2. Security, Privacy, and Ethics Marsha Woodbury, Ph.D. University of Illinois, Urbana-Champaign marsha@illinois.edu

4. Let’s start with a punch http://www.youtube.com/watch?v=Afa pbKKLRGg http://www.youtube.com/watch?v=Afa pbKKLRGg http://www.youtube.com/watch?v=Afa pbKKLRGg http://www.youtube.com/watch?v=Afa pbKKLRGg

5. Roadmap What is ethics? What is ethics? What does a code of ethics look like? What does a code of ethics look like? What are laws? What are laws? What is privacy? What is privacy? What is security? What is security? Discussion of issues that face us now and in the future Discussion of issues that face us now and in the future

6. Ethical Issues Privacy and confidentiality Privacy and confidentiality Integrity of information over time Integrity of information over time Unimpaired and consistent service Unimpaired and consistent service Controlling access to resources Controlling access to resources Serving people and society Serving people and society

7. What is Ethics? Figuring out, defending, and recommending concepts of right and wrong behavior. Usually refers to actions not done while a gun is pointed at your head.

8. Ethics Made Simple Is the action legal? Is the action legal? What would your parents say? What would your parents say? If you do it, will you feel bad? If you do it, will you feel bad? How will it look in the newspaper? How will it look in the newspaper? Is there a shusher in the group? Is there a shusher in the group? Does it pass the smell test? Does it pass the smell test?

10. The Code of Ethics (edited by your speaker) We must take care not to endanger the life, health, safety, and welfare of the public. We must take care not to endanger the life, health, safety, and welfare of the public. We should demonstrate competence and due care in our technical duties. We should demonstrate competence and due care in our technical duties. We must maintain and update our technical skills. We must maintain and update our technical skills. http://www.secureworks.com/research/articles/ethics

11. Another code of ethics http://www.cybersecurityinstitute.biz/training/ethicsconduct.htm Computer Forensics: 4. I will be honest and forthright in my dealings with others. 4. I will be honest and forthright in my dealings with others. 6. I will not accept compensation for my services based on contingency. 6. I will not accept compensation for my services based on contingency.

12. A Point to Ponder A Point to Ponder Humans Mental health is very important. Privacy and other rights need to be considered.

13. Laws vs. Ethics The legal system takes time to evolve, lays out what is acceptable and unacceptable behavior, establishes penalties. 12

14. Example of a Law Ryan Haight Online Pharmacy Consumer Protection Act Defines "online pharmacy" Defines "online pharmacy" Requires at least one face-to-face patient medical evaluation Requires at least one face-to-face patient medical evaluation Requires registration for online pharmacies Requires registration for online pharmacies

15. Chilling Effects Law--Example Digital Millennium Copyright Act DMCA Safe Harbor—ISP takes down material immediately once it is notified, whether there is just cause or not DMCA Safe Harbor—ISP takes down material immediately once it is notified, whether there is just cause or not

16. DMCA, cont. DMCA Subpoenas Anyone who has written something is a copyright holder Anyone who has written something is a copyright holder Anyone who has written something is a copyright holder Anyone who has written something is a copyright holder Law enforcement might use the Section 512(h) subpoena other than for vindicating copyright right Law enforcement might use the Section 512(h) subpoena other than for vindicating copyright right No judge reviews the subpoena No judge reviews the subpoena

17. Is that ethical?

18. Typical Problems: Medical Records http://www.youtube.com/watch?v=SY b9Zn5glnw http://www.youtube.com/watch?v=SY b9Zn5glnw http://www.youtube.com/watch?v=SY b9Zn5glnw http://www.youtube.com/watch?v=SY b9Zn5glnw

19. Privacy What is the right to privacy? What is the right to privacy? http://www.youtube.com/watch?v=EUb 70aUDYaM http://www.youtube.com/watch?v=EUb 70aUDYaM http://www.youtube.com/watch?v=EUb 70aUDYaM http://www.youtube.com/watch?v=EUb 70aUDYaM

20. Privacy Article 12: No one shall be subject to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks. Article 12: No one shall be subject to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks. United Nations, Universal Declaration Of Human Rights

21. Security Measures taken as a precaution against theft or espionage or sabotage, etc. Measures taken as a precaution against theft or espionage or sabotage, etc. Freedom from anxiety or fear Freedom from anxiety or fear Often thwarted by users leaving passwords on sticky notes Often thwarted by users leaving passwords on sticky notes

23. Internet Privacy/Security Issues University Sites and Personal Data Accidents University Sites and Personal Data Accidents Identity Theft and Identity Loss Identity Theft and Identity Loss

24. And a few more Cybercafes Cybercafes Google's Gmail Google's Gmail Online Dating Online Dating

25. Anonymity Bad uses money laundering drug trading terrorism preying upon the vulnerable Good uses security mental health self-fulfillment peace of mind

26. Ethical Issues Privacy and confidentiality Privacy and confidentiality Integrity of information over time Integrity of information over time Unimpaired and consistent service Unimpaired and consistent service Controlling access to resources Controlling access to resources Serving people and society Serving people and society (NSA spying on Americans) (NSA spying on Americans)NSA spying on AmericansNSA spying on Americans

27. Good Luck!! Remember, You have access to data (!) You have access to data (!) Make sure we can trust you Make sure we can trust you Contact me: marsha@illinois.edu