Government Systems
5. Protecting Privacy: technology, markets,
rights, and laws
6. Communications
2.1
Privacy Risks and
Principles
2.1.1 What is Privacy
To build in Privacy protections systems Key
Aspects of Privacy:
• Freedom from intrusion (Entry to another's property
without right or permission)
• Control of information about oneself
• Freedom from surveillance (being tracked, followed,
watched)
Privacy threats Categories
2.1.2 New Technology, New Risks
• Government and private databases
(searching data re-identification is easy)
• Sophisticated tools for surveillance and
data analysis (smart phones send location)
Location data should be Anonymous but it stores phone ID, age
and gender info and sent to 3rd parties.
Hidden data in mobile phones. If you do not know it stores data
you do not delete it. Photos, contact list etc.
• Vulnerability (Susceptible to attack) of data
to loss, hacking, and misuse:
2.1.3 Terminology
1. Informed consent and Invisible information
gathering –
collection of personal information about someone without
the person’s knowledge (spyware, event data recorders
in cars, customer ID number in software of cursor, finger
printing)
2. Secondary use, data mining, matching, and
profiling –
use of personal information for a purpose other than the
one it was provided for
(cont.)
• Data mining - searching and analyzing masses of
data to find patterns and develop new information
or knowledge
• Computer matching - combining and comparing
information from different databases (using social
security number, for example, to match records)
• Computer profiling - analyzing data in computer
files to determine characteristics of people most
likely to engage in certain behavior
•
•
•
•
•
•
•
Secondary use of personal information
(SUPI)
The degree of control one should have over
its SUPI.
After informing people what info is collected
and what it does with it.
Then give control over SUPI through
Informed consent (IS)
Two forms of IS are Opt-in & Opt-out policies
Opt-out by default information will be used
Opt-in by default info will not be used
Data retention (Allow to remain in a place or
position or maintain a property or features)
Fair Information Principles or
practices for managing personal data
Fair Information Principles or practices
for managing personal data
• Laws in US, Canada, and Europ using them as
ethical practices in many situations but gives
custody when court order comes subpoena (su
pee nu).
• There is a wide variation and in interpretation
among business and privacy advocates (what
info business need and for how long)
• Difficult to determine the purpose of supplying
info: the increase of cameras used by police or
google street view, sent on tweets.
Discussion Questions
• Have you seen opt-in and opt-out
choices? Where? How were they
worded?
• Were any of them deceptive (mislead) ?
• What are some common elements of
privacy policies you have read?
2.2
The Fourth Amendment,
Expectation of Privacy,
and Surveillance
Technologies
"Big Brother is Watching You“
• George Orwell’s dystopian (A work of fiction describing
an imaginary place where life is extremely bad because of deprivation,
) novel 1984, Big brother could
watch every one via “tele-screens” in all
homes and public places.
oppression or terror
• Today, it does not have to watch every
move we make, because so many of our
activities leave data trials in databases
available to gov agencies.
Cont.
• Government Accountability Office (GAO) monitors government's privacy policies:
•
•
•
Mission is to support the Congress in meeting its constitutional responsibilities and to help
improve the performance and ensure the accountability of the federal government for the
benefit of the American people.
Work is done at the request of congressional committees and support congressional
oversight by
– auditing agency operations to determine whether federal funds are being spent
efficiently and effectively;
– investigating allegations of illegal and improper activities;
– reporting on how well government programs and policies are meeting their objectives;
– performing policy analyses and outlining options for congressional consideration; and
– issuing legal decisions and opinions, such as bid protest rulings and reports on agency
rules.
It advises Congress and the heads of executive agencies about ways to make government
more efficient, effective, ethical, equitable and responsive. Thus improve government
operations, saving the government and taxpayers billions of dollars.
2.2.1 The Fourth Amendment
• US constitution protects a right to privacy from gov
intrusion. (even Europe)
– It requires that the gov have probable cause for
the search and seizure (The act of taking of a
person by force).
• Federal privacy rules allow law enforcement
agencies to access medical records without a court
order.
• The USA PATRIOT Act passed after (9/11) eased
gov. access to Personal info with out court order
• PROBLEM: weakening factor for 4th amend: using
new technology gov can search homes with out
physically entering into them.
Cont.
• PROBLEM: weakening factor for 4th amend. : using
new technology gov can search homes with out
physically entering into them.
– Search home – with out entering them
– Search our persons – from distance with out our
knowledge
– Extract all the data -- on cell phone (even
deleted passwords) in 2 minutes 
Government databases with personal information
2.2.2 New Technologies, Supreme Court
Decisions, and Expectations
• Non invasive but deeply revealing searches: With out
search warrants or probable cause, on unsusceptible
people.
– particle sniffers – drugs/explosives,
– imaging – gun detection under cloths,
– molecular composition of truck cargo with out opening
trucks,
– thermal imaging devices – find heat lamps for growing
marijuna,
– mobile phone- person tracking
Cont.
• Supreme Court decisions and expectation of privacy:
– In 1928 gov. used Wiretaps on phone lines with out court
order.
• Supreme court allowed it and justified (4th am. Applies on
physical intrusion search of material things not on
communication.
– In 1967 SC ruled : 4th am. Applies on conversation.
• E.g. law enforcement agent attached electronic listening
device outside telephone booth to record suspect’s
conversation
• Court justified it protects people not places and private and
not things in public places.
• To intrude in places where a reasonable person has
reasonable expectations of privacy, gov. agents need a
court order.
Cont.
• Supreme Court decisions and expectation of privacy:
– In 1976 SC recognized problem if actual law enforcement
reduces actual “expectation of privacy” by action this should not
reduce 4th am protection.
– E.g. if we share our info with business like banks then we have
no reasonable expectation of privacy for that info. (no need for
court order). We share our web activities with ISPs and
websites and expect them to be private.
– In 2001 SC ruled police could not use thermal imaging devices
to search home from the outside without search warrant.
– The surveillance is SEARCH if it uses unknown new technology
that is not in general public use. (warrantless search)
• Provide privacy protection against new technologies or Should
court have permitted search?
(Our use of new technology doesn’t means we are less interested in our Privacy and
its monitoring still creeps us out) – Judge Alex Konzinski
2.2.3 Search and Seizure of Computers and
Phones
• 1950 SC ruling against Alabama state to get
membership info of National Association for
Advancement of Colored People (NACCP)
– Privacy in group association may .. Be essential to
preservation of freedom of association, particularly where
a group adopts disagree beliefs.
• 4th am. Search warrants be specific about the
Object of the search or seizure.
– Amount of info in plain view at home is smaller than
computer at business place.
– PROBLEM: Access computer is serious threat to privacy,
liberty, and FOS
Cont.
– Interpretation of information in plain view
• All un encrypted files on Phones and Laptops-invites
abuse.
• Court view: if officer see evidence of another crime at
plain view, the officer may seize and use it. Could be
used for “fishing expeditions” for other information (An
investigation undertaken in the hope (but not the stated
purpose) of discovering information).
• PROBLEM: Fishing expeditions - Crosses 4th am that
“Warrant be Specific”
• Case: In searching evidence on man’s computer for
drug crime and officer saw file names suggesting illegal
contents. Open files and found child pornography.
• Appeal court justified: name of might be considered in
plain view not the contents.
• Unpleasant crime but principles protects from police
abuse
Cont.
– Investigation: for searching foot ball players using
performance enhancing drugs steroids. Law enforcement
agents obtained search warrants for computer files of
laboratory records on drug tests for 10 specific players.
– Seized lab files contains records of 100 baseball players,
hockey players, and ordinary people. Name of prominent
players who allegedly tested positive leaked to news.
– Federal Appeal court ruled: info of others was beyond the
scope of search warrant and is illegal.
• 5th am. A person can not be forced to testify (provide
evidence for) against him. (Inconsistent ruling for encr. Key)
– Keep files encrypted but could take keys and lock.
Cont.
• Phones and Laptops:
– Police can search an arrested person (with out warrant) and examine
its property on the person or within his reach.
– Can mobile phones be searched ? they may contain
proprietary/confidential info e.g lawyer’s phone.
– Vast collection of info on phone is kind of info 4th am. is intended to
protect.
– Ohio’s SC + Judge Ruling: Searching an arrested persons phone
(retrieving info) with out search warrant is illegal as people have
expectation of privacy for their phone contents
– California SC ruled: info retrieval is permitted as phone is personal
property found on arrested person.
– Finally US SC hear case and results were profound for privacy.
– Mean times Lawyers suggests to Leave phone out of reach while
driving.
• Custom and Border officials: search luggage and seize laptops
mobiles of journalists, business people and other travelers.
• Federal appeal: no search of laptops on borders.
2.2.4 Video Surveillance and Face recognition
• People aware surveillance areas (banks,
convenience stores, prisons, gambling casinos,
traffic and catch drivers
• After 2001 attack installation of high zoomed
cameras ½ mile range.
• Spy Surveillance: Cameras + face recognition
apps violate civil liberty issues.
– Police in tampa florida scan faces of 1lac fans
and employees in Super Bowl (snooper/spy).
Then matches computer files criminal matches
in their DB of suspects. In two years of no
wanted recognized. (Face rec poor accuracy in
2001)
Cont.
– Police in Tampa florida scan faces of 1lac fans and
employees in Super Bowl (snooper/spy). Then matches
computer files criminal matches in their DB of suspects.
In two years of no wanted recognized. (Face rec poor
accuracy in 2001)
– Police office can take snap and run face recognition app
on mobile. Iris and finger print.
– Toronto city refuses police to cover protest and recognize
its organizers.
– Privacy commissioner of Canada argued that Country’s
privacy act requires demonstrable need for each piece of
information collected therefore recording activities of
large number of the general public was not a permissible
means of crime prevention.
Cont.
– England is 1st country to setup large number of cameras in public
places. Millions are installed in Britain. A study by British university
reported number of abuses by reporters sharing movies with
colleagues.
– Defense lawyer reported that prosecutors destroys footage that
might clear suspect.
– Application for enforcing curfew on young people Or detection of
specific people powerful people. The kind of people targeted for
illegal surveillance in past.
– Britain gov. released report: Closed circuit TV only help reducing
vehicle crimes in parking lots. Later year picture identified terrorists
who set off bombs in London subway
– In 2001After rioters (trouble makers) burned and looted
neighborhoods in England, recording from street cameras and face
recognition system were used for identification of rioters.
• What tradeoffs between privacy and identifying criminals and
terrorists are we willing to make ?
Cont.
– California department of transport ion photographed the
licensed plates on cars driving in particular area. Then
contacted car owners about a survey about traffic in the area.
100 of drivers complained even their faces were not
photographed not for police action but for survey.
• Do people have the right to know when and where the cameras
are in use?
– In USA Police must have a reason for requiring a person to be
fingerprinted.
– Design Privacy protecting features in to technology and pass
privacy protection legislation before, as SC of Canada worries in
quoted.
– We must always be alert from modern methods of surveillance,
if uncontrolled, to annihilate privacy.
2.3
The Business and Social
Sectors
2.3.1 Marketing and personalization
• Marketing: biggest use of personal information. It includes
finding new customers.
• Personalization: make recommendation based on prior
purchase. Personalization of ads.
• Consumer Dossiers: Collection of consumer history.
• Targeted marketing
– Data mining
– Paying for consumer information
– Data firms and consumer profiles
• Credit records
• Design systems ethically and responsibly means including
ways to inform and remind users of unobvious data
collection, of change in policies or features,, and of risks
2.3.2 Our Social and Personal Activity
•
•
•
•
Social Networks- What We do
Personal information in blogs and online profiles
Pictures of ourselves and our families
File sharing and storing
Is privacy old-fashioned?
– Young people put less value on privacy than
previous generations
– May not understand the risks
Social Networks – What they do
• Responsibility of free services
• Life in clouds
2.3.3 Location Tracking
• Global Positioning Systems (GPS)
– Computer or communication services that know exactly
where a person is at a particular time.
– Cell phones and other devices are used for location
tracking and provide details to Profiles and Dossiers
Business and Gov.
– Collected data could be PROTECTED.
• Customer traffic patterns could be positively used but
“Location emitting tickets” are better anonymous.
• Who is at bar ? Face recognition cameras.
• Tools for parents: RFID Tags (chip + antenna) can be
monitored 100 of feet away
• Pros and cons
2.3.4 A Right to be Forgotten
• Legislators and privacy advocates are promoting a legal
right to demand that websites remove material about
oneself as a legal and ethical right.
• Complying with the request could be ethically acceptable
and admirable but not ethically obligatory.
• Some companies provide free services on the cost of using
our data and some give totally free services or at discount
on viewing ads.
• Right to be forgotten could be taken as negative right
(liberty: to stay off internet) or a positive right (claim:
removal of posts). Can conflict FOS.
• Other may not write about a person or exchange specified
information about the person – information gained with out
violating any of the person’s rights.
• Parents may request legally to remove unethical contents
posted by their children.
(cont.)
Stolen and Lost Data:
• Hackers
• Physical theft (laptops, thumb-drives,
etc.)
• Requesting information under false
pretenses (false appearance)
• Bribery of employees who have access
2.4
The Government
Systems
2.4.1 Databases
National ID System:
• Social Security Numbers
– Too widely used
– Easy to falsify
(cont.)
National ID System (Cont.):
• A new national ID system - Pros
– would require the card
– harder to forge
– have to carry only one card
• A new national ID system - Cons
– Threat to freedom and privacy
– Increased potential for abuse
(cont.)
Children:
• The Internet
– Not able to make decisions on when to
provide information
– Vulnerable to online predators
• Parental monitoring
– Software to monitor Web usage
– Web cams to monitor children while
parents are at work
– GPS tracking via cell phones or RFID
Discussion Questions
• Is there information that you have
posted to the Web that you later
removed? Why did you remove it? Were
there consequences to posting the
information?
• Have you seen information that others
have posted about themselves that you
would not reveal about yourself?
2.4.2 Public Records vs. Privacy
• Public Records - records available to general
public (bankruptcy, property, and arrest
records, salaries of government employees,
etc.)
• Identity theft can arise when public records
are accessed
• How should we control access to sensitive
public records?
2.5
Protecting Privacy:
technology, markets,
rights, and laws
2.5.1 Technology and Markets
Technology and Markets:
• Privacy enhancing-technologies for
consumers
• Encryption
– Public-key cryptography
• Business tools and policies for
protecting data
2.5.2 Rights and Law
• Theories
– Warren and Brandeis
– Thomson
• Transactions
• Ownership of personal data
• A basic legal framework
• Regulation
– Health Insurance Portability and
Accountability Act (HIPAA)
(cont.)
Rights and laws: Contrasting Viewpoints:
• Free Market View
– Freedom of consumers to make voluntary
agreements
– Diversity of individual tastes and values
– Response of the market to consumer
preferences
– Usefulness of contracts
– Flaws of regulatory solutions
(cont.)
Rights and laws: Contrasting Viewpoints (cont.):
• Consumer Protection View
– Uses of personal information
– Costly and disruptive results of errors in
databases
– Ease with which personal information leaks
out
– Consumers need protection from their own
lack of knowledge, judgment, or interest
(cont.)
Privacy Regulations in the European
Union (EU):
• Data Protection Directive
– More strict than U.S. regulations
– Abuses still occur
– Puts requirements on businesses
outside the EU
Discussion Question
• How would the free-market view and the
consumer protection view differ on
errors in Credit Bureau databases?
• Who is the consumer in this situation?
2.6
Communications
Communication
Wiretapping and E-mail Protection:
• Telephone
– 1934 Communications Act prohibited interception
of messages
– 1968 Omnibus Crime Control and Safe Streets Act
allowed wiretapping and electronic surveillance by
law-enforcement (with court order)
• E-mail and other new communications
– Electronic Communications Privacy Act of 1986
(ECPA) extended the 1968 wiretapping laws to
include electronic communications, restricts
government access to e-mail
Communication (cont.)
Designing Communications Systems for
Interception:
• Communications Assistance for Law
Enforcement Act of 1994 (CALEA)
– Telecommunications equipment must be
designed to ensure government can
intercept telephone calls
– Rules and requirements written by
Federal Communications Commission
(FCC)
Communication (cont.)
Secret Intelligence Gathering:
• The National Security Agency (NSA)
– Foreign Intelligence Surveillance Act
(FISA) established oversight rules for
the NSA
• Secret access to communications
records
Communication (cont.)
Encryption Policy:
• Government ban on export of strong
encryption software in the 1990s
(removed in 2000)
• Pretty Good Privacy (PGP)
Discussion Questions
• What types of communication exist
today that did not exist in 1968 when
wiretapping was finally approved for
law-enforcement agencies?
• What type of electronic communications
do you use on a regular basis?