K. Salah1 Legal, Privacy, & Ethical Issues

K. Salah2 Overview Human Controls Applicable to Computer Security The Basic Issues Computer Crime Privacy Ethical Issues Codes of Professional Ethics

K. Salah3 The basic issues

K. Salah4 Protecting Programs and Data Copyrights—works of the mind Copyrights—works of the mind Intellectual Property Digital Millennium Copyright Act Patents—tangible objects Patents—tangible objects Trade Secrets—competitive edge info Trade Secrets—competitive edge info

K. Salah5 Intellectual Property Intellectual property == information that belongs to someone  Book  Movie  Program May be protected by  Copyright  Patent  Trade secret Computer security can help with some of these  Not much help with patents

K. Salah6 Copyrights Designed to protect the expression of ideas  Limited to a particular specific expression  May be more than one copyright for a given expression Composer: the score Lyricist: the lyrics to the song Artist: a particular performance of the song Limited in time  Expire 70 years after author’s death  Expire after 95 years (if owned by corporation)  These limits can change, and have been getting longer recently Public domain  Public “owns” the copyright  Common for government documents  Older works pass into the public domain Collections can be copyrighted even if the individual components aren’t subject to copyright

K. Salah7 Fair use Copyrighted item is subject to fair use  May be excerpted for teaching, criticism, etc.  Definition of fair use depends on many factors First sale  Author controls the first sale of a copyrighted work: receives benefits from its sale  Owner controls future sales: owner may resell it to anyone without contacting the copyright holder  Owner may only sell a copy he currently owns

K. Salah8 Patents Cover an implementation of an idea  Patent has details on how to implement the object  Patent should have enough information to allow someone to actually build the object! Patents are public  Searchable at  Download PDF for $3 each Patent protection  Nobody is allowed to make an object covered by the patent without licensing it from the patent owner  Deciding what’s covered is difficult. Patent lasts for about 18 years

K. Salah9 More on patents Patent must be novel  Only one patent per idea: if multiple independent inventors, still only one patent (one inventor loses)  Patent must not be obvious Patent holder must oppose all infringement  Even small infringers have to be pursued  Copyright holder need only go after major offenders Patent can be lost  Holder didn’t pursue all infringers  Patent was obvious and shouldn’t have been granted  Someone else invented it first Patents best for big companies, not individuals

K. Salah10 Trade secrets Not legally protected  Must be kept secret!  Legal action can be taken against someone who (illegally) reveals the secret Can’t uncover the secret, but can  Reverse engineer the process  Independently invent something that does the same thing Difficult to enforce!  Reverse engineering -- OK  Revealing the secret isn’t  Distinguishing these can be difficult

K. Salah11 Comparison among: Copyright, Patent and Trade Secret Protection CopyrightPatent Trade Secret Protects Expression of idea, not idea itself Invention—way something works A secret, competitive advantage Protected Object Made Public Yes, intention is to promote pub. Design filed at Patent Office No Requirement to Distribute YesNoNo Ease of filing Very easy, do-it- yourself Very complicated; specialist lawyer suggested No filing Duration Individual’s life + 70 years 19 years Indefinite Legal Protection Sue if unauthorized copy sold Sue if invention copied Sue if secret stolen

K. Salah12 Licensing vs. Ownership If program is sold (under copyright), owner can resell it to someone else If program is licensed, “owner” must abide by licensing terms  May restrict redistribution  May restrict other uses (it’s a license) Licensing may avoid some problems, but opens others  What if the program doesn’t work? Copyright has no guarantees License has to say what you’re licensing for  Making backup copies?  Using the program on multiple machines?

K. Salah13 Rights of Employees/Employers Ownership of Products Ownership of Products Ownership of a Patent Ownership of a Patent Ownership of a Copyright Ownership of a Copyright Work for Hire Work for Hire Licenses Licenses Trade Secret Protection Trade Secret Protection Employment Contracts Employment Contracts

K. Salah14 Software Failures Selling correct software Selling correct software Reporting software flaws Reporting software flaws Vendor interests User interests Responsible vulnerability reporting Quality Software

K. Salah15 Computer Crime Rules of Property Rules of Property Rules of Evidence Rules of Evidence Threats to Integrity and Confidentiality Threats to Integrity and Confidentiality Value of Data Value of Data Acceptance of Computer Terminology Acceptance of Computer Terminology Hard to Define Hard to Define Hard to Prosecute Hard to Prosecute US Computer Fraud and Abuse Act US Economic Espionage Act US Electronic Funds Transfer Act US Freedom of Information Act US Privacy Act US Electronic Communications Privacy Act USA Patriot Act

K. Salah16 Computer Crime (cont’d) International International EU Data Protection Act Restricted Content Cryptography Use Criminals are hard to catch Criminals are hard to catch Law is not precise Law is not precise

K. Salah17 Cryptography Challenges Controls on export Controls on export Controls on use Controls on use Free speech issues Free speech issues Key escrow issues Key escrow issues

K. Salah18 III. Privacy Identity Theft Identity Theft Aggregation and Data Mining Aggregation and Data Mining Poor System Security Poor System Security Government Threats Government Threats The Internet The Internet Privacy vs. Security Concerns Privacy vs. Security Concerns Corporate Rights and Private Business Corporate Rights and Private Business Privacy for Sale Privacy for Sale Controls Controls Authentication Anonymity Computer Voting Pseudonymity The Law—EU Protection Act, HIPAA, Graham-Leach-Bailey

K. Salah19 IV. Ethical Issues Law vs. Ethics Law vs. Ethics Ethics vs. Religion Ethics vs. Religion Universality ?? Pluralism ?? Ethical Approaches Ethical Approaches Consequence-based—i.e. utilitarianism Rules-based—deontology

K. Salah20 V. Codes of Ethics IEEE IEEE ACM ACM Computer Ethics Institute Computer Ethics Institute 10 Commandments of Computer Use 10 Commandments of Computer Use Brookings Institute