CHAPTER 8: LEGAL & ETHICAL ASPECTS

CHAPTER 8: LEGAL & ETHICAL ASPECTS

1. 1. CYBERCRIME & COMPUTER CRIME

   • 3 Types of computer crime
     • Computers as comm. tools
     • Computers as storage devices
     • Computers as targets
   • Law enforcement challenges
     • Lack of investigators knowledgeable & experienced in dealing w/ this kind of crime
     • Required tech. may be beyond their budget
     • The global nature of cybercrime
     • Lack of collaborations & cooperation w/ remote law enforcement agencies
   • Working w/ law enforcement
     • Mgt. needs to:
       • Understand the criminal investigation process
       • Understand the inputs that investigators need
       • Understand the ways in which the victim can contribute positively to the investigation
     • Executive mgt. & security admin. need to look upon law enforcement as a resource & tool
   • Comp. crime @ cybercrime is a term used broadly to describe criminal activity in which computers @ comp. networks are a tool, a target, @ a place of criminal activity

2. 2. INTELLECTUAL PROPERTY

   • Types of intellectual property
     • Copyrights - Unauthorized use
       • Protects tangible @ fixed expression of an idea but not the idea itself
       • Creator can claim @ file copyright at a national gov. copyright office if: a) proposed work is ori. b) creator has put ori. idea in concrete form
       • 5 Copyright Rights
         • Reproduction right
         • Modification right
         • Distribution right
         • Public-performance right
         • Public-display right
         • eg. Musical works, literary works, sound recordings, software related works
     • Patents - Unauthorized malcing, using @ selling
       • Grant a property right to the inventor
       • 3 Types:
         • Utility
         • Design
         • Plant
     • Trademarks - unauthorized use @ colorable imitation
       • Trademarks rights may be used to:
         • Prevent others from using a confusingly similar mark
         • But not to prevent others from making the same goods or from selling the same goods @ services under a clearly diff. mark
       • A word, name, symbol @ device | Used in trade w/ goods | Distinguishes them from good of others
   • Digital rights mgt. (DRM)
     • Systems & procedures that ensure that holders of digital rights are clearly identified & receive stipulated payment for their works
     • No single DRM standard @ archi.
     • Obj. is to provide mechanisms for the complete content mgt. life cycle
     • Provide persistent content protection for a variety of digital content types/platforms/media
   • Digital millennium copyright act (DMCA)
     • 5 DMCA exemptions:
       • Fair use
       • Personal privacy
       • Reverse eng.
       • Security testing
       • Encryption research
     • Signed into law in 1998 | Implements WIPO treaties to strengthen protections of digital copyrighted materials
     • 2 Technological measures to protect their copyright:
       • Measures that prevent access to the work
       • Measures that prevent copying of the work
   • Intellectual property relevant to network & computer security
     • A no. of forms of intellectual property are relevant in the context of network & comp. security
     • Eg. of some of the most prominent:
       • Software
       • Databases
       • Digital content
       • Algorithms

3. 3. PRIVACY

   • Privacy law & regulation
     • Overlaps w/ comp. security
     • Dramatic increase in scale of information collected & stored
     • Individuals have become increasingly aware of access & use of personal information & private details about their lives
     • Concerns abt extent of privacy compromise have led to a variety of legal & technical approaches to reinforcing privacy rights
   • Organizational response
     • Notice
     • Consent
     • Consistency
     • Access
     • Security
     • Onward transfer
     • Enforcement
   • Computer usage privacy
     • Permits individual to determine records kept
     • Creates a private right of action for individuals
     • Permits individuals to forbid records being used for other purposes
   • Privacy & data surveillance
     • Demands of homeland security & counterterrorism have imposed new threats to personal privacy
     • Law enforcement & intelligence agencies have become increasingly aggressive in using data surveillance techniques to fulfill their mission
     • Both policy & technical approaches are needed to protect privacy when both gov. & nongov. org. seek to learn as much as possible abt individuals
     • Private org. are exploiting a no. of trends to increase their ability to build detailed profiles of individuals
       • Spread of the internet
       • Increase in electronic payment methods
       • Near-universal use of cellular phone comm.
       • Ubiquitous computation
       • Sensor webs
   • Privacy Protection
     • Tamper-resistant
     • Creates an audit log
     • Verifies user access permissions & credentials

4. 4. ETHICAL ISSUES

   • Ethics & the IS professions
     • Concern w/ balancing prof. responsibilities w/ ethical @ moral responsibilities
     • Org. have a duty to provide alternative, less extreme opportunities for the employee
     • Prof. societies should provide a mechanism whereby society members can get advice on how to proceed
     • Types:
       • Ethical duty as a prof. may come into conflict w/ loyalty to employer
       • "Blowing the whistle"
       • Expose a situation that can harm the public @ a company's customers
       • Potential conflict of interest
   • The rules
     • Collaborative effort to develop a short list of guidelines on the ethics of comp. systems
     • Ad Hoc Committee on Responsible Computing
       • Anyone can join this committee & suggest changes to the guidelines
       • Moral Responsibility for Computing Artifacts
         • The Rules apply to software that is commercial, free, open source, recreational, an academic exercise @ a research tool
       • Computing artifact
   • Codes of conduct
     • Be a + stimulus @ instill confidence
     • Be educational
     • Provide a measure of support
     • Be a means of deterrence & discipline
     • Enhance the profession's public image
     • Comparison of Codes of Conduct:
       • Dignity & worth of other people
       • Personal integrity & honestly
       • Responsibility for work
       • Confidentiality of information
       • Public safety, health & welfare
   • Ethical issues related to computers & information systems
     • Repositories & processors of information
     • Producers of new forms & types of assets
     • Instruments of acts
     • Symbols of intimidation & deception
   • "A system of moral principles that relates to the benefits & harms of particular actions, & to the rightness & wrongness of motives & ends of those actions"