1. CHAPTER 8 Legal, Privacy and Ethical Issues in Computer Security (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 1

2. Objectives  Discuss program and data protection by patents, and trademarks  Discuss computer crime and its impact in our society  Describe the codes of professional ethics (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 2

3. Protecting Program and Data (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 3  Copyrights  Patents  Trade secrets  Protection for computer objects

4. Copyrights (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 4  Copyright are designed to protect the expression of idea.  Applies to creative work, such as story, photograph, song or pencil sketch.  The copyright must apply to an original work and must be in some tangible medium of expression (written, printed, recorded etc.).

5. Copyrights (cont) (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 5  Certain works are considered to be in public domain, owned by public, by no one in particular – song “Happy Birthday to You” or recipe for “Mee Goreng”.  The copyright law indicates that the copyrighted object is subject to fair use. A purchaser has the right to use the product in the manner for which it was intended and in a way that does not interfere with the author's rights  Unfair use of a copyrighted item is called piracy.  What the different of © or ®?

6. Copyrights (cont) (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 6  The Digital Millennium Copyright Act (CDMA) of 1998 clarified some issues of digital objects.  Digital objects can be subject to copyright.  It is a crime to circumvent or disable antipiracy functionality built into an object.  It is a crime to manufacture, sell, or distribute devices that disable antipiracy functionality or that copy digital objects.  However, these devices can be used (and manufactured, sold, or distributed) for research and educational purposes.  It is acceptable to make a backup copy of a digital object as a protection against hardware or software failure or to store copies in an archive.  Libraries can make up to three copies of a digital object for lending to other libraries.  Items protected – music files, graphics images, data in a database, computer programs.

7. Patents (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 7  Unlikely copyright, patents protect invention, tangible objects or ways to make them, not works of the mind.  Apply to the result of science, technology and engineering.  A patent is designed to protect the device or process for carrying out an idea, not the idea itself  Items protected – computer software, recognizing algorithms like processes and formulas.

8. Trade Secrets (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 8  Trade secrets is information that gives one company a competitive edge over others.  Example – formula for a soft drink, mailing list of customers or information about a product due to be announced in a few months.  Trade secret is easily discovered – reverse engineering.

9. Trade Secrets (cont) (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 9  In reverse engineering, one studies a finished object to determine how it is manufactured or how it works.  The difficulty with computer programs is that reverse engineering works – decompiler and disassembler programs can produce a source version of an executable program.

10. Protection of Computer Objects (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 10  Hardware such as chips, disk drives or floppy disk media can be patented.  Firmware such as code embedded in a chip can be protect by trade secret.  Copyright protection seems to appropriate to protect object code and source code for software.

11. (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 11 CopyrightPatentTrade Secret ProtectsExpression of idea, not idea itself Inventionthe way something works A secret, competitive advantage Protected object made public Yes; intention is to promote publication Design filed at Patent Office No Requirement to distributeYesNo Ease of filingVery easy, do-it-yourselfVery complicated; specialist lawyer suggested No filing DurationLife of human originator plus 70 years, or total of 95 years for a company 19 yearsIndefinite Legal protectionSue if unauthorized copy sold Sue if invention copiedSue if secret improperly obtained Comparing Copyright, Patent, and Trade Secret Protection.

12. Information and the Law (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 12  why information is different from other commercial things?  Information Is Not Depletable  Information Can Be Replicated  Information Has a Minimal Marginal Cost  The Value of Information Is Often Time Dependent  Information Is Often Transferred Intangibly

13. Right of employee and the employer (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 13  Employers hire employees to generate ideas and make products  Ownership is a computer security concern because it relates to the rights of an employer to protect the secrecy and integrity of works produced by the employees.  Ownership of a Patent -If an employee lets an employer patent an invention, the employer is deemed to own the patent and therefore the rights to the invention.  Ownership of a Copyright- special situation known as work for hire applies to many copyrights for developing software or other products.

14. Work for Hire (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 14  In a work for hire situation, the employer, not the employee, is considered the author of a work Licenses  An alternative to a work for hire arrangement is licensed software-the programmer develops and retains full ownership of the software. In return for a fee, the programmer grants to a company a license to use the program.

15. Why Computer Crime Is Hard to Prosecute (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 15  Lack of understanding.  Lack of physical evidence.  Lack of recognition assets.  Lack of political impact.  Complexity of case.  Juveniles.

16. Why Computer Criminals Are Hard to Catch (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 16  As if computer crime laws and prosecution were not enough, it is also difficult for law enforcement agencies to catch computer criminals. There are two major reasons for this.  computer crime is a multinational activity that must usually be pursued on a national or local leve  Complexity is an even more significant factor than country of origin

17. Privacy (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 17  Information privacy has three aspects: sensitive data, affected parties, and controlled disclosure  Privacy is controlled disclosure: The subject chooses what personal data to give out and to whom.  After disclosing something, a subject relinquishes much control to the receiver.  What data are sensitive is at the discretion of the subject; people consider different things sensitive. Why a person considers something sensitive is less important than that it is.  Individuals, informal groups, and formal organizations all have things they consider private.  Privacy has a cost; choosing not to give out certain data may limit other benefits.

18. Differences Between the Law and Ethics (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 18  An ethic is different from a law in several important ways.  First, laws apply to everyone: One may disagree with the intent or the meaning of a law, but that is not an excuse for disobeying the law.  Second, the courts have a regular process for determining which law supersedes which if two laws conflict.  Third, the laws and the courts identify certain actions as right and others as wrong. From a legal standpoint, anything that is not illegal is right.  Finally, laws can be enforced to rectify wrongs done by unlawful behavior. Ethical Issues in Computer Security

19. (c) by Syed Ardi Syed Yahya Kamal, UTM 2004 19 LawEthics Described by formal, written documentsDescribed by unwritten principles Interpreted by courtsInterpreted by each individual Established by legislatures representing all people Presented by philosophers, religions, professional groups Applicable to everyonePersonal choice Priority determined by courts if two laws conflict Priority determined by an individual if two principles conflict Court is final arbiter of "right"No external arbiter Enforceable by police and courtsLimited enforcement Contrast of Law vs. Ethics.