AUTHOR
Jeffrey H. Matsuura

ABSTRACT

There is increasing support for “self-help” measures in response to perceived or actual misuse of computer systems. Network operators who recognize that their network is under attack often seek authority to take action to disable the attacker. Owners of copyright protected material ask for permission to act to disable computers that store pirated versions of their works. Some copyright owners also deliberately distribute corrupted versions of their material to frustrate pirates. Internet service providers who receive a high volume of messages from a source sometimes assume it to be unsolicited commercial e-mail, and block the messages, at times resulting in non-delivery of legitimate messages. Commercial vendors of software often seek the right to be able to disable the software they sell if the licensee fails to fulfill its license obligations. Security authorities and researchers commonly make use of “honeypots” to attract computer attacks in order to gather information about such attacks and to identify security suspects.

This paper explores the question: At what point do such aggressive digital actions, taken in the name of defense of established legal rights, cease being legitimate responsive defensive measures, and become unethical (and potentially unlawful) offensive actions? The paper will examine traditional concepts of self-defense and mitigation of harm, and will apply those principles to these active digital defensive schemes.

The paper will examine the interaction between these digital self-help or self-defense initiatives and the increasing number of computer security laws and regulations. Laws such as the Computer Fraud and Abuse Act, in the United States, prohibit unauthorized access to computers and computer networks. Those legal restrictions are primarily aimed at preventing malicious conduct against computer systems. Those same prohibitions, however, could be applied against parties who take action against the computers of another party, based on a claim of self-defense. The issue is one of determining when a victim has become a lawbreaker as a result of damages inflicted by its digital counterattack. Those damages could injure the original attacker or some innocent third party who is affected by the counterattack unintentionally.

The paper will also examine legislative initiatives that encourage these self-help measures. For example, efforts have been made in the United States Congress to pass legislation that would permit copyright owners to take action against peer-to-peer file-sharing networks involved in piracy, without facing full liability for damage they might cause to other computers (the P2P Piracy Protection Act). Although Congress has not yet enacted such legislation, that approach illustrates how far some officials appear to be prepared to go to permit aggressive defensive actions in the name of enforcement of rights or responses to digital attack.

The paper will examine the potential consequences of widespread use of active digital self-defense. Consequences include a potential escalation of conflict as victims of digital attacks unleash counterattacks, as a matter of course. The paper will examine whether such an environment actually makes the entire Internet less stable and less secure than it is today. The paper will also consider whether this is the type of conduct and environment we should accept, from an ethical perspective.

The paper will include a recommendation as to an acceptable approach to the issue of legitimate digital defensive actions. The paper will suggest that parties should not be encouraged to rely on digital counterattacks to defend their rights. The cost of widespread counterattacks, in terms of damage to innocent parties, is likely to be too high. In addition, the environment created in the online community by reliance on digital vigilantism is not an ethically healthy one. That approach would tend to undermine the stability of the online community, making both individuals and organizations reluctant to expand their online activities. Instead, resources should be directed toward digital defensive measures that reduce the opportunities for attacks, and those that increase the costs to the attacker. Appropriate defensive measures would likely include pooling of the effort and cost associated with defense among service providers and users. This type of collective defensive approach appears to be more likely to establish a stable and secure online environment than would rampant self-help activities by individual parties.

Promotion of aggressive digital counterattacks would push the online community toward chaos. A chaotic online environment will be less attractive to casual and commercial users, thus inhibiting the development of the Internet and electronic commerce. No one will be better off in such an unstable community. Aggressive digital self-defense may provide the illusion of order, but it is actually more likely to signal the beginning of a descent into profound disorder for the online community.

AUTHOR
Konstantinos Markellos, Penelope Markellou, Maria Rigou, Spiros Sirmakessis and Athanasios Tsakalidis

ABSTRACT

Privacy has become increasingly important as the Internet constitutes now part of our lives. Even though this word has many connotations in the society the following definition can be adopted for the case of web “privacy is the subjective condition a person experiences when two factors are in place, firstly he/she must have the power to control information about himself/herself and secondly he/she must exercise that control consistent with his/her interests and values” [Privacilla.org. Privacilla’s Two-Part Definition of Privacy ( http://www.privacilla.org/funda mentals/privacydefinition.html]. In other words, a web-site in order to obtain and analyze data on its the web users needs their permission.

Considerable controversy has been arisen recently on web personalization privacy issues [Volokh, E. (2000). Personalization and Privacy. Communications of the ACM, Vol. 43, No. 8, pp. 84-88, August 2000.]. It is obvious that personalization techniques require rich data from the users. A login (usually user’s name) and a password are not enough. Most web-users are not willing to give more information about themselves. They want to be assured that their personal information will not be shared with anyone else without their prior explicit permission.

The 6th WWW User Survey conducted by the Graphics, Visualization and Usability Center of the Georgia Institute of Technology showed that the main reason for not registering in a web-site is that the terms/conditions of how the collected information is going to be used are not clearly specified (70%) [GVU – Graphics, Visualization and Usability Center of the Georgia Institute of Technology (1996). 6th WWW User Survey (http://www.gvu.gatech.edu/ user_surveys/survey-10-1996/#highsum]. Another survey conducted by the Personalization Consortium indicated that privacy issues are important for the users but they would share personal information in exchange for better services [Personalization Consortium (http://www.personalization.org).]. Moreover, 58% of users require a privacy statement from the web-site and even 51% read it before registering on the site. Furnell and Karweni [Furnell, S.M. and Karweni, T. (1999). Security Implications of Electronic Commerce: a Survey of Consumers and Businesses. Internet Research, Vol. 9, No. 5, pp. 372-382.] in their study found that 87.5% of surveyed consumers expect to see comprehensive information regarding privacy policy when visiting a commerce web-site. On the other hand survey in [Liu, C. and Arnett, K. (2002). An Examination of Privacy Policies in Fortune 500 Web Sites. Mid-American Journal of Business. Vol. 17, No. 1, pp.13.] examined web-sites of the Fortune 500 and showed that slightly more that 50% of sites provide privacy policies on their home pages.

So, personalization and therefore web mining techniques have to overcome the privacy problem in order to present satisfactory results. These novel technologies retrieve and analyze data from different sources in order to extract “hidden” information and knowledge. Consequently, it is obviously that privacy has been put in jeopardy since information about online user activities are recorded for constructing individual or group profiles. To maximize data gathering opportunities, web-sites collect data from every user touch point, online (registration, transactions, sign-ups, profiles, preferences, surveys, services, web log files, advertising banners, sweepstakes and other promotions requiring user’s data) and offline (services by phone, in-store transactions, paper submissions like sweepstake or promotion entries).

From the above the arisen question is how to protect people from the misuse of personal information on the web. This need for web user’s privacy has created a new market dedicated to design and develop products for protecting information privacy. There are many products for:

• Managing cookies: Burnt Cookies, Cookie Cruncher, Cookie Cutter, MagicCookie Monster, Spy Blocker, Cookie Pal, Cookie Master, Buzof, PGPcookie.cutter, NSClean & IEClean, Complete Cleanup, Cookie Terminator.
• Surfing anonymously through proxy servers: Anonymity 4 Proxy, PrivadaProxy, Internet Junkbuster Proxy, ProxyMate, Anonymizer, Naviscope.
• Encrypting e-mail: PGP, PEM, HushMail, Diasappearing E-mail, ZipLip Mail.
• Blocking unwanted files: AdSubtract SE, IDcide Privacy Companion.
• Cleaning residual files: Window Washer, Internet Guard Dog.
• Managing user’s identity: Freedom, Digitalme, Personal Child Persona.
• Purchasing anonymously: ZixCharge, iPrivacy.
• Maintaining user’s firewall: Norton Internet Security 2000.
• Searching the Internet privately: TopClick Private Web Search.
• Generating privacy policy: Privacy Wizard, DMA’s Privacy Policy Generator, OECD Privacy Policy Generator, Policy Editor, P3Pwriter Privacy Policy Editor.

The last one was developed by the World Wide Web Consortium (W3C) in 1999 [P3P. Platform for Privacy Preferences Project (http://www.w3.org/P3P).]. P3P is a standard, which provides a simple and automated way for users to gain more control over their personal information when visiting web-sites. At its most basic level, P3P is a standardized set of multiple- choice questions, covering all the major aspects of a web-site’s privacy policies. Taken together, they present a clear snapshot of how a site handles personal information about its users. P3P-enabled web-sites make this information available in a standard, machine-readable format that P3P-enabled browsers can “read” automatically and compare it to the user’s own set of privacy preferences. P3P enhances user control by putting privacy policies where users can find them, in a form users can understand, and, most importantly, enables users to act on what they see.

Many web-sites provide a privacy statement or a P3P policy that the user can view with a browser. P3P helps protect the privacy of user’s personal information on the Internet by simplifying the process for deciding whether and under what circumstances personal information is disclosed to web-sites. However, while P3P provides a standard mechanism for describing privacy practices, it does not set a privacy standard which web-sites must follow. In Internet Explorer for instance the user can define his/her privacy preferences for handling cookies. So, when he/she browse to web-sites, Internet Explorer determines whether the sites provide P3P privacy information. For sites that provide this information, the browser compares user’s privacy preferences to the site’s privacy policy information. In this manner, Internet Explorer decides whether to allow cookies or restrict them. As an example, the user can choose to block cookies which use personally- identifiable information without his/her clear consent. A P3P-compliant web-site must provide a clear definition of its privacy policies.

Nowadays the new technologies/products for protecting user’s privacy on computers and networks are becoming increasingly popular. However, none can guarantee secure communications. So, electronic privacy issues in the foreseeable future will become highly crucial and intense.

In this framework, the full paper will present firstly some theoretical issues concerning the meaning and the significance of privacy. Then we will discuss the fine line between web personalization and personal intrusion and control when recording and modeling the user. The cases when this line is crossed will be also identified. The need for privacy has also created a market of products designed to protect user’s personal information. The solutions that technology can offer to website owners and visitors and the most well-known domain standards will be investigated. Finally, we will discuss open research issues since apart from the privacy threats that may emerge from the use of web mining for personalization, the same technology can also be deployed to identify privacy violations.

REFERENCES

Furnell, S.M. and Karweni, T. (1999). Security Implications of Electronic Commerce: a Survey of Consumers and Businesses. Internet Research, Vol. 9, No. 5, pp. 372-382.

GVU – Graphics, Visualization and Usability Center of the Georgia Institute of Technology (1996). 6th WWW User Survey ( http://www.gvu.gatech.edu/user_surveys/survey-10-1996/#highsum).

Liu, C. and Arnett, K. (2002). An Examination of Privacy Policies in Fortune 500 Web Sites. Mid-American Journal of Business. Vol. 17, No. 1, pp.13.

P3P. Platform for Privacy Preferences Project (http://www.w3.org/P3P).

Personalization Consortium (http://www.personalization.org).

Privacilla.org. Privacilla’s Two-Part Definition of Privacy ( http://www.privacilla.org/funda mentals/privacydefinition.html).

Volokh, E. (2000). Personalization and Privacy. Communications of the ACM, Vol. 43, No. 8, pp. 84-88, August 2000.

AUTHOR
Nicolas Mangos and Maz Demosthenous

ABSTRACT

This paper analyses recent work that has considered customizing web sites to fit various specific country cultures. The importance of cultural differences in web site designing is not new and has been investigated using the Hostede approach where some researchers concentrated on masculinity versus femininity where countries are differentiated by their gender roles (Dormann and Chisalita, 2002). Others have used the complete five dimensions of Hofstede in there analysis of cultural issues in web site redesign which include: long-term versus short term orientation; femininity versus masculinity power-distance; collectivism versus individualism and uncertainty avoidance (Marcus and Gould, 2000; Sheridan, 2002).

Whilst the Hofstede model has proven useful in various social science disciplinary research, it does have its limitations if solely relied upon to reflect cultural barriers. The current paper suggests that going beyond the convenience of Hofstede model may provide additional and useful insights into cultural barriers in web site designing. An eCuturation model is proposed which includes the Hofstede model but only as one part of the cultural interface elements.

The major contribution of the paper is the development of an eCulturation model. Where eCulturation refers to the process that facilitates culturally sensitive Web site design. The idea is to minimize cultural barriers to effective online global communication. The model developed in this paper identifies, classifies and conceptualises the factors that may contribute to cultural barriers by drawing on research that has described and empirically tested these factors. In developing the eCulturation model, cultural components are conveniently divided into four major cultural components, which include customs, traditions, mores, and values (refer to eCulturation figure attached). The next level of the model identifies the cultural interface elements that emanate from the cultural components. The ten cultural interface elements include: language, colour, symbols, form, look and feel, gestures, credit card acceptance, image/advertising, zip codes, and Hofstede’s five dimensions. It is these ten elements that can have an important impact on web site design but are not contained in any known holistic web-site design model.

Interestingly zip codes are country specific, for instance in Australia and Hong Kong there are postcodes which do not fit the space and nature of an international zip code response to an internet prompt on the screen, so in this instance there is a lost response. Therefore the postcode is not the traditional code used by other countries, which makes the zip code traditional, leading to a cultural problem of country identity when responding via the web cite. In this way the determination of geography implies cultural elements. It can also be categorised as “culture intertwined with the use of technology” (Ulfelder , page 3, 2000).

The proposed model positions web design at the centre and that this design needs to adapt to a select number of cultural interface elements which are reflective of cultural components of the particular country in question (refer to figure of model attached). The proposed model whilst appearing to be all encompassing can still be used to help focus on those cultural elements that are characteristic of the particular country in question. It is all too simplistic to apply a relatively standard approach to web site design from an economic rationale point of view. To help avoid cultural communication problems, web sites should be designed to reflect customs, traditions, mores and values of local culture. For each country these issues will have differences and similarities. The identification of these similarities and differences may be enhanced by using the eCulturation model developed in this paper

The results of this explanatory study, provides evidence of the need to localise web sites according to the country you target. There is an argument that suggests that there is a need to adapt web sites to each country to make customers feel at home with the site. On the other hand there is a contrary argument that you can standardise the majority of the elements. For instance Levitt (1983) seminal paper on globalisation refers to consumer convergence and that there is one world one product suggestive of a standard approach to global business. Through the process of eCulturation one can safely standardise where cultural factors/ elements are common to countries and adopt to those that are different.

Furthermore, this web site redesign can be achieved and refined through validation by local partners on a global level. In the globalisation debate where it is suggested that the optimal position is to standardise where you can and localise where necessary. The proposed model can be effectively used to differentiate what may be standardised and alternatively what has to be localised in particularly using the cultural interface elements. The myth of globalisation suggests that you really need to be culturally sensitive even though there do appear pockets of standardisation in global business.

Figure above is a diagrammatic representation of the proposed eCulturation model.

Where Cultural Components include: customs, traditions, mores and values

Where Cultural Interface Elements include: language, colour, symbols, form, look andfeel, gestures, credit card acceptance, image/advertising, zip codes and includes Hofstede’s five dimensions.

The outer circle is not an exhaustive list of interface elements but can accommodate other specific cultural issues pertaining to specific country characteristics. The eCulturation model is assumed to be flexible enough as to capture most relevant interface elements that are identified as relevant cultural barriers to effective web site communication and implementation.

AUTHOR
B R Mandre, C G Aher, D V Patil, Atulchandra Kulkarni

ABSTRACT

The information technology stands for the technology in making the information available for the people. It itself gives the freedom of information. But total freedom of information may raise some serious issues in the information society. In spite of freedom of information the most needed thing is the privacy of information. This paper describes both the aspects of the information; it’s consequence, need, reality and issues in balancing both of them.

The unification of information technology, telecommunications and communication technologies has transformed the whole world into an information society making the whole world as if it is a global village. The each and everything in this information society is on the fingertips of all the people irrespective of their time zone, geographic location and country. The technology has made a big impact on the accessibility of information. Due to the information technology, the society has changed in very complex manner. It will be a challenging task to discover impact of technology on privacy and freedom of information.

This paper describes the privacy, freedom of information and ethical issues related to the information usage. As such, both are the very important aspect of the information. It focuses on the various issues related to the privacy and freedom of information, responsibilities and influence of the information technology on each of these.

Privacy of information is a very important aspect about an individual or an organization. It protects some specific information about an individual or an organization from being public. This is the factor which should be given due consideration in this information society. As such, privacy is an important factor in this competitive and borderless information world.

Privacy and freedom of information are exactly opposite ends of the aspects of the information. It can be examined by making a comparison of privacy of information versus the freedom of information.

Privacy stands for the needs of the individuals in protecting some information. While, the freedom of information stands for the demand of the society in getting the information. The conflict fires up when both these overlap.

These aspects can be studied in detail by concentrating on following main issues. First is how much information of an individual other people may need to access. Second is how much one should have access to his/her own private information that other people hold. Another is how much access one should have to public information.

The Privacy stands for the interest that individuals have in sustaining personal information free from interference by other people and organizations. The freedom of information stands for the interest that people in society in having the information about an individual, an organization or about a process freely.

Information Privacy is the interest an individual has in controlling, or at least significantly influencing, the handling of data about themselves. Privacy Protection is a process of finding appropriate balances between privacy and multiple competing interests.

Many software companies collect the personal data from the user while installing or downloading the software. This data may be misused in the information society. The threats of hacking makes it mandatory to give attention to the privacy issues.

Authors discuss about the issues in protection from the bulk mails and the email from unknown people. It also discuss about the privacy issues in other related activities on the Internet.

This paper discusses the various issues related to the privacy, freedom of information, privacy protection and information society. It focuses on how the information society is threatened from privacy issues.

This paper gives in depth coverage of the impact of information technology on the privacy issues, freedom of information, advantages, threats, opportunities, effect on it’s stakeholders and focuses on the directions in which the privacy should be protected in information society.

AUTHOR
Fillia Makedon, C.B. Owen, C. Sudborough, S. Kapidakis, P. Gloor, C. Heckman, J. Ford, J. Pearlman

ABSTRACT

Cases where the failure to share information places humans or property at risk present an ethical dilemma: the risk of harm supports ethical arguments for less restrictive information sharing, while privacy and ownership concerns support ethical arguments for more restrictive information sharing. This paper considers technical means to address this ethical dilemma in the context of a new data-sharing framework called SCENS (Makedon et al. 2003, Ye et al. 2003) based on metadata libraries (Makedon et al. 2002).

The SCENS approach uses negotiation technologies to establish conditions for information sharing, allowing for sharing that would not be possible otherwise. The negotiation system enables communication and cooperation as it brokers agreements from sharing parties that determine who, what, how and for how long there is access to the shared information. Case studies from four domains are analyzed to examine similarities and differences. The central thesis of the paper is that SCENS can provide an appropriate means for easing, and possibly resolving, the ethical dilemma of data sharing under risk.

Ethical issues relative to information sharing often arise because available information can be used in an unplanned way or without the consent of the information owner. Indeed, significant legislation has been passed that codifies these ethical principles into law. However, considering only the viewpoint of data owners ignores the ethical issues introduced when a risk exists that data sharing could alleviate. In these cases, sharing of information may be needed to solve a problem involving the safety or well-being of humans or property.

In this paper we analyze cases in the context of four domains: medicine, social services, e-government, and international security. We argue that well-meaning but poorly-crafted laws that consider only the negative effects of information sharing, such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA 1996) in the United States, often put individuals at risk. We consider risks such as terrorism that demonstrate the hazards of not facilitating the sharing of information across government agencies. We then outline a negotiation approach based on determining restrictions and stipulations on the use of data on a case-by-case basis.

Case studies in four domains

1. Medical

Recent HIPAA restrictions greatly hinder data sharing capabilities among authorized medical clinicians and researchers. For example, medical test results may be unavailable to a clinical specialist even when an emergency exists, such as a decision whether to operate on a patient or not. In this case, the desire to protect patient’s data from misuse may run counter to the needs of the patient.

2. Social services

Social services manage situations such as mental health, poverty, alcoholism, and child abuse. The data may include psychological observations, performance tests, or brain scans, and due to legitimate concerns about privacy and the sensitivity of individual records, different institutions rarely make these available except on a case-by-case basis. Thus, although sharing in this domain may dramatically improve the level and quality of care by cutting costs, helping research, and aiding funding efforts, it is currently very difficult to arrange due to the effort required for each attempt to gain authorization for access.

3. E-government

The new electronic communication infrastructure known as “e-government” has made many government services accessible through electronic interfaces, both for the public and for internal government affairs. E-government can offer around-the-clock access, transparency, accountability, up-to-date information, and other benefits. To be fully efficient in such a system, different government agencies must be willing to share their data and analyses of these data; however, concerns about data security and acknowledgement of effort often hamper cooperation.

4. International security

International security requires preparedness for current and emerging risks. Security organizations face difficult challenges overcoming cultural barriers and deriving knowledge from the assimilation of diverse information quickly and accurately. As the world becomes more crowded, complex, and interconnected, international security agencies operating in isolation are hampered in their efforts to monitor and assess security risks. However, as in the case of e-government, cooperation between parties is hampered when the benefits of making contributions are difficult to perceive.

SCENS sharing approach

We believe that a technological solution can be used to attack the ethical dilemma between satisfying concerns about security, ownership, and privacy and the perceived need to provide access to data needed to combat risks. Key to deciding on an ethical information sharing approach is to involve the people who provide and use the information in a negotiation on how it may be used. To address privacy concerns, people can consent on the use of personal information as part of the negotiated conditions: this can include determining what part of the information will be available for use in each case, in which cases information will be available, and who will be allowed to make use of the information (or what conditions the user of the information will satisfy). An information sharing system must include appropriate incentives for both information owners and information users.

A negotiation-based mechanism of communication and cooperation
At Dartmouth we are building SCENS: Secure Content Exchange Negotiation System. SCENS automates the process of reaching agreement between two or more parties as it documents the conditions under which exchange or sharing of information is to take place. These conditions can be usage requirements, such as limitations on duration, or specification of the persons or groups who can be involved in information sharing. SCENS also supports “group negotiation” useful for “distributed decision making”. Group negotiation sets conditions that a critical mass of users must agree upon, and allows individual negotiations to succeed only if many contracts with similar terms reach agreement.

REFERENCES

U.S. Public Law 104-191. August 21, 1996. Health Insurance Portability and Accountability Act of 1996, subtitle F: Administrative Simplification.

Makedon F., Ford J. C., Shen L., Steinberg T., Saykin A. J., Wishart H. A., and Kapadakis S. 2002. “MetaDL: A Digital Library of Metadata for Sensitive or Complex Research Data,” presented at European Conference on Digital Libraries (ECDL2002), Rome, Italy.

Makedon F., Kapadakis S., Steinberg T., Ye S., and Shen L. 2003. “Data brokers: Building collections through automated negotiation,” Dartmouth College Computer Science Department, Hanover, NH, Technical Report DEVLAB-SCENS-03-02, March 2003.

Ye S., Makedon F., Steinberg T., Shen L., Ford J., Wang Y., Zhao Y., and Kapidakis S. 2003. “SCENS: A system for the mediated sharing of sensitive data,” presented at Third ACM/IEEE Joint Conference on Digital Libraries, Houston, TX.

AUTHOR
Peter Madsen

ABSTRACT

Digital Fluency is the title of a project that has recently revised Carnegie Mellon University’s Computer Skills Workshop to integrate computer ethics topics with those dealing with competent computer use. The overall goal of the project is to make students aware of their responsibilities as citizens of our campus and of the wider information society beyond. This year the ethics module treated the problems of P2P file sharing and Internet plagiarism. In this plenary session there will be a report on the planning, design and development phases of the project, a demonstration of the online materials used in the ethics module including two web-based guided inquiries, and a discussion of its hybrid delivery system.