IT and Society Lecture 7: Security Issues

Recap – Information Security Management Systems (ISMS)

• ISMS emphasizes risk-driven management, selecting and implementing security controls based on risk assessments.
• Continuous improvement adapts to changes in the risk environment.
• Documentation-centered and integrates performance evaluation for processes and controls.
• The 27K series of standards is generic, adaptable, and flexible, covering varying security needs outside ICT.
• Certification schemes associated with these standards are increasingly utilized in practice.

Security in Organizations

• A gap exists between high-quality IT security research and collaboration with industry and policy makers.
• A comprehensive, scientifically validated method for prioritizing security measures is currently lacking.

Balancing National Security and Privacy

• National security interests intensified post September 11, 2001, raising questions about the feasibility of balancing national security with privacy.
• Dilma Rousseff emphasized that without the right to privacy, freedom of expression and democracy cannot thrive.

United States and Five Eyes Alliance

• The NSA and Five Eyes (U.S., Canada, U.K, Australia, New Zealand) have made extensive efforts to exert control over Internet security and surveillance.
• Whistleblowers like Edward Snowden have revealed details about the operational methods and capabilities of Western intelligence.

NSA History

• The NSA remained relatively unknown until 1982, with James Bamford's historical overview aided by FOIA requests uncovering its activities.

Programs: Prism

• Prism allows the FBI to conduct wiretaps on U.S. citizens legally with a warrant based on probable cause.
• Foreign individuals can be wiretapped without restrictions, raising concerns about privacy and surveillance overreach.

Programs: Muscular (U.K./U.S.)

• Involves data collection among major service firms, with claims that many encrypted communications may not be secure.
• SSL encryption may only protect data between the user's device and the CDN, but not during internal transfers.

Programs: Special Collection Service

• Employs strategies like implanting collection equipment within foreign telecoms and government facilities.
• Tempest monitoring collects data from electromagnetic emissions, prompting standards for shielding electronic devices.

Research Examples

• Focus areas include encrypted communications, examining the vulnerability of encryption methods used in VPNs and TLS connections.

Government Surveillance and Privacy

• A prevailing argument posits that security needs justify government surveillance, suggesting minimal privacy concerns for law-abiding citizens.
• A counterargument promotes privacy as a fundamental right that should be protected and not perceived as something to hide.

Freedom House Ratings

• Lower scores indicate better Internet freedom; ratings shift over time reflect changing circumstances in various countries.
• Reports analyze the state of Internet freedom comprehensively, detailing the implication of censorship and freedom restrictions.

From Filtering to Censorship

• Internet filtering often targets local content critical to governments, evolving into overt censorship of dissenting views.
• Websites related to human rights, independent media, and political opposition are common targets for blocking.

Collateral Impact of Internet Filtering

• Filtering can inadvertently restrict access to a broader range of content, extending beyond intended targets and stifling free expression.

Involvement of Private Entities

• Commercial entities may impose restrictions on freedom of speech in opaque ways, complicating public accountability.
• The infrastructure set up for filtering may lead to mission creep, expanding the reasons for censorship beyond the original intent.