Handbook of Infosec Terms 2.0/Handbook_of_Infosec_Terms_Version_2.0_ISSO.iso/text/privacy/p01_026.txt

Text File | 1996-09-03 | 11KB | 289 lines

PRIVACY Forum Digest     Friday, 20 November 1992     Volume 01 : Issue 26

         Moderated by Lauren Weinstein ([e-mail])
                Vortex Technology, Topanga, CA, U.S.A.

                     ===== PRIVACY FORUM =====

         The PRIVACY Forum digest is supported in part by the
          ACM Committee on Computers and Public Policy.


CONTENTS
    Re: Wire Taps, Key Management, and Privacy (Dorothy Denning)
    SURVEY RESULTS: Is Big Brother Watching You? (Lorrayne Schaefer)


 *** Please include a RELEVANT "Subject:" line on all submissions! ***
            *** Submissions without them may be ignored! ***

-----------------------------------------------------------------------------
The PRIVACY Forum is a moderated digest for the discussion and analysis of
issues relating to the general topic of privacy (both personal and
collective) in the "information age" of the 1990's and beyond.  The
moderator will choose submissions for inclusion based on their relevance and
content.  Submissions will not be routinely acknowledged.

ALL submissions should be addressed to "[e-mail]" and must have
RELEVANT "Subject:" lines.  Submissions without appropriate and relevant
"Subject:" lines may be ignored.  Subscriptions are by an automatic
"listserv" system; for subscription information, please send a message
consisting of the word "help" (quotes not included) in the BODY of a message
to: "[e-mail]".  Mailing list problems should be
reported to "[e-mail]".  All submissions included in this
digest represent the views of the individual authors and all submissions
will be considered to be distributable without limitations.

The PRIVACY Forum archive, including all issues of the digest and all
related materials, is available via anonymous FTP from site "cv.vortex.com",
in the "/privacy" directory.  Use the FTP login "ftp" or "anonymous", and
enter your e-mail address as the password.  The typical "README" and "INDEX"
files are available to guide you through the files available for FTP
access.  PRIVACY Forum materials may also be obtained automatically via
e-mail through the listserv system.  Please follow the instructions above
for getting the listserv "help" information, which includes details
regarding the "index" and "get" listserv commands, which are used to access
the PRIVACY Forum archive.

For information regarding the availability of this digest via FAX, please
send an inquiry to [e-mail], call [phone], or FAX
to [phone].
-----------------------------------------------------------------------------

VOLUME 01, ISSUE 26

   Quote for the day:

    Psychiatrist: "Tell me Harold, what do you do for fun?
                  What activity gives you a different sense of
               enjoyment from the others?
               What do you find fulfilling?
               What gives you that special satisfaction?"

    Harold:           "I go to funerals."

                    -- G. Wood and Bud Cort
                       "Harold and Maude" (1972)

----------------------------------------------------------------------

Date:    Thu, 19 Nov 92 17:57:01 EST
From:    [e-mail] (Dorothy Denning )
Subject: Re: Wire Taps, Key Management, and Privacy

In PRIVACY Forum Digest V01 #25, Brinton Cooper writes:

  In RISKS DIGEST 13.87, Dorothy Denning .. spoke of the high costs of lawful
  surveillance and asserted, "Much of this is related to organized crime,"
  perhaps a scare tactic?

Actually the majority of taps goes to narcotics investigations. After
that comes racketeering and gambling.  According to the FBI, the
hierarchy of Organized Crime has been neutralized or destabilized
through the use of electronic surveillance, and thirty odd years of
successes would be reversed if the ability to conduct court-authorized
electronic surveillance was lost.  I believe this represents an honest
assessment of what they see would happen.

   Her solution involves nongovernmental "key centers" which,
   presumably, would not give out keys to anyone without a properly
   executed court order.

By way of context, I'm looking for a way to balance our national
interests for privacy and security with those for effective law
enforcement.  This is one idea I proposed.  I am not pushing it as "the
solution".  In any case, the idea was for users to register their keys
with a trustee (key center).  Or, using a technique invented by Silvio
Micali, you could split your key into parts and register each part with
a different trustee.  Law enforcement would have to take a court order
to each trustee in order to get the pieces and reconstruct the key.

   She cites that the "...phone companies are so fussy about court
   orders that they send them back if the semicolons aren't right...,"
   apparently believing that the rights of the citizens are thereby
   protected.  For the following reasons, this is a politically naive
   position.

   1. It provides that our right to protection from illegal governmental
   search and seizure and/or illegal eavesdropping rests on the good will
   and integrity of a phone company!

Your statement does not follow from what I said.  I said the phone
companies are fussy.  I know of no cases where the phone companies
assisted with unauthorized taps.  If you do, please cite.  They could
go out of business if they didn't respect the rights of their
customers.  Even so, your right to protection does not rest entirely on
the phone company.  Title 18 makes tapping without a court order
illegal.

Crypto will make it much more difficult for anyone to tap illegally. If
the keys are registered with a trustee other than the phone company, someone
would have to subvert both the trustee and the phone company (to get the
bits).

   3. Court orders, search warrants, and the like protect citizens only
   when the information or evidence gathered is to be used in court against
   a suspect.  If information is being gathered for political purposes,
   blackmail, or other subversion of law (Watergate, Iran-Contra, the
   Italian bank scandal, etc), the purloined information will never see a
   public forum but can still do great harm to innocent persons.  Thus, the
   constraints of court orders are obviated.

I expect that most of this information is not being obtained by wiretapping.
It is popular to suggest it is and difficult to refute.  If someone
in law enforcement is found to be tapping without a court order, they
could be convicted of violating Title 18.

But in any case, it will be very difficult for LE to intercept without a
court order with the new digital technologies and crypto.

  The FBI needs to fund its own R&D from its own budget, just as the
  rest of the government at all levels must do.  There is talent that can
  "red team" modern telecommunications and find trapdoors when necessary.

Are you suggesting that it would be better for the FBI to break the
cryptosystems than go through a trustee with a court order?

Dorothy Denning

------------------------------

Date:    Fri, 13 Nov 92 09:16:56 EST
From:    [e-mail]
Subject: SURVEY RESULTS:  Is Big Brother Watching You?

   [ These results refer to a survey originally seen here in the
     PRIVACY Forum on Monday, 6 July 1992 (Volume 01 : Issue 07).
     The survey size was reported as 100 people.  The original
     survey introduction is included below. -- MODERATOR ]

---

The purpose of this survey is to collect data for a presentation that I
will give at this year's National Computer Security Conference in October.
I would like to thank you for taking the time to fill out this survey.  If
you have any questions, you can call me at 703-883-5301 or send me email at
[e-mail].  Please send your completed survey to:

Lorrayne Schaefer
The MITRE Corporation
M/S Z213
7525 Colshire Drive
McLean, VA 22102

1.    What is your title?

Engineer        31%        Manager            14%
Computer Scientist    25%        Systems Administrator    10%
Administrator        4%        Student            10%
Not Provided        2%        Professor        3%
Author            1%


2.    What type of work does your organization do?

Education        24%        Software Development    19%
Hardware Development    15%        Research        11%
Not Provided        6%        Other            8%
Government        6%        System Administration    2%
Telephone        5%        System Development    2%
Network Development    2%

3.    Does your organization currently monitor computer activity?  (Yes/No)

Yes            67%
No            32%
Unknown            1%

If yes, what type of monitoring does your company do (e.g., electronic
mail, bulletin boards, telephone, system activity, network activity)?

All            16%        System Activity            17%
Bulletin Boards        4%        Network Activity & Other    12%
Other            3%        Telephone Usage            7%
E-mail            2%        System & Network Activity    5%
Unknown            1%        N/A                1%

4.    If you are considering (or are currently) using a monitoring tool,
    what exactly would you monitor?  How would you protect this
    information?

System Usage        17%        N/A                43%
Accounting        5%        Nothing                11%
Everything        4%        Network Traffic            10%
Don't Know        3%        Other                2%
Bulletin Board        1%        Security            3%
E-mail            1%

5.    Are you for or against monitoring?  Why/why not?  Think in terms of
    whether it is ethical or unethical ("ethical" meaning that it is
    right and "unethical" meaning it is wrong) for an employer to
    monitor an employee's computer usage.  In your response, consider
    that the employee is allowed by the company to use the computer and
    the company currently monitors computer activity.

Against            52%
For            47%
N/A            1%

6.    If your company monitors employees, is it clearly defined in your
    company policy?

N/A            35%
No            34%
Yes            31%

7.    In your opinion, does the employee have rights in terms of being
    monitored?

Yes            90%
No            8%
Don't Know        2%

8.    In your opinion, does the company have rights to protect its as
    sets by using a form of monitoring tool?

Yes            91%
No            6%
Don't Know        3%

9.    If you are being monitored, do you take offense?  Managers: How do
    you handle situations in which the employee takes offense at being
    monitored?

No            42%
Yes            36%
N/A            22%

10.     What measures does your company use to prevent misuse of monitoring in
        the workplace?

None            36%        Don't Know        17%
N/A            22%        Policy            6%
Control of Information    4%        Security        6%
Honor System        4%        Warnings        3%
Other            2%

11.    If an employee is caught abusing the monitoring tool, what would
    happen to that individual?  If your company is not using any form of
    monitoring, what do you think should happen to an individual who
    abused the tool?

Reprimand        64%        Don't Know        17%
N/A            10%        Termination        5%
Nothing            4%

12.    Is it unethical to monitor electronic mail to determine if the
    employee is not abusing this company resource (e.g., suppose the
    employee sends personal notes via a network to others that are not
    work related)?  Why or why not?

No            49%
Yes            49%
N/A            2%

------------------------------

End of PRIVACY Forum Digest 01.26
************************