Computer Ethics & Social Issues

1. Computer Ethics & Social Issues Privacy

2. What is Privacy? • 4th Amendment • Protection against unreasonable search and seizure • Constitutional right to Privacy? • Not expressly granted • Courts have ruled that without a reasonable expectation of privacy, there is no privacy right • Supreme Court has ruled that privacy is protected under several constitutional amendments under the Bill of Rights

3. The “Reasonable Man” • Quasi-mythic legal concept used as an instrument of the courts • Similar to “Common Sense” • The Reasonable Man or Reasonable Expectation or Reasonable “X” • Considered legally acceptable provided the given person, action, etc. may be considered reasonable by the community presently affected by the circumstances under immediate evaluation

4. What is Reasonable? • Armed Federal Agents raid your house at midnight. They find you in possession of videos taken of national landmarks in highly-populated areas. You are taken into custody and held in prison. • Did you recently go on a vacation? Are the videos benign? Do you have a clean criminal record? • Are you a known and highly vocal anti-government conspirator with strong ties to overseas terrorist organizations?

5. What is Unreasonable?

6. Limits of Reason • Privacy – does it extend to information? • Private web browsing history on a home computer • Web browsing history on a public computer • Web browsing history on a business computer used during normal business hours • Should you be paranoid?

7. The Courts are Paranoid • Laws are in place to protect a person from the Government • Anti- “Big Brother” • Protection of financial data, credit reporting, purchasing habits, any and all records involving a person and their money • Unless you are a terrorist under the USA PATRIOT Act • No laws protect a person from a corporation • Why???

8. Privacy Laws • HIPAA • Health Insurance Portability and Accountability Act of 1996 • Holders of electronic data relating to medical records are required to safeguard such information to protect the privacy of the associated individual • Relevancy to College: • Student medical records, infirmary visits, psychological visits, Appalachian Nurse Practitioner Center

9. Privacy Laws • FERPA • Family Educational Rights and Privacy Act • Protection of a student’s educational information and prevention of unauthorized information disclosure • Relevancy to College: • Who has the right to see your academic transcript? Who can modify it? How is a student protected against unauthorized access?

10. Privacy Laws • Wiretap Act • Katz v. United States • Katz performed illegal gambling activities using a public phone booth. Evidence collected against him by the FBI and used to convict him included a recording of the conversation made via a device attached to the phone booth. • Katz appealed and the Supreme Court ruled in favor of Katz. • Katz had a reasonable expectation of privacy in using the phone booth. The Government thus committed an unreasonable search and seizure within the meaning of the 4th Amendment.

11. Privacy Laws • ECPA • Electronic Communications Privacy Act • Extends protections granted by the Wiretap Act to other media • Email, fax, internet messages • Government cannot intercept such communications without a court order based on probable cause

12. ECPA – The “Gotcha” • Pen Register • Device that records electronic impulses to identify the numbers dialed for outgoing calls • Trap and Trace • Device which records the originating number of incoming calls for a particular number • Both provide data for profiling an individual’s activities • To get a court order giving access to this data, LEA only needs to certify that the data is relevant to an ongoing criminal investigation. Prosecution does not need to justify the request and judges are required to approve every request • Smith v. Maryland • No expectation of privacy since the user of the communications system is willingly providing this information to the organization controlling communication

13. Wait… What? • FISA • Foreign Intelligence Surveillance Act of 1978 • Describes procedures for electronic surveillance and collection of foreign intelligence information in communications between foreign powers and agents of foreign powers • Does not allow surveillance involving a U.S. citizen without judicial authorization • Special FISA Court meets in secret to hear applications for orders approving surveillance in the U.S. • Applications are rarely denied

14. Privacy in the Wake of Terror

15. As a result of 9/11 • USA PATRIOT Act • Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 • Grants many new powers to U.S. LEAs and intelligence agencies • Ability for Gov’t to search telephone, email, medical, financial and other records • Heavily criticized for “giving law enforcement agencies the ability to abuse power”

16. USA PATRIOT Act (cont.) • Authorizes use of National Security Letters to gain access to personal records • Authorizes the Attorney General or a delegate to compel holders of an individual’s personal records to disclose them to the Gov’t • U.S. Citizens or Foreign Citizens, regardless of whether or not they are suspected of espionage or criminal activity • Not subject to judicial review or oversight

17. What Privacy? • Supreme Court rules that U.S. citizens have a reasonable right to privacy • USA PATRIOT Act provides that you have no reasonable expectation of privacy if you are a (terrorist) criminal and expect your (terroristic) criminal actions to be protected under privacy laws

18. Moral of the story? • If you are not a terrorist or a criminal, then you have nothing to be afraid of! • Do you agree? • What actions could be performed with a computer which could be interpreted as a criminal or terroristic event? • Innocent until proven guilty? Depends on the interpretation of the law given the specific circumstances and whether or not you are a potential threat • Innocent videotaping of national monuments while on vacation or intelligence gathering for a planned criminal activity?

19. Without a Supreme Court Ruling on Constitutionality…

20. USA PATRIOT Act and CS • Of key importance: • USA PATRIOT Act updates the Computer Fraud and Abuse Act to include computer trespassers as physical trespassers • Gaining access to a computer network and manipulating data, settings, or access is the same as physically entering the building the network, computer, or data is stored • Victims of computer trespass may now engage LEAs to combat hacking, DoS’ing, or the like just as they can against burglars.

21. Freedom of Information Act • Grants U.S. citizens access to information and records of the Federal government • Government has some privacy – requests must not be “unreasonable” • May not compromise national security • Any request which is denied is eligible for appeal • Notable requests under FOIA • President Kennedy assassination • Roswell, NM UFO incident • NSA’s cybersecurity program

22. Privacy in Business • Identity Theft • Personally Identifiable Information • SSNs, Full name, DoB, Address, DL #, etc. • The theft of such information relating to an executive of person with financial responsibilities within an organization could be catastrophic • Data Breaches • Organizations fail to safeguard the PII of customers or members under their care

23. Cybercrime is big $$$ • ID Theft Black Market • IDs sold in bulk on the DarkWeb • Targetand Michael’s are recent large PII data breaches with current black market appeal • How do criminals get this info? • Phishing • Surprisingly effective!!! • Spyware, Keyloggers, Trojans

24. Privacy in a Lawsuit • Electronic Discovery (e-discovery) • The collection, preparation, review, and production of electronically stored information for use in criminal and civil actions • At the request of the court, a business must comply with and be able to perform the e-discovery request or face legal consequences • Example: • Corporate email

25. Privacy of a Consumer • HAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA

26. You thought Government was bad?

27. NO CORPORATE RESTRICTIONS

28. No Consumer Privacy • Consumer Profiling • Use of cookies to datamine your web traffic • Use of crawlers to scan your hard drive to “fingerprint” you as a recurring website visitor • This information is often sold to other companies • Marketing Firms • Take the data sold to them and market an aggregated database of consumer profiles • DoubleClick (a subsidiary of Google) employs advertising networks to serve ads to thousands of websites. • All your web traffic is monitored and reviewed. This data is sold to people who single out your activities and market products they believe you will buy. • AND YOU DOBUY THEM

29. Consumer Control • Former Google CEO Eric Schmidt: • “We know where you are. We know where you’ve been. We can more or less know what you are thinking about.” • “We can suggest what you should do next, what you care about. Imagine: We know where you are, we know what you like.” • “The rise of Google, the rise of Facebook, the rise of Apple, I think are proof that there is a place for computer science as something that solves problems that people face every day.”

30. Workplace Privacy • Do you have a right to privacy in your work email system? Are your personal emails private and off-limits from the System Administrators? • How about your student email? • This is defined by the corporate email policy.

31. Workplace Privacy • As an employee of an organization, is your physical location at a given time and place a matter of personal privacy or corporate security? • Employee ID cards, when used to access buildings and services which require its use, could possibly be actively monitored by a corporate security team • This is defined by the corporate security policy.

32. Workplace Privacy • If issued a corporate laptop to take home and be able to work from home or travel when needed, is it a matter of privacy what computer networks you access from that computer or what software you install for personal use? • This is defined by the corporate acceptable computer use policy.

33. Workplace Privacy • Any privacy relating to what an employee does while on company time or on company premises or with company resources is completely dependent upon the policies of that company. • Employees may invoke legal action if their constitutional rights are endangered, from the perspective of a “reasonable” person.

34. Questions • Edward Snowden is hailed by many as an advocate of the constitutional right to privacy. • How are the secret actions of the NSA, as reported by Snowden, different from what many corporations do in plain sight? • Should corporations suffer the same scrutiny as the Government, or should the Government be afforded the same leniency as corporations enjoy when it comes to the privacy of U.S. citizens?