Computer crime can broadly be defined as criminal activity involving an information technology infrastructure, including illegal access (unauthorized access), illegal interception (by technical means of non-public transmissions of computer data to, from or within a computer system), data interference (unauthorized damaging, deletion, deterioration, alteration or suppression of computer data), systems interference (interfering with the functioning of a computer system by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing computer data), misuse of devices, forgery (ID theft), and electronic fraud.
A computer can be :
#attacked
#used to attack
#used as a means to commit crime
Computer crime is hard to prosecute because:
#low computer literacy (lack of understanding)
#no physical clues (lack of physical evidence)
#intangible forms of assets
#considered as juvenile crime
#Lack of political impact
Examining a Case for Ethical Issues
1. Understand the situation. Determine the issues involved.
2. Know several theories of ethical reasoning
3. List the ethical principles involved
4. Determine which principles outweigh others.
Summary
Laws are formally adopted rules for acceptable behavior in modern society. Ethics are socially acceptable behaviors. The key difference between laws and ethics is that laws carry the sanction of a governing authority and ethics do not.
Organizations formalize desired behaviors in documents called policies. Policies must be read and agreed to before they are binding.
Civil law represents a wide variety of laws that are used to govern a nation or state. Criminal law addresses violations that harm society and are enforced by agents of the state or nation. Tort law is conducted by means of individual lawsuits rather than criminal prosecution by the state.
Showing posts with label Legal and Ethical Issues in Computer Security. Show all posts
Showing posts with label Legal and Ethical Issues in Computer Security. Show all posts
Tuesday, October 27, 2009
Protecting Programs and Data
Copyrights
designed to protect the expression of ideas applies to a creative work such as a story and song. intended to allow regular and free exchange of ideas must apply to an original work and it must be in some tangible medium of expression to cover works in the arts, literature and written scholarship
Patents
applies to the result of science, technology and engineering can protect a “new and useful process, machine, manufacture or composition of matter” designed to protect the device or process for carrying out an idea, not the idea itself
Trade Secret
must be kept a secret the owner must protect the secret by any means, such as by storing it in a safe, encrypting it and by making employees sign a statement that they will not disclose the secret trade secret protection can also vanish through reverse engineering
Information and The Law
Information as an Object not depletable
Information can be sold again and again without depleting stock or diminishing quality
Information has the value not the medium can be replicated
Can use the information and sell it many times minimal margin cost
The cost to produce another one after having produced others is small value is timely
The value of information often depends on when you know it often transferred intangibly
Information is being delivered as bits on a cable
Legal Issues Related to Information
Database
Problem:
Difficult to determine that a set of data came from a particular database so that the database can claim compensation electronic commerce
Goods are ordered electronically
Technical protection available:
Digital signatures and other cryptographic protocols
Problem:
How to prove conditions of delivery
Rights of Employees and Employers ownership of a patent
The person who owns a work under patent and copyright law is inventor (producer)
ownership of a copyright
Similar to ownership of a patent
The programmer is the presumed owner of the work
The owner has all rights to an object work for hire
The employer is considered the author of a work not the employee
Licenses
An alternative to ‘work for hire’ arrangement
Programmer develops and retain full ownership of the software
The programmer grants a license to a company to use the program
License can be:
For a copy or unlimited copies
To be used at one location or many etc
trade secret protection Trade secret is not registered
The ownership must be established
The information as confidential data
employment contracts
Will express the rights of ownership
Specifies:
The employee is hired to work as a programmer exclusively for the benefit of the company
The company states that it is a work for hire situation
The company claims all rights to any programs developed including all copyrights and the right to market
The employee receives access to certain trade secrets as a part of employment and the employees agrees not to reveal those secrets
Sometimes an agreement not to compute is included such as the employee is not to compete by working in the same field for a set period of time after termination
designed to protect the expression of ideas applies to a creative work such as a story and song. intended to allow regular and free exchange of ideas must apply to an original work and it must be in some tangible medium of expression to cover works in the arts, literature and written scholarship
Patents
applies to the result of science, technology and engineering can protect a “new and useful process, machine, manufacture or composition of matter” designed to protect the device or process for carrying out an idea, not the idea itself
Trade Secret
must be kept a secret the owner must protect the secret by any means, such as by storing it in a safe, encrypting it and by making employees sign a statement that they will not disclose the secret trade secret protection can also vanish through reverse engineering
Information and The Law
Information as an Object not depletable
Information can be sold again and again without depleting stock or diminishing quality
Information has the value not the medium can be replicated
Can use the information and sell it many times minimal margin cost
The cost to produce another one after having produced others is small value is timely
The value of information often depends on when you know it often transferred intangibly
Information is being delivered as bits on a cable
Legal Issues Related to Information
Database
Problem:
Difficult to determine that a set of data came from a particular database so that the database can claim compensation electronic commerce
Goods are ordered electronically
Technical protection available:
Digital signatures and other cryptographic protocols
Problem:
How to prove conditions of delivery
Rights of Employees and Employers ownership of a patent
The person who owns a work under patent and copyright law is inventor (producer)
ownership of a copyright
Similar to ownership of a patent
The programmer is the presumed owner of the work
The owner has all rights to an object work for hire
The employer is considered the author of a work not the employee
Licenses
An alternative to ‘work for hire’ arrangement
Programmer develops and retain full ownership of the software
The programmer grants a license to a company to use the program
License can be:
For a copy or unlimited copies
To be used at one location or many etc
trade secret protection Trade secret is not registered
The ownership must be established
The information as confidential data
employment contracts
Will express the rights of ownership
Specifies:
The employee is hired to work as a programmer exclusively for the benefit of the company
The company states that it is a work for hire situation
The company claims all rights to any programs developed including all copyrights and the right to market
The employee receives access to certain trade secrets as a part of employment and the employees agrees not to reveal those secrets
Sometimes an agreement not to compute is included such as the employee is not to compete by working in the same field for a set period of time after termination
Legal & Ethical
Law
a rule of conduct or action prescribed or formally recognized as binding or enforced by a controlling authority implies imposition by a sovereign authority and the obligation of obedience on the part of all subject to that authority
Ethics
a set of moral principles or values the principles of conduct governing an individual or a group an objectively defined standard of right and wrong
Categories of Law
Civil law: represents a wide variety of laws that govern a nation or state
Criminal law: addresses violations harmful to society and is actively enforced through prosecution by the state
Tort law enables individuals to seek recourse against others in the event of personal, physical, or financial injury.
Torts are enforced via individual lawsuits rather than criminal prosecutions by the state. When someone brings a legal action under tort law, personal attorneys present the evidence and argue the details rather than representatives of the state, who prosecute criminal cases.
The categories of laws that affect the individual in the workplace are private law and public law.
Private law regulates the relationship between the individual and the organization, and encompasses family law, commercial law, and labor law.
Public law regulates the structure and administration of government agencies and their relationships with citizens, employees, and other governments, providing careful checks and balances. Examples of public law include criminal, administrative, and constitutional law
Law and Ethics
Laws are rules that mandate or prohibit certain behavior in society
ethics, which define socially acceptable behaviors.
The key difference between laws and ethics is that laws carry the sanctions of a governing authority and ethics do not. Ethics in turn are based on cultural mores: the fixed moral attitudes or customs of a particular group.
Some ethics are recognized as universal. For example,murder, theft, assault, and arson are commonly accepted as actions that deviate from ethical and legal codes in the civilized world.
Differences between Laws and Ethics
LAW
+Formal, documented
+Interpreted by courts
+Established by legislature representing everyone
+Applicable to everyone
+Priority determined by courts if two laws conflict
+Enforceable by police and courts
ETHIC
+Described by unwritten principles
+Interpreted by individuals
+Presented by philosophers, religions, professional group
+Personal choice
+Priority determined by individual if two principles conflict
Ethics Concept in Information Security
Ethical Differences Across Cultures
Cultural differences can make it difficult to determine what is and is not ethical especially when considering the use of computers.
individuals of different nationalities have different perspectives; difficulties arise when one nationality’s ethical behavior conflicts with the ethics of another national group
For example, to Western cultures, many of the ways in which Asian cultures use computer technology is software piracy. This ethical conflict arises out of Asian traditions of collective ownership, which clash with the protection of intellectual property
Software License Infringement
the individuals surveyed understood what software license infringement was but felt either that their use was not piracy, or that their society permitted this piracy in some way the lack of legal disincentives, the lack of punitive measures, or any one of a number of other reasons could also explain why these alleged piracy centers were not oblivious to intellectual property laws
Illicit Use
The individuals studied unilaterally condemned viruses, hacking, and other forms of system abuse as unacceptable behavior
The low overall degree of tolerance for illicit system use may be a function of the easy association between the common crimes of breaking and entering, trespassing, theft, and destruction of property to their computer-related counterparts
Misuse of Corporate Resources
Individuals displayed a rather lenient view of personal use of company equipment.
A range of views within the acknowledgement of ethical versus unethical behavior as to whether or not some actions are moderately or highly acceptable
Ethics and Education
Differences in the ethics of computer use are not exclusively international.
Differences are found among individuals within the same country, within the same social class, and within the same company
Deterrence to Unethical and Illegal Behavior
It is the responsibility of information security personnel to do everything in their power to deter these acts and to use policy, education and training, and technology to protect information and systems
Three general categories of unethical and illegal behavior:
Ignorance
Accident
Intent
Three general categories of unethical and illegal behavior:
Ignorance
ignorance of the law is no excuse, however ignorance of policy and procedures is
Accident
Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage by accident
Intent
Intent is often the cornerstone of legal defense, when it becomes necessary to determine whether or not the offender acted out of ignorance, by accident, or with specific intent to cause harm or damage
Deterrence
Deterrence is the best method for preventing an illegal or unethical activity. Laws, policies, and technical controls are all examples of deterrents. However, it is generally agreed that laws and policies and their associated penalties only deter if three conditions are present
Fear of penalty: The individual intending to commit the act must fear the penalty. Threats of informal reprimand or verbal warnings may not have the same impact as the threat of imprisonment or forfeiture of pay.
Probability of being caught: The individual has to believe there is a strong possibility of being caught performing the illegal or unethical act. Penalties can be severe, but the penalty will not deter the behavior unless there is an expectation of being caught.
Probability of penalty being administered: The individual must believe that the penalty will in fact be administered.
a rule of conduct or action prescribed or formally recognized as binding or enforced by a controlling authority implies imposition by a sovereign authority and the obligation of obedience on the part of all subject to that authority
Ethics
a set of moral principles or values the principles of conduct governing an individual or a group an objectively defined standard of right and wrong
Categories of Law
Civil law: represents a wide variety of laws that govern a nation or state
Criminal law: addresses violations harmful to society and is actively enforced through prosecution by the state
Tort law enables individuals to seek recourse against others in the event of personal, physical, or financial injury.
Torts are enforced via individual lawsuits rather than criminal prosecutions by the state. When someone brings a legal action under tort law, personal attorneys present the evidence and argue the details rather than representatives of the state, who prosecute criminal cases.
The categories of laws that affect the individual in the workplace are private law and public law.
Private law regulates the relationship between the individual and the organization, and encompasses family law, commercial law, and labor law.
Public law regulates the structure and administration of government agencies and their relationships with citizens, employees, and other governments, providing careful checks and balances. Examples of public law include criminal, administrative, and constitutional law
Law and Ethics
Laws are rules that mandate or prohibit certain behavior in society
ethics, which define socially acceptable behaviors.
The key difference between laws and ethics is that laws carry the sanctions of a governing authority and ethics do not. Ethics in turn are based on cultural mores: the fixed moral attitudes or customs of a particular group.
Some ethics are recognized as universal. For example,murder, theft, assault, and arson are commonly accepted as actions that deviate from ethical and legal codes in the civilized world.
Differences between Laws and Ethics
LAW
+Formal, documented
+Interpreted by courts
+Established by legislature representing everyone
+Applicable to everyone
+Priority determined by courts if two laws conflict
+Enforceable by police and courts
ETHIC
+Described by unwritten principles
+Interpreted by individuals
+Presented by philosophers, religions, professional group
+Personal choice
+Priority determined by individual if two principles conflict
Ethics Concept in Information Security
Ethical Differences Across Cultures
Cultural differences can make it difficult to determine what is and is not ethical especially when considering the use of computers.
individuals of different nationalities have different perspectives; difficulties arise when one nationality’s ethical behavior conflicts with the ethics of another national group
For example, to Western cultures, many of the ways in which Asian cultures use computer technology is software piracy. This ethical conflict arises out of Asian traditions of collective ownership, which clash with the protection of intellectual property
Software License Infringement
the individuals surveyed understood what software license infringement was but felt either that their use was not piracy, or that their society permitted this piracy in some way the lack of legal disincentives, the lack of punitive measures, or any one of a number of other reasons could also explain why these alleged piracy centers were not oblivious to intellectual property laws
Illicit Use
The individuals studied unilaterally condemned viruses, hacking, and other forms of system abuse as unacceptable behavior
The low overall degree of tolerance for illicit system use may be a function of the easy association between the common crimes of breaking and entering, trespassing, theft, and destruction of property to their computer-related counterparts
Misuse of Corporate Resources
Individuals displayed a rather lenient view of personal use of company equipment.
A range of views within the acknowledgement of ethical versus unethical behavior as to whether or not some actions are moderately or highly acceptable
Ethics and Education
Differences in the ethics of computer use are not exclusively international.
Differences are found among individuals within the same country, within the same social class, and within the same company
Deterrence to Unethical and Illegal Behavior
It is the responsibility of information security personnel to do everything in their power to deter these acts and to use policy, education and training, and technology to protect information and systems
Three general categories of unethical and illegal behavior:
Ignorance
Accident
Intent
Three general categories of unethical and illegal behavior:
Ignorance
ignorance of the law is no excuse, however ignorance of policy and procedures is
Accident
Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage by accident
Intent
Intent is often the cornerstone of legal defense, when it becomes necessary to determine whether or not the offender acted out of ignorance, by accident, or with specific intent to cause harm or damage
Deterrence
Deterrence is the best method for preventing an illegal or unethical activity. Laws, policies, and technical controls are all examples of deterrents. However, it is generally agreed that laws and policies and their associated penalties only deter if three conditions are present
Fear of penalty: The individual intending to commit the act must fear the penalty. Threats of informal reprimand or verbal warnings may not have the same impact as the threat of imprisonment or forfeiture of pay.
Probability of being caught: The individual has to believe there is a strong possibility of being caught performing the illegal or unethical act. Penalties can be severe, but the penalty will not deter the behavior unless there is an expectation of being caught.
Probability of penalty being administered: The individual must believe that the penalty will in fact be administered.
Subscribe to:
Posts (Atom)
