For A-plus Writer Only

Management Information Systems for The Information Age

Haag, S., & Cummings, M. (2013). Management information systems for the information age.

New York: McGraw-Hill.

MANAGEMENT INFORMATION

SYSTEMS FOR THE INFORMATION AGE

> > Ninth Edition Stephen HAAG I Maeve CUMMINGS

_.

CHAPTER EIGHT OUTLINE

1. Define ethics and describe the two factors that affect how you make a decision concerning ethical issue.

2. Define and describe intellectual property, copyright, Fair Use Doctrine, and pirated software.

3. Define privacy and describe ways in which it can be threatened.

4. Describe the ways in which information on your computer or network is vulnerable and list measures you can take to protect it.

227 Industry Perspective Lack of Ethics in the Workplace Can Lead to Lost Productivity

234 Industry Perspective Personally Identifiable Information Not Needed

237 Global Perspective Cyberattacks Now Considered an Act of War

247 Industry Perspective Mobile Devices: The New Big Corporate Security Headache

XLM/E Network Basics

• Exploring Google Earth

• Protecting your computer against viruses

• Searching for shareware and freewa re

• Ethical computing guidelines

• Privacy laws and legislation

Extended Learning Module E provides an introduction to the vast, exciting, and dynamic of information technology networks. The module includes discussions of what is needed up a small network at home, the components used to build large business networks, lnte connection possibilities, types of communications media, and network security.

XLM/H Computer Crime and Digital Forensics Extended Learning Module H provides an overview of computer and computer-aided cri and its investigation. First, you'll read about the various types of computer crime, malwa hackers. Next, you'll explore digital forensics starting with the investigation process. You about the digital forensics software and hardware that experts use along with the anti-· measures that the bad guys employ.

otecting People and Information eats and Safeguards

RAGEOUS INDUSTRY SFORMATION: SFORMATIONS IN MEDICINE MEAN

ER LIVES

__ o utrageous industry transformations to this

_ ... have focused on how innovations in tech-

y are changing the landscape of entire

- - ...str ies, in many instances putting many tradi-

- al and old-style businesses out of business. But

:: ""ield of medicine tends to be a bit different.

~ed icine, technological innovations are more

_ - ly and uniformly embraced by the entire

:.1St ry. Importantly, these innovations often -~:: t o saving lives, reducing health care costs,

-:: helping people lead longer, healthier lives.

e such innovation is that of robotics surgery

_ - nrostate cancer. In the accompanying graph,

-~can see that from 2005 to 2008, the percent-

;:: of prostate cancer surgeries using the da

- i Prostatectomy, a type of robotics surgery, ~eased from 20 percent to 71 percent. During

: sam e period, the percentage of open surger-

- ""or prostate cancer decreased from almost 80

-::' ent to less than 30 percent. The advantages - -ob otics surgery include:

• Less pain and faster recovery • Reduced need for blood transfusion

Lower infection risk

• Better cancer control

Reduction in urinary incontinence and erec-

ti le dysfunction

- ese types of technological innovations meet

: cr iteria of triple-bottom-line processes. The

""it motive is still met; they are kind to the

-- _" ro nment (fewer gauzes, fewer plastic blood

:;s, etc.); and they are better for people. 1

2005 USA Radical Prostatectomy Rations

2006 USA Radi cal Prostatectomy Rations

20 07 USA Radical Prostatectom y Rations

2008 USA Radical Prostatectomy Rations

Questions

-· da Vinci Prostatectomy

~ Laparoscopic

B Open Surgery

g da Vinci Prostatectomy ~ Laparoscopic

m Open Surgery

~ da Vinci Prostatectomy ~ Laparoscopic ,

m Open Surgery

• da Vinci Prostatectomy

Laparoscopic

m Open Surgery

1. Search robotics in surgery on YouTube. For

what kinds of robotics surgeries did you find

demonstrations?

2. Will taking robotics-type surgical procedures

into third-world countries be easier and

cheaper than traditional "open" surgical pro-

cedures? Why or why not?

3. Why does the medicine industry more quickly

and uniformly embrace innovations than

other industries?

225

226 Chapter 8 • Protecting People and Information

C} -- ntroduction

As you know, the three components of an IT system are people, information, and in.i mation technology. Most of what you've seen in previous chapters has dealt wi th :-

.-

I LEARNING OUTCOME 1

and how it stores and processes information. In this chapter we 're going to concen on information- its use, ownership, and protection. The best environment for handl:::._ information is one that has stability without stagnation and change without chaos.

To handle information in a responsible way you must understand

• The importance of ethics in the ownership and use of information.

• The importance to people of personal privacy and the ways in which it can b e compromised.

• Threats to information and how to protect against them (security). '

The most important part of any IT system consists of the people who use it are affected by it. How people treat each other has always been important, but in information-based and digital age, with huge computing power at our fingertips, we affect more people's lives in more ways than ever before. How we act toward each oth and this includes how we view and handle information, is largely determined by our ethi

You don't have to look far to see examples of computer use that is questionable fo an ethical viewpoint. For example,

'

• People copy, use, and distribute software they have no right to.

• Employees search organizational databases for information on celebrities and friends.

• Organizations collect, buy, and use information and don't check the validity or accuracy of that information.

• Misguided people create and spread viruses that cause trouble for those using and maintaining IT systems.

• Information system developers put systems on the market before they're completely tested. A few years ago, the developers of an incubator thermostat control program didn' t test it fully, and two infants died as a result. 2

• Unethical people break into computer systems and steal passwords, information. and proprietary information.

• Employees destroy or steal proprietary schematics, sketches, customer lists, and reports from their employers .

• People snoop on each other and read each other's e-mail and other private file s.

-. Ethics

Ethical people have integrity. They are people who are as careful to attend to ther: responsibilities toward others as they are to look after their own legitimate interes1- They desire to do what is fair and good and not what merely seems fair and good. Ac _ minimum, being an ethical person means that one takes seriously the rights of others , the consequences that one's actions will have for others, and the habits of mind and heha,-i~· that make for virtuous living. But even the most ethical people must face the nearly ine\;.- tahle dilemmas involving choices between incompatible good outcomes and conflic~ loyalties. An ethical dilemma is not the choice of whether or not to he ethical; rather, ethical dilemma is when one's responsibilities seem to lead in opposite directions.

ETHICS IN THE WORKPLACE CAN LEAD LOST PRODUCTIVITY

: now almost commonplace for people to perform

-=rso nal tasks on their computers while at work. They

- p for and buy merchandise. They send personal

ails. They bid on auction items on eBay. The list

:es on and on.

measure, consider this. During the NCAA tournament

in 2010, almost 12 million hours of live games were

streamed on the Internet. (Most of those hours were

during typical business hours.)

Bu t there is a particular time of the year when the

st productivity is lost on account of nonwork activ-

- es on the Web. Think for a minute. Can you guess

en it is? It's not associated with a holiday or selling

=ason. It's March Madness, the spring of each year

It won't take you long to put two and two together

to come up with the fact that social media has a lot

to do with lost productivity in the workpla<!e. In 2011,

Coca-Cola spent 20 percent of its tournament advertis-

ing budget on social media . That compares to just 2 per-

cent spent on social media in the previous year by Coke.

en 68 college basketball teams from around the

: untry battle it out in a single-elimination format .

:Jri ng the 2008 NCAA tournament, for example, $1.7

_ lion was lost in productivity according to Challenger,

-:=_ray, & Christmas, a Chicago-based outplacement firm.

That $1 .7 billion most probably pales by comparison

- t he lost productivity during the most recent NCAA

:::>u rnament . No organization has attempted to esti-

-ate March Madness lost productivity again, but it

-as most assuredly increased since 2008. As a surrogate

Hershey's Reece's Peanut Butter Cups brand went

social media-wild as well. That brand sponsored the

halftime festivity of allowing one fan to attempt to

make a shot from half-court for a cool $1 million. The

more times you visited the brand's Facebook page,

the more times you could enter your name into the

drawing. And it wasn't just a couple of thousand or

so people hoping to win the chance at fan immortal-

ity. The brand has more than 6.6 million followers on

Facebook. 3• 4

In Plato's Republic, written in the fourth century B.C. , Socrates tells his interlocutors at they are discussing "how we ought to live." That is a good characterization of ethics.

Ethics can be defined as the principles and standards that guide our behavior toward other people. One might add that ethics is also about the reasons we give for thinking we ought to live one way rather than another, make one decision rather than another, or opt :or one policy over another. We generally think of ethical people as those who give equal weight to the interests of the individuals who will be affected by what they do. Acting ethically means behaving in a principled fashion and treating other people with dignity and respect. This is simple to say but not always so simple to do since some situations are complex or ambiguous.

As the quote from Plato makes clear, the important role of ethics in our lives has long been recognized. In 44 B.C ., Cicero said that ethics is indispensible to anyone who wants to have a good career. "Good," however, must mean more than "successful," for being ethical involves measuring oneself by standards that transcend one's career goals. One might be a successful embezzler, but one would have failed to live morally. That being said, Cicero, along with some of the greatest minds over the centuries, struggled with questions such as "What rules are ethically binding?" " What are ' rights' and who or what has them?" "What consequences can be considered good?" and "What is it that makes a person virtuous?"

Our sense of what is right and wrong or what is better or worse is rooted in our history, culture, and religion. Despite the variety of societies that exist, ethical norms are surpris- ingly stable. The values, for example, of truthfulness, care for the young, or respect for

227

228 Chapter 8 • Protecting People and Informat ion

Figure 8.1 Your Ethical Structure

.-

one's neighbor's life and property don't go out of style. But if it is true that ethics rem relatively stable, it is equally true that society changes and this creates new challenges r~­ us to expand our ethical horizons and to think in novel and creative ways about "how . ~ ought to live." Ethical dilemmas abound , not less so in this electronic age, when there_ a new dimension in ethical debates related to the amount of personal information that - can collect and store and the speed with which we can access and process that inforrn::.- tion. New information technology raises new ethical questions. It raises questions abo how values that we cherish are to be preserved and applied in an information rich wor:

TWO FACTORS THAT DETERMINE HOW YOU DECIDE ETHICAL ISSUES

How you collect, store, access, and use information depends to a large extent on y ethics-what you perceive as right and wrong. Two factors affect how you make yo decision wh en you're faced with an ethical dilemma. The fast is your basic ethic:: structure, which you developed as you grew up. The second is the set of practical c::- cumstances inevitably involved in the decision th at you're trying to make, that is, all c:h.:· shades of gray in what are rarely black or white decisions.

Your ethical structure and the ethical challenges you'll fac e exist at several levels (:.-~ Figure 8. 1). 5 At the outside level are things that most people wouldn' t consider b such as taking a couple of paper clips or sending an occasional personal e-mail on co pany time. Do these things really matter? At the middle level are more significant e cal challenges. One example might be accessing personnel records for personal reaso Could there ever be a personal reason so compelling that you would not feel ethi discomfort doing this? Reading someone else's e-mail might be another middle-le·~ example. At the innermost ethical level are ethical violations that you'd surely co nsid very serious, such as embezzling funds or selling company records to a competitor. _ yet, over time , your ethical structure can change so that even such acts as these co seem more or less acceptable. For example, if everyone around you is accessing cor:.S- d ential reco rds for their own purposes, in time you might come to think such an act is big deal. And this might spell big trouble for you.

Re latedness

•

Consequences

Society's /Opinion

• Likelihoo d of Effect

Reach of Result

ne of the elementary lessons of ethics, too often forgotten, is that something is not e morally acceptable merely because most people do it.

It would be nice if every ethical decision were crystal clear, such as in the innermost rrle in Figure 8.1, but ethical decisions are not always so easy. Ideally, your sense of .:ac is ethical should tell you what to do. But practically speaking, any assessment of .::ar is right or wrong can rarely be divorced from a variety of considerations: 6

1. Consequences. How much or how little benefit or harm will come from a particular decision?

2. Society's opinion. What is your perception of what society really thinks of your intended action?

3 . Likelihood of effect. What is the probability of the harm or benefit that will occur if you take the action?

-!. Time to consequences. How long will it take for the benefit or harm to take effect?

5 . Relatedness. How much do you identify with the person or persons who will receive the benefit or suffer the harm?

6 . R each of result. How many people will be affected by your action?

:\"o matter how strong your sense of ethics is, these practical aspects of the situa- n may affect you as you make your decision-perhaps unduly, perhaps quite justifi- .. -. Thus, ethical dilemmas usually arise not out of simple situations but from a clash ~rween competing goals, responsibilities , and loyalties. Ethical decisions are complex

QTilents that balance rewards for yourself and others against responsibilities to your- "" r and others. Inevitably, your decision process is influenced by uncertainty about the

!!llitude of the outcome, by your estimate of the importance of the situation, some- es by your perception of conflicting "right reactions,'' and more than one socially ep table "correct" decision. You are the one who has to live with yourself afterward.

TELLECTUAL PROPERTY

- ethical issue you will almost certainly encounter is one related to the use or copying of prietary software. Software is a type of intellectual property. Intellectual property is intan- le creative work that is embodied in physical form. 7 Music, novels, paintings, and sculp-

::res are all examples of intellectual property. So also are your company's product sketches schematics and ot\ier proprietary documents. These documents along with music, nov-

- -. and so on are worth much more than the physical form in which they are delivered. For ~ple, a single Lady Gaga song is worth far more than the CD on which it's purchased.

e song is also an example of intellectual property that is covered by copyright law. Copyright law protects the authorship of literary and dramatic works , musical and

eatrical compositions , and works of art. Copyright is the legal protection afforded an ression of an idea, such as a song, video game, and some types of proprietary docu-

ents. Having a copyright means that no one can use your song or video game with- your permission. As a form of intellectual property, software is usually protected by

_ pyright law, although sometimes it falls under patent law, which protects an idea, such the design of a sewing machine or an industrial pump valve. Copyright law doesn't forbid the use of intellectual property completely. It has some cable exceptions. For example, a TV program could show a video game you created with- - your permission. This would be an example of the use of copyrighted material for the

::eation of new material, i.e., the TV program. And that's legal; it falls under the Fair Use ~'OCtrine. The Fair Use Doctrine says that you may use copyrighted material in certain

tions , for example, in the creation of new work or, within certain limits, for teaching ::::rposes. One of those limits is on the amount of the copyrighted material you may use.

Ethics 229

I LEARNING OUTCOME 2

230 Chapter 8 • Protecting People and Information

....

Generally, the determining factor in legal decisions on copyright disputes is whe•h~ the copyright holder has been or is likely to be denied income because of the infrin~ ment. Courts will consider factors such as how much of the work was used and how, ai:. when and on what basis the decision was made to use it.

Remember that copyright infringement is illegal. That means it's against th e la outside of a fair use situation, to simply copy a copyrighted picture, text, or an· - thing else without permission, whether the copyrighted material is on the lnteme or not.

Even without knowing of or thinking about it, you may have committed copyrigh. infringement during your education. Have you ever created a slide presentation aOC. inserted an image you found on the Web? Did you provide a citation for the image Unfortunately, most students don' t. And, truth be told, it's only a minor ethical violatio (although still illegal) according to Figure 8.1. That is, it didn't really hurt anyone am you most likely didn't deny the owner an opportunity to make money. But if it's not yo original work, you have to provide a citation. At a minimum, you may have violated yo school's code of ethical conduct. In preparing material (terll! papers and the like) fo- your classes, keep one simple rule in mind: If it isn' t your original work, then provide _ citation.

It's also illegal to copy copyrighted software. But there's one exception to th rule: In the United States, you may always make one copy of copyrighted software to keep for backup purposes. When you buy copyrighted software, what you're pa~-­ ing for is the right to use it- and that's all. How many more copies you may mah depends on the copyright agreement that comes with the software package. Some software companies state emphatically that you may not even put the software on a second computer, even if they're both yours and no one else uses either one. Othe- companies are less res trictive , and agree to let you put a copy of software on multip~e machines-as long as only one person is using that software package at any giYe time. In this instance , the company considers software to be like a book in that yo can have it in different places and you can loan it out, but only one person at a ti me may use it. Music companies often allow three copies of a CD or individual musi track to be played on different platforms , like your computer, your stereo system.. and your MP3 player.

If you copy copyrighted software and give it to another person or persons, you're pirating the software. Pirated software is the unauthorized use, duplication, distribu- tion, or sale of copyrighted software. 8 Software piracy costs businesses billions of dollae a year in lost revenue. Microsoft gets more than 25,000 reports of software piracy ever:'- year, and the company reportedly follows up on all of them. Countries with the highes~ software piracy rates are Georgia (93%), Zimbabwe (91 %) , Bangladesh (90%), Moldma. (90%), Yemen (90%) , Armenia (89%) , Venezuela (88%), Belarus (88%), Libya (8 8%, . and Azerbaijan (88%). 9 Countries with the lowest software piracy rates include the United States, Japan, Luxembourg, New Zealand, Australia, Austria, Sweden, Belgium. and Finland (all 25 percent or less). According to a BSA-IDC Piracy Impact Study ic 2010 , reducing the overall global piracy rate by 10 percentage points over four yeae would create:

• $142 billion in new economic global activity

• 500,000 new high-tech jobs

• $32 billion in new tax revenues for governments

Interestingly enough, the study concluded that more than 80 percent of the abow benefits would be realized by local governments and economies where the software piracy is taking place.

Privacy · 'acy is the right to be left alone when you want to be, to have control over your own per-

possessions, and not to be observed without your consent. It's the right to be free of -anted intrusion into your private life. Privacy has several dimensions. Psychologically,

:: a need for personal space. All of us , to a greater or lesser extent, need to feel in control our most personal possessions, and personal information belongs on that list. Legally, _ a cy is necessary for self-protection. 10 If you put the key to your house in a special · g place in your yard, you want to keep that information private. This information

uld be abused and cause you grief. In this section, we'll examine some specific areas of _ a cy: individuals snooping on each other; employers' collection of information about ployees; businesses' collection of information about consumers; government collec-

- n of personal information; and the issue of privacy in international trade.

I VACY AND OTHER INDIVIDUALS

dier individuals, like family members, associates, fellow employees, or unknown hackers, uld be electronically invading your privacy. Their motives might be simple curiosity, an

...::empt to get your password, or a wish to access something they have no right to. Obviously, re are situations in which they'd be well within their rights, and would be well advised, to

:e what's going on. You would be too. Examples might be if you suspect that your child is electronic contact with someone or something undesirable, or if you think that someone

ing your computer without permission. Many Web sites offer programs, collectively _:erred to as snoopware, to help people monitor what's happening on a computer.

For general snooping you can get key logger software and install it on the computer u want to monitor. Key logger, or key trapper, software, is a program that, when -talled on a computer, records every keystroke and mouse click. It records all e-mail, - rant messages, chat room exchanges, Web sites you visit, applications you run, and -swords you type in on that computer. Also available for monitoring computer use are screen capture programs that peri- ' cally record what's on the screen. (They get the information straight from the video d .) These programs don't trap every single screen, just whatever is on the screen en the capturing program activates. But they still give whoever is doing the monitor- a pretty good idea of what the computer user is up to. Other tools for monitoring

Jude packet sniffers (that examine the information passing by) on switches, hubs, or uters (the devices on networks that connect computers to each other), and log analysis

:x>ls that keep track oflogons, deletions , and so forth. As you're probably already aware, e-mail is completely insecure. E-mail content might as

-:ell be written on a postcard for all the privacy it has.Not only that, but each e-mail you send :esults in at least three or four copies being stored on different computers (see Figure 8.2 on

e next page). It's stored first in the computer you're using. Second, it's stored by the e-mail _ -rver, the computer through which it gets onto the Internet. Third, it's stored on the recipi-

t's computer, and may also be archived on the recipient's e-mail server. While you probably realize that your e-mail is not totally private, do you realize that

tlier electronic output leaves its mark too? For example, if you use a color laser printer, ur printouts have patterns of yellow dots on the back that are not visible unless you Ye a blue light and a microscope. These dots identify the model and serial number of ur printer and the time the printout was made. Printer manufacturers introduced this ture at the request of the Secret Service, which is the agency responsible for investi-

- ring counterfeit currency.

Privacy 231

I LEARNING OUTCOME 3

232 Chapter 8 • Protecting People and Information

Figure 8.2 The E-Mail You Send Is Stored on Many Computers

.-

~- AF?~]!]

Sender's Computer

Sender's Server

___. ~ - fBJ I ~~ '~ ~ ~ ,4WE47-;~-

Recipient's Server

Recipient's Computer

Another example is those photos you take with your digital camera. With the rig~ software you can load the photo and see a whole block of information like the date tht photo was taken , the camera type and serial number, whether the owner of the camen signed up for a warranty, and various other details. Your CD burner leaves a distin~ . signature on the CDs you burn. That is, any CD that your computer burns can he trac - hack to your CD drive. Of course, it stands to reason that your cell phone, when it's or::.. can tell people where you are by virtue of the fact that it registers ~tself with the towers i- uses to send and receive calls.

ED Rs or Event Data Recorders are now becoming a standard feature on new vehicles The EDR is part of the airbag control module and was originally included to improw the performance of airbags. When the airbag is deployed, data for the five seconds p rior to impact is transferred to a computer chip . About seven pages of information can be downloaded from the chip. This information includes the car' s speed at the time o: impact, the engine's RPMs, the percent throttle, whether the brakes were applied, and whether the driver's seat belt was buckled. The system is even designed to record a sec- ond impact which is frequently what happens in a collision. This is invaluable informa- tion to have about an accident and many reckless and inebriated drivers have been taken off the roads because of it.

IDENTITY THEFT

Identity theft is the forging of someone' s identity for the purpose of fraud. The fra ud is often for financial gain, and the stolen identity is used to apply for and use cre di: cards in the victim' s name or to apply for loans. But it can also be simply to disguise real identity, particularly if the thief is hiding from law enforcement or is running so me sort of scam. Below are some statistics related to identity theft. 11 ' 12

• 10%-Americans who have had their identities stolen

• $54 billion-estimated loss to businesses and consumers in the United States in 2009

• $4,841-average amount taken from an identity theft victim

• 15%-victims who don't learn about their identity being stolen for four or more years

• $631-average out-of-pocket expense for victims

• 43%-victims who knew the person who stole their identity (this is called friendly fraud)

• 330 hours-average number of hours it takes to repair damage done by identity thef.:

Worldwide it is estimated that the cost of identity theft to business and consum- ers in 2010 was a staggering $221 billion. If "identity theft costs " was a country, i- would he the 38th largest country in the world in terms of GDP, or gross domes tic product.

~ !11lre 8.3 provides three very revealing graphs regarding identity theft in the United from 2005 to 2010 . Notice the general upward trend in the number of data

hes, from 157 in 2005 to 662 in 2010. 2009 showed a decline, but the general d trend is very prominent. The revelation: The hackers are winning. Notice also

· chere were some 223 million records exposed due to data breaches in 2009. That have been an anomaly but, then again, perhaps not. In that year, there were two big breaches: The U.S. Military reported a breach that exposed 76 million records; and

and Payment Systems reported a breach that exposed 130 million records. - cial networking sites can be 10 times more effective in hooking phishing victims

other sites since people are more likely to click on a link sent by a trusted friend. ~book is a frequent target. A ploy that has been effective for phishers is to send you

ort message that directs you to a Web site that looks very like the social networking ~. When you then type in your ID and password the phishers get it. To avoid this sort of problem, type in the Web address of your social networking site or kmark it and never follow the suggested link. This is good advice to take if you're at all

illfe about where you're being sent. For example, look at this link: www.micosoft.com. that look 0 K to you? Look more closely and you'll see that the company name is mis-

- ed. This is the sort of trick that phishers use. Following are three examples of what happened when people became the victims of

enti ty theft.

• An 82 -year-old woman in Fort Worth, Texas, discovered that her identity had been stolen when the woman using her name was involved in a four-car collision. For 18 months, she kept getting notices oflawsuits and overdue medical bills that were really meant for someone else. It took seven years for her to get her financial good name restored after the identity thief charged over $100 ,000 on her 12 fraudulently acquired credit cards.

• A 42-year-old retired Army captain in Rocky Hill, Connecticut, found that an identity thief had spent $260 ,000 buying goods and services that included two trucks, a Harley-Davidson motorcycle, and a time-share vacation home in South Carolina. The victim discovered his problem only when his retirement pay was garnished to pay the outstanding bills.

• In New York, members ofa pickpocket ring forged the driver's licenses of their victims within hours of snatching the women's purses. If you steal someone's cash only, your haul usually, won't be more than $200, probably much less. On the other hand, if you steal the person's identity, you can net on average between $4,000 and $10,000 .

Millions of Records Exposed due to Data Breaches

Average Number of Records Exposed per Data Breach

400000

300000 200000 100000

""" J

Q I I I I 2005 2006 2007 2008 2009 2010

2008 2009 2010

Privacy 233

Figure 8.3 2005-2010 U.S. Identity Theft Information 13

PERSONALLY IDENTIFIABLE INFORMATION NOT NEEDED

Cybercriminals need very little information to pull off

a very sophisticated spear-phishing e-mail campaign. In

fact, they don't even need social security numbers, date

of births, or any payment card information. All they

need is to be able to correlate consumer names and

e-ma il addresses to where those people bank, shop,

and purchase services. Then, they can build fraudulent

e-mails from the legitimate merchant or bank and send

them to legitimate customers of those businesses.

with only names and e-mail addresses of customer's

customers being stolen. But that's all the data a good

spear-phishing e-mail campaign needs. It was esti-

mated that information was stolen on 60 million indi-

vidual consumers.

According to CyberFactors, a cyber-risk analytics and intelligence firm, the worst-case scenario would

put total losses at $4 billion by Epsilon, its customers

like Citigroup, and customers of all Epsilon's custom-

ers. That includes millions of dollars in lost business for

Epsilon, $225 million in Epsilon liab,ilities, and the $5

million each of its customers will spend just to notify all their customers that a breach occurred.

And that has a lot of people scared, especially con-

sidering the data breach that occurred at Epsilon.

Epsilon is a Dallas-based e-mail marketing service pro-

vider for 2,500 very large clients including Citigroup,

JP Morgan Chase, U.S. Bank, Barclays, Best Buy,

Hilton Worldwide, Marriott International, Disney

Destinations, and The College Board (which admin-

isters the SATs), just to name a few. In early 2011,

Epsilon reported that a data breach had occurred,

Older data breaches focused exclusively on gaining

access to personally identifiable information (Pll) like

your social security numbers and to payment card data.

Now, all that's needed is a name and an e-mail address

and a correlation to a place of business. 14• 15• 16

<"'

234

A common way to steal identities online is called phishing. Phishing (also called carding or brand spoofing) is a technique to gain personal information for the purpose of identity theft, usually by means of fraudulent e-mail. One way this is done is to send out e-mail messages that look as though they came from legitimate businesses like AOL, MSN, eBay, PayPal, insurance companies, or online retailers like Amazon.com. The messages look genuine with official-looking formats and logos. These e-mails typically ask for verification of important information like passwords and account numbers. The reason given is often that this personal information is needed for accounting or auditing purposes.

Legitimate businesses don't send out such e-mails. If you get such an e-mail, DON'T provide any information without checking further. For example, you could call the com- pany and ask about it. Another clue is bad grammar and misspellings. Even one typo in an official communication is a warning sign.

A second kind of phishing is to persuade people by e-mail to click on a Web site included in the message and provide personal information. Favorite targets of this type of scheme are eBay and Pay Pal. You get an e-mail that purports to come from eBay and tells you that your account has been compromised or one pretending to come from PayPal saying that your Pay Pal account is about to pay out on merchandise worth hundreds of dollars that you didn't order. The idea is to get you to "bite" and go to a site that will steal information like your eBay or PayPal password and then ask for other information, like credit card numbers.

There are now numerous variations of phishing. As we have described it thus far, phishing sends out thousands and perhaps even millions of e-mails, attempting to find anyone to reply. You may not even have a PayPal account and still receive a phishing e-mail claiming to be from PayPal regarding your (nonexistent) account. On the other

hand, spear phishing is phishing that is targeted to specific individuals. In this case, the creator of the fraudulent e-mail already has some of your personal information and wants more. Finally, there is whaling, the use of phishing targeted at senior business execu- tives, government leaders, and other types of high-profile individuals.

A more sophisticated variation on this is p harming, which is the rerouting of your request for a legitimate Web site. You may type in the correct address for your bank and be redirected to a fake site that collects information from you. You may even get to the legitimate site and then be linked to the fake site after you have put in identifying infor- mation. You don't notice this because the fake site address is very slightly different from the real one, perhaps just one letter off or different. Make sure to look for the padlock-in the browser, not the site-to let you know that you are at a secure site before entering data (see Chapter 5 on Web e-commerce security).

Pharming is accomplished by getting access to the giant databases that Internet pro- viders use to route Web traffic. Once they have access, they can make little changes so that you are diverted to the fake site either before or after you access the real one. It works so well because it's very hard to spot the fake site.

One of the most worrying types of identity theft is medical record theft. Someone who steals your medical records to get medical care will most likely add to or change your records so that when you need care your records are not accurate. This could lead to your getting medication that you're allergic to or not getting a procedure that you need. According to the World Privacy Forum (WPF) almost 20,000 people filed com- plaints about theft of their medical records between January 1992 and April 2006. Again, according to the WPF, about $100 billion dollars of health care costs are the result of health care fraud. More than 600 health identity theft cases were tried in 2005 and 516 of those people were convicted. _

Figure 8.4 on the next page shows some ways to protect yourself.

PRIVACY AND EMPLOYEES

Employers need to know about their employees to operate effectively. If you're applying for a job, you may fill out an application. However, that's not the only source of informa- tion to which your prospective employer has access. For a fee, and sometimes for free, an employer can find out your driving record, your eviction records, your credit stand- ing, your telephone usage, your insurance coverage, and so on. Another good source of information,is what you put on the Internet from photos to videos to text communica- tions. Once you have put something on the Internet, whether it's in instant messaging or Facebook, you lose control of that information. Data collection companies gather up such information, organize it, and sell it.

After you're hired , your employer can monitor where you go, what you do, what you say, and what you write in e-mails- at least during working hours. The American Management Association says as many as 60 percent of employers moni- tored employee e-mails, both incoming and outgoing. One reason that companies monitor employees' e-mail is that they can be sued for what their employees send to each other and to people outside the company.

About 70 percent of Web traffic occurs during work hours, and this is reason enough for companies to monitor what, and for how long, employees are surfing the Web. The FBI reports that 78 percent of surveyed companies indicated that employees had abused Internet privileges by downloading pornography, pirating software, or some other activ- ity that wasn't work related. Also, 60 percent of employees said that they visit Web sites or surf for personal use at work. Again, various software packages are available to keep track of people's Web surfing. Some software actually blocks access to certain sites.

Privacy 235

236 Chapter 8 • Protecting People and Informatio n

Figure 8.4 Protecting Yourself from Identity Theft 17

....

• Use stron g passwords with a combinat ion of uppe r and lower case letters, and a m ixture of letters, numbers, an d special symbols

• Use different passwords for every application (that may be many)

• Change all your passwo rd s every 60 days

• Shred personal documents you are throwing away

• Store personal documents you keep at the house in a secure, nonpublic place (a safe would be best)

• Check your cred it repo rt at least once a yea r at all th ree cred it report ing agencies (Experian, Transunion, and Equifa x)

• Do not carry your social security number around with you

• Do not leave outgoing mail in an unsecured area (such as clipped to the exterior of your ma ilbox)

• Do not have your social security number or driver's license number printed on you r checks

• Do not have your personal checks (i .e., the box of checks you order from the ban k) sent to your home address; have them sent to the bank and then pick them up

• Never give out personal information in a communi cation (email, phone call, etc.) unless yo u have initiated the com mun ication

• Never respond to suspect emai l

• Never unsubscribe to emails you don't recognize and don 't know are leg itimate

• You can't win a lottery you haven't entered

• Always check for the https or lock icon on Web sites you use to enter personal and/or financial information (see Chapte r 5)

• Consider putting a "freeze " on your cred it. M any states allow you to do this. If you do freeze your account, you must f irst unfreeze your credi t before performing such tasks as opening a new account. Unfreezing your account is a very difficult task for an identity thief to perform .

Businesses have go od reasons for seeking and storing p ersonal info rmation on employees. They

• Want to hire the best p eople possible and to avoid b eing su ed fo r failing to adequately investigate the background s of employees.

• Want to ensure th at staff members are conducting themselves appropriately and not was ting or misusing comp any resources . Financial ins titutions are even required by law to monitor all commu nications in clu ding e-mail and telep hone conversation s.

• Can be held liable for the actions of employees .

MONITORING TECHNOLOGY Numerous vendors sell so ftware pro ducts that scan e-mail, both incoming an d outgoing. The software can look for specific word s or p hrases

CYBERATTACKS NOW CONSIDERED AN ACT OF WAR

In mid-2011, both the United States and the United

Kingdom publicly acknowledged that nation-sponsored

cyberattacks can be considered an act of war. The very

next day, Google reported that a cyberattack originat-

ing in Jinan, China, had breached the Gmail accounts of

senior U.S. government officials, Chinese political activ-

ists, officials in several Asian countries (predominantly •

South Korea), military personnel, and journalists.

businesses, because of their characteristics, can be

assigned an origin of China. Influential people (e.g.,

ministers, state secretaries, department heads) as well

as positions that deal intensively with issues to do with

China were commonly attacked."

About the same time, Chinese Premier Wen Jiabao

and German Chancellor Angela Merkel were holding

their first joint cabinet meeting to finalize the details

on more than $15 billion in business deals between

the two countries. It was during that meeting that

the Cologne-based Bundesverfassungsschutz intel-

ligence agency reported a dramatic increase in the

number of China-originated cyberattacks on German

officials and businesses. According to the report, "Most

of the attacks aimed at federal officials and German

China, along with Russia, has long been known as

a country whose government sponsors cyberattacks

against other countries, specificall:r Western govern-

ments, and large corporations with home offices in

that country. According to Harry Sverdlove, Chief

Technology Officer at security firm Bit9, "It's a lot easier

to hack into a system than it is to tap a phone line or

break into an office and take pictures."

As an "act of war," cyberattacks can now be responded

to by the United States using military force. That is, if a

cyberattack is as bad as a traditional military attack (in

terms of death, destruction, and disruption), the United

States may respond with a use of force. 18• 19

in the subject lines or in the body of the text. An e-mail-scanning program can sneak into your computer in Trojan-horse software. That is, it can hide in an innocent-looking e-mail or some other file or software.

An employer can track your keyboard and mouse activity with the type of key log- ger software that you read about in the previous section. An alternative that's some- times harder to detect is a hardware key logger. A hardware key logger is a hardware device that captures keystrokes on their journey from the keyboard to the mother- board. These devices can be in the form of a connector on the system-unit end of the cable between the keyboard and the system unit. There' s another type of hardware key logger that you can install into the keyboard . Both have enough memory to store about a year's worth of typing. These devices can't capture anything that's not typed, but they do capture every keystroke, including backspace, delete, insert, and all the others. To defeat them you'd have to copy the password (or whatever you want kept secret) and paste it into its new location. The key logger keeps a record of the key- strokes you use, if any, in your copy-and-paste operation, but not what you copied and pasted.

There is little sympathy in the legal system for the estimated 27 million employees whom the American Management Association says are under surveillance. Employers have the legal right to monitor the use of their resources and that includes the time they're paying you for. In contrast to your home, you have no expectation of privacy when using the company's resources.

The most recent federal bill that addressed electronic monitoring of employees is the Electronic Communications Privacy Act of 1986. Although , in general, it forbids the interception of wired or electronic communications, it has exceptions for both prior con- sent and business use .

237

238 Chapter 8 • Protecting People and Information

r

Some state laws have addressed the issue of how far employers can go and what they can do to monitor employees. Connecticut has a law that took effect in 1999 that requires employers in the private sector to notify employees in writing of electronic monitoring. And Pennsylvania, a year earlier, permitted telephone marketers to listen in on calls for quality control purposes as long as at least one of the parties is aware of the action. 20

PRIVACY AND CONSUMERS

Businesses face a dilemma.

• Customers want businesses to know who they are, hut, at the same time , they want them to leave them alone.

• Customers want businesses to provide what they want, hut, at the same time, they don't want businesses knowing too much about their habits and preferences.

• Customers want businesses to tell them about products and services they might like to have, hut they don't want to he inundated with ads.

Like it or not, massive amounts of personal information are availahl~ to businesses from various sources. A relatively large Web site may get about 100 million hits per day, which means that the site gets about 200 bytes of information for each hit. That's about 20 gigabytes of information per day. 2 1 This level of information load has helped to make customer relationship management (CRM) systems one of the fastest growing areas of software development. Part of managing customer relationships is personalization. Web sites that greet you by name and Amazon.corn's famous recommendations that "People who bought this product also bought . . ." are examples of personalization, which is made possible by the Web site's knowledge about you. 22

Apart from being able to collect its own information about you, a company can read- ily access consumer information elsewhere. Credit card companies sell information, as do the Census Bureau and mailing list companies. Web traffic tracking companies such as DouhleClick follow you (and other surfers) around the Web and then sell the information about where you went and for how long. DouhleClick can collect informa- tion about you over time and provide its customers with a highly refined profile on you. DoubleClick is also an intermediary for companies that want to advertise to Web surf- ers. When hired by a company wanting to sell something, DouhleClick identifies people who might he receptive and sends the ad to them as a banner or pop-up ad. Proponents of this practice claim that it's good for the surfers because they get targeted advertising and less unwanted advertising.

COOKIES The basic tool of consumer Web monitoring is the cookie. A cookie is a small file that contains information about you and your Web activities, which a Web site you visit places on your computer. A cookie has many uses . For example, it' s used to keep ID and password information so that you don't have to go through the whole veri- fication process every time you log onto a Web site. It's also used to store the contents of electronic shopping carts, so that the next time you log on, the Web site will be able to see your wish list (which is stored on your computer in a cookie).

A cookie can also he used to track your Web activity. It can monitor and record what sites you visit, how long you stay there, what Web pages you visited , what site you came from and the next site you went to. This type of cookie is called a unique cookie. Some cookies are temporary and some stay on your computer indefinitely.

Third-party or common cookies are the ones that have many privacy advocates dis- turbed. These are different from the unique cookies that a Web site you visit puts onto your hard disk. A common cookie is one that started out as a unique cookie, but the

original site sold access to it to a third party, like DoubleClick, that can then change the cookie so that the third party can track the surfer's activity across many sites. The third party collects information about surfers without names or other identifiable personal information. They usually collect an IP address, which they then link to a random iden- tifying ID so that the surfer can be identified at other sites. Surveys have shown that the vast majority of people (91 percent) don't like the idea of unknown companies gather- ing information about them that they have provided to sites with whom they chose to interact. 23

You have two options if you want to block cookies. First, you can set your browser to accept or reject all cookies. Or you can get it to warn you when a site wants to put a cookie on your computer. Second, you can get cookie management software with addi- tional options that are not available on your browser. For example, CookieCop 3, from PC Magazine, will let you accept or reject cookies on a per-site basis. It also allows you to replace banner ads with the image of your choice and to block ads for sites you find offensive. With this or other cookie-stopper software, you can disable pop-up windows , and stipulate that certain cookies can stay on your hard drive for the duration of one ses- sion only.

SPAM Spam is unsolicited e-mail (electronic junk mail) from businesses that adver- tise goods and services. Often spam mass mailings advertise pornography, get-rich-quick schemes, and miracle cures. Experts at Commtouch.com, a computer security company, estimate that about 80 percent of all e-mails in 2007 were spam, with levels peaking at 96 percent, during the last quarter of the year. The spam level rose higher during cer- tain periods in 2008 and the first half of 2009. 24 ' 25 If you haven' t been inundated with spam, you're either very lucky or you don' t use the Internet much. Spam has become a severe irritant to consumers and a costly matter for businesses, who must sort through hundreds of e-mail messages every day deleting spam and hoping that they don' t delete e-mail messages that are actually legitimate customer orders.

You can get spam filters to block out spam, but spammers are clever about including nonprinting characters in their subject lines and addresses that fool the filters into let- ting them pass. For example, say a spammer wanted to send out a message about a new weight loss drug called Off. The spammer would alter the spelling of the word or add invisible HTML tags so that the subject line would be: o*F*F or O<i></i>F<u></u>F. The HTML tags <i> and <u> would normally italicize and underline text, respectively, and the </i> ~nd </u> would undo the italicizing and holding, but since there' s no text in between the tags do nothing except evade the filter.

Many states have passed laws to regulate spam and the Federal Government passed an anti-spam law in 2003 called the CAN-Spam Act (see Figure 8.6 on page 243), which was widely criticized by anti-spam activists as legitimizing spam, since it set down rules for spamming rather than banning it altogether.

Most experts doubt that the CAN-Spam Act hurts the spammers who are the source of most of the spam. They say that it just costs legitimate businesses time and money since they have to maintain do-not-spam lists and follow the legal guidelines when send- ing out e-mails to customers. Since the bulk of spam comes from spammers who spoof (disguise) the origin of the e-mail, they can usually operate for a long time in defiance of the law. Irate spam trackers , some of whom have become cyber vigilantes, have gone so far as to "out" spammers and publicize information about them on the Web in an effort to stop them.

One trick that spammers use to collect addresses for spamming is to send out e-mail purporting to add you to a general do-not-spam list if you reply. In fact, what it does is add your e-mail address to the list of"live" ones.

Privacy 239

240 Chapter 8 • Protecting People and Information

Figure 8.5 Adware in a Free Version of Eudora, an E-Mail Application from Qualcomm

.-

ADWARE AND SPYWARE If you've downloaded a game or other software from the Web for free , you may have noticed that it came with banner ads. These ads are collectively known as adware. Adware is software to generate ads that installs itself on your computer when you download some other (usually free) program from the Web (see Figure 8.5). Adware is a type of Trojan horse software, meaning that it's software you don't want hidden inside software you do want. There's usually a disclaimer, bur- ied somewhere in the multiple "I agree" screens, saying that the software includes this adware. At the bottom of several small-print screens you're asked to agree to the terms. Very few people read the whole agreement, and advertisers count on that. This sort of product is sometimes called click-wrap because it's like commercial software that has an agreement that you agree to by breaking the shrink-wrap.

Most people don't get upset about pure adware, since they feel it's worth having to view ads to get software for free . (Many apps for your smartphone come with adware.) However, there's a more insidious extra that's often bundled with free downloadable soft- ware called spyware. Spyware (also called sneakware or stealthware) is malicious soft- ware that collects information about you and your computer and repor.ts it to someone without your permission. It usually comes hidden in downloadable software and tracks your online movements and/or mines the information stored on your computer. The first release of RealNetworks' Reaijukebox sent information back to the company about what CDs the people who downloaded the software were playing on that computer. This information collection was going on when the customer wasn't even on the Web. 26

Spyware is fast becoming the hidden cost of free software. Software such as Kazaa Media Desktop and Audiogalaxy, the successors to Napster for sharing music and other files online, includes spyware. If you download free software and it has banner ads, it's quite possible that it has spyware, too. There's usually something in the "I agree" screens telling you about spyware, but it can be hard to find. Spyware can stay on your computer long after you've uninstalled the original software.

r5J F11': Edit Ma1bo>: Me">~ Tran;fur- Sj::ec:al T·--'"""~w"""'.cc__··_c""+--O ~~-----~-~-~-

Jl"i l ~~ l @ 1 ~~~~ I ~ {} 1 ~ 1 [QJ 1 ~~~~ 1~~ 1? I

· ($'NTPCU:; G>Temp

G>Pi<eo= -G>pc mAG @PSUMisc

•· G>PSUln ' G>PSUOut -G>sa.. ®' soorit)'fooJs <!;>Sta~ G> St:eveGbson

f.!I Picasa. +

I Your Digital

Photos

OfgT<U lll weo:'lilS

~ Sn¥e w.!l\O\ltem•

FREE $Hit~

dl!l r-.14ll<J1.>botlQ Wh• ll<l>Q•<o l~!ill 1" S•bi•ct

J

Inside PC Maga; 02:15 PM3/1512 IO The Right CD/DY thoring Tool; USB and Video? Yes; 5.1 Sound PC Magazine Ti1 10:11 AM3/1612 7 Today's Tip: Fix Ex el 2003's RAND Function PC Mag azine Pr 11 :33 AM 3/1612 10 First Looks: Sharp clius MM20, Gateway 710X Peak Pe rform ance . PC MagazineTi1 11:41 AM3f1 7f2 8 Today·s Tip : Keep Y urWireless Connection from Changing Inside PC Maga; 02:16-PM3/17f2 11 Misses Photo Editor; Ul\ra-Ultraportable; 1SPs Sue Spa mmers; -10 PC Magazi ne Pr 04:10 PM 3117'2 10 Filsl Look s: Escienl ireBall D\/OM-100. Canon iEO Color Bubble PC Magazine Int 05:3J PM 3/171.2 9 Portal technology; Co pute r help; Se cu rity watch PC Magazine Ti1 12:CE PM 311812 6 Today·s Tip : Beller Lis in Excel PC Mag azine Pr 01 : 12 PM 311812 10 Firsl Looks : A new des !op,3 wi rele ss security cameras . Produ

in~i:a:~z~:g~~ ~~~~: ~: :~ I; ~~:~~~rT:~ ~~~';!: T:i~ake! Tech Access to o Far?; A P J <9rtio PC Magazine Pr 01:01 PM3/19/l IO - PC Magazine TI1 05:25 AM 3122'2 7 Inside PC Maga; 00:3 1 AM3f22/211

PC Magazin e T n 00:52 AM 3!l2f2 11 PC Magazine Pr 11 :34 AM 3f2l!2 9 PC Magazin e TI J 10:17 AM 3mn. 7 PC Magaz ine Pr 12:02 PM 312312 9 PC Magazine Tr1 05:.(3 AM 3124/.2 7 PC Magazine Pr 03:55 PM 3/24'2 10 PC Magazine Ut 07:00 PM 3124'2 5 PC Magazine 12:45 AM 3f25f2 4 PC Magazine TI1 00:25 AM 312512 7 PC Magazine Pr 12:45 PM 312612 9 Inside PC Maga: 02: 13 PM 312612 11 Inside PC Mag a; 03:37 PM 3fl£l2 11 PC-MagazineTi1 05:1iPM3126n 7 PC Maga zin e Pr 00:24 PM 3/2fJ2 9 PC Magazin e Ti1 09:17 AM 312!312 7 Inside PC Maga: 10:24 AM 312!312. 12

483L4231Kl19K I ~

Today 's Tip: Making Cookies

Adware

You can detect various kinds of Trojan horse software with The Cleaner from www.moosoft.com. Also check out www.wilderssecurity.com for Trojan First Aid Kit (TFAK). The best-known spyware detection programs, also called stealthware blockers, are Ad-Aware (free from www.lavasoft.com) and PestPatrol. The software scans your whole computer, identifies spyware programs, and offers to delete them. If you want to check out free software for spyware before you download it, go online to www.spychecker.com, a site that will tell you if particular free software includes adware or spyware.

Even without spyware, a Web site can tell a lot about its Web visitors from its Web log. A Web log consists of one line of information for every visitor to a Web site and is usually stored on a 'Veb server. At the very least, a Web log can provide a Web site company with a record of your clickstream.

A clickstream records information about you during a Web surfing session such as what Web sites you visited, how long you were there, what ads you looked at , and what you bought. If, as a consumer, you want to protect information about your surfing hab- its, you can use various software packages to do so. Apart from cookie management software you can avail yourself of anonymous Web browsing (AWB) services, which, in effect, hide your identity from the Web sites you visit. An example is Anonymizer at www.anonymizer.com. This site, and others like it, sends your Web browsing through its server and removes all identifying information. Some of the ABW services that are available include disabling pop-up promotions, defeating tracking programs, and erasing browsing history files. If you don't want to go through an outside server, you can download software to do the job. SurfSecret is a shareware antitracking package available from www.surfsecret.com.

As a final note on the subject, remember that even if a company promises, and fully intends, to keep its customer information protected, it may not be possible. %en faced with a subpoena, the company will have to relinquish customer records. Furthermore, courts have ruled in bankruptcy cases that customer files are assets that may be sold to pay debts .

PRIVACY AND GOVERNMENT AGENCIES

Government agencies have about 2,000 databases containing personal information on individuals. 27 The various branches of government need information to administer enti- tlement programs, such as social security, welfare, student loans, law enforcement, and so on.

LAW ENFORCEMENT You've often heard about someone being apprehended for a grievous crime after a routine traffic stop for something like a broken taillight. The arrest most likely ensued because the arresting officer ran a check on the license plate and driver's license. The officer probably checked the National Crime Information Center (NCIC) database and found the outstanding warrant there. Timothy McVeigh and oth- ers responsible for the bombing of the Federal building in Oklahoma City were caught in this way.

The NCIC database contains information on the criminal records of more than 20 million people. It also stores information on outstanding warrants , missing chil- dren, gang members, juvenile delinquents, stolen guns and cars, and so on. The NCIC has links to other government and private databases, and guardians of the law all over the country can access NCIC information. Sometimes they do so in response to something suspicious, and other times it' s just routine. For example, Americans returning from outside the country are routinely checked through the NCIC when they come through customs.

Privacy 241

242 Chapter 8 • Protecting People and Information

r

Given its wealth of information and accessibility, it's not surprising that the NCIC system has been abused. Several police departments have found that a significant num- ber of employees illegally snooped for criminal records on people they knew or wanted to know.

The Federal Bureau of Investigation (FBI) has caused a stir because of its electronic surveillance methods. First there was Carnivore, a rather unfortunate name, which has since been changed to DCS-1000. DCS-1000 connects hardware to an ISP to trap all e-mail sent to or received by the target of the investigation. It takes a court order to use DCS-1000, and, of course, the target is typically unaware of the surveillance. Intercepting communications is not new: The FBI put the first tap on a phone in 1885,just four years after the invention of the telephone. 28 DCS-1000, with a court order, traps all communi- cations involving the individual named in the court order.

Because it can be hard to identify the data packets of one individual's e-mail amongst all the other Internet traffic , it' s entirely possible that other people's e-mail might be scooped up in the net. And this is what happened in March 2000 when FBI agents were legally intercepting messages of a suspect, but someone else was caught in the trap. The information on the innocent party was obtained under the Freedom of Information Act. The FBI said the incident was an honest mistake and a result of miscommunication between it and the ISP. 29 But this is the sort of mistake that scares people. Most people want law enforcement to be able to watch the bad guys- that's necessary for our collec- tive safety. But the prospect of information being collected on law-abiding citizens who are minding their own business worries a lot of people.

In 2001 , the FBI acknowledged an enhancement to DCS-1000 called Magic Lantern, which is key logger software. The FBI installs it by sending the target an innocent-looking Trojan-horse e-mail, which contains the key logger software. The hidden software then sends information back to the FBI periodically.30

Another federal agency, the National Security Agency (NSA), uses a system called Echelon that uses a global network of satellites and surveillance stations to trap phone, e-mail, and fax transmissions. The system then screens all this information looking for certain keywords and phrases and analyzes the messages that fit the search criteria.

At the local level, the actions of the Tampa Police Department at the 2001 Super Bowl caused an outcry from privacy advocates. Police, with the agreement of the NFL, fo cused video cameras on the faces of tens of thousands of spectators as they entered the stadium. The images were sent to computers which, using facial recognition software, compared the images to a database of pictures of suspected criminals and terrorists. The police spokes- person said that the action was legal since it's permissible to take pictures of people in public places. That' s true in so far as you have no expectation of privacy in a public place. Indeed surveillance of people has been going on for years without much protest in gam- bling casinos, Walmart stores, and other businesses in the private sector. But the American Civil Liberties Union (ACLU) protested the surveillance of Super Bowl spectators on the grounds that it was surveillance by a government agency without court-ordered authoriza- tion. The fact that the state was involved made it unacceptable to the ACLU.

OTHER FEDERAL AGENCIES The Internal Revenue Service (IRS) gets income infor- mation from taxpayers . But the agency has access to other databases , too. For example, the IRS keeps track of vehicle registration information so that it can check up on people buying expensive cars and boats to make sure they' re reporting an income level that cor- responds to their purchases. The IRS can go to outside government databases as well. Verizon says that it gets 22,000 requests for phone records from the IRS, FBI, and other government agencies per year. It seldom info rms the customer of the request. America Online (AOL) has a special fax number reserved j ust for subpoenas.

The Census Bureau collects information on all the U.S. inhabitants it can find every 10 years . All citizens are requested to fill out a census form , and some peo- ple get a very long and detailed form requiring them to disclose a lot of personal information. The information that the Census Bureau collects is available to other government agencies and even to commercial enterprises. The bureau doesn' t link the information to respondents' names but sells summarized information about geo- graphic regions. Some of these regions are relatively small, however, consisting of fewer than 100 city blocks.

It's fairly safe to assume that anytime you have contact with any branch of govern- ment, information about you will be subsequently stored somewhere. For example, if you get a government-backed student loan, you provide personal information such as your name , address , income, parents' income, and so on. Some of the information nug- gets attached to the loan would be the school you're attending, the bank dispersing the loan, your repayment schedule, and later, your repayment pattern.

LAWS ON PRIVACY

The United States doesn't have a comprehensive or consistent set of laws governing the use of information. However, some laws are in place. Recent legislation includes the

• Identity Theft and Assumption Det errence Act, 1998, strengthened the criminal laws governing identity theft, making it a federal crime to use or transfer identification belonging to another. It also established a central federal service for victims.

• USA Patri ot Act, 200 1 and 2003, allows law enforcement to get access to almost any information, including library records, video rentals, bookstore purchases, and business records when investigating any act of te rrorism or hostile intelligence activities. In 2003 Patriot II broadened the original law.

• Homeland Security Act, 2002, provided new authority to government agencies to mine data on individuals and groups including e-mails and Web site visits; put limits on the information available under the Freedom of Information Act; and gave new powers to government agencies to declare national heath emergenci~s.

• Sarban es-Oxley Act, 2002, sought to protect investors by improving the accuracy and reliability of corporate disclosures and requires companies to (1) implement extensive and detailed policies to prevent illegal activity within the company and (2) respond in a timely manner to investigate illegal activity. (You'll find more about the business implications of Sarbanes-Oxley in Extended Learning Module H: Computer Crime and Digital Forensics.)

• Fair an d Accurate Cred it Transactions Act, 2003, included provisions for the prevention of identity theft including consumers' right to get a credit report free each year, requ iring merchants to leave all but the last five digits of a credit card number off a rece ipt, and requiring lenders and credit agencies to take action even before a vict im knows a crime has occurred when they notice any circumstances that might indicate identity theft .

• CAN-Spam Act, 2003, sought to regulate interstate commerce by imposing limitations and penalties on businesses sending unsolicited e-mai l to consume rs. The law forbids deceptive subject lines, headers, return addresses, etc., as well as harvesting e-mail addresses from Web sites . It requires businesses that send spam to maintain a do-not-spam list and to include a postal mailing address in the message.

Privacy 243

Figure 8.6 Recent Information - Re lated La w s

244 Chapter 8 • Protecting People and Information

I LEARNING OUTCOME 4

.-

Health Insurance Portability and Accountability Act (HIPAA) and the Financial Service Modernization Act. HIPAA, enacted in 1996, requires that the health care industry for- mulate and implement the first regulations to keep patient information confidential. The act seeks to

• Limit the release and use of your health information without your consent.

• Give you the right to access your medical records and find out who else has accessed them.

• Overhaul the circumstances under which researchers and others can review medical records.

• Release health information on a need-to-know basis only.

• Allow the disclosure of protected health information for business reasons as long as the recipient undertakes, in writing, to protect the information.

The Financial Services Modernization Act requires that financial institutions protect personal customer information and that they have customer permiss\on before sharing such information with other businesses. However, the act contains a clause that allows the sharing of information for "legitimate business purposes." See Figure 8.6 for recent information-related laws.

Security So, what can put your important information resource in jeopardy? Well, countless things. Hard disks can crash, computer parts can fail , hackers and crackers can gain access and do mischief, thieves engaged in industrial espionage can steal your infor- mation , and disgruntled employees or associates can cause damage. The FBI esti- mates that computer sabotage costs businesses somewhere close to $10 billion every year. Companies are increasing their spending on Internet security software, a fact that Symantec Corp. can attest to. Symantec is the largest exclusive developer of computer security software and has a market value of $14 billion, making it one of the most valu- able software companies in the world.

SECURITY AND EMPLOYEES

Most of the press reports are about outside attacks on computer systems, but actually, companies are in far more danger of losing money from employee misconduct than they are from outsiders. It's estimated that 75 percent of computer crime is perpe- trated by insiders , although this is not a problem that's restricted to computer misuse . A 300-restaurant chain with 30 employees in each location loses , on average , $218 per employee.

But white-collar crime is where the big bucks are lost (see Figure 8.7). White-collar crime in general, from Fortune 100 firms to video stores to construction companies, accounts for about $400 billion in losses every year-$400 billion is $108 billion more than the whole federal defense budget-and information technology makes it much easier to accomplish and conceal the crime. Of all white collar fraud, the biggest losses are those incurred by management misconduct. Manager theft of various kinds is about four times that of other employees. Take embezzlement, for example. The average cost of a nonmanagerial employee's theft is $60,000, while that for managerial employees is $250,000. The most astonishing aspect of this is that most insider fraud (up to two- thirds) is never reported to the legal authorities , according to the Association of Certified Fraud Examiners (ACFE) .

FIGURE COMMENT

$2.9 trillion 2009 Potential total worldwide loss due to fraud

$160,000 Median loss caused by fraud

85% First-time fraudsters

42% Fraud committed by employees

41% Fraud committed by managers

17% Fraud committed by owners/executives

24 months Months to detect fraud by owners/executives

67% Fraud committed by males

Computer-aided fraud includes the old standby crimes like vendor fraud (sending payment to a nonexistent vendor or payment for goods not delivered), writing pay- roll checks to fictitious employees, claiming expense reimbursements for costs never incurred, and so on. In addition, there are newer crimes such as stealing security codes , credit card numbers , and proprietary files. Intellectual property is one of the favorite targets of theft by insiders. In fact, the companies that make surveillance software say that employers are buying and installing the software not so much to monitor employees as to track how intellectual property, like product design sketches, schematics, and so on, is moving around the network.

Fraud examiners have a rule of thumb that in any group of employees, about 10 per- cent are completely honest, 10 percent will steal, and, for the remaining 80 percent, it will depend on circumstances. Most theft is committed by people who are strapped for cash, have access to funds that are poorly protected, and perceive a low risk of getting caught.

SECURITY AND OUTSIDE THREATS

In 2010, companies spent, on average, $7.2 million each to recover corporate data that was lost or stolen. That's 6 percent more than in 2009. The losses are the result of many problems such as someone breaking into their systems, malicious insider activity, mal- ware like spyware and viruses, and the theft of USB devices , notebook computers, and flash memory cards. The average cost per record that was compromised was $214. 32

The threats from outside are many and varied. Competitors could try to get your customer lists or the prototype for your new project. Cy her vandals could he joyriding in cyberspace looking for something interesting to see, steal, or destroy. You could become the victim of a generalized attack from a virus or worm, or could suffer a targeted attack like a denial-of-service attack. If you have something worth stealing or manipulating on your system, there could he people after that, too. For example, the online gambling industry is plagued by attacks where hackers have illicitly gained access to the serv- ers that control the gambling, corrupting games to win millions of dollars. Exploiting well-known system weaknesses accounts for a large part of hacker damage, while only 5

1 fi h ki . . 33

percent resu ts rom rea ng mto systems m new ways .

Security 245

Figure 8.7 Figures on Fraud 31

_.

246 Chapter 8 • Protecting People and Information

Figure 8.8 Hacker Types

.-

The people who break into the computer systems of others are " hackers" (see Figure 8.8). Hackers are generally knowledgeable computer users who use their knowledge to invade other people's computers. They have varying motives. Some just do it for the fun of it. Others (called hacktivists) have a philosophical or political message they want to share, and still others (called crackers) are hired guns who illegally break in, usually to steal information, for a fee. The latter can be a very lucrative undertak- ing. Some highly skilled crackers charge up to $1 million per job. There are also "good guys ,'' called white-hat hackers, who test the vulnerability of systems so that protective measures may be taken.

TYPES OF CYBER CRIME Cyber crimes range from electronically breaking and entering to cyberstalking and murder. In October 1999, a 21-year-old woman was shot and killed outside the building where she worked. Her killer had been electronically stalking her for two years. He became obsessed with the young lady and had even posted a Web site dedicated to her on which he announced his intention to kill her. He got her Social Security number online, found out where she worked, tracked her down, and shot her, after which he shot himself.

Most cyber crimes are not as bad as murder, but they can be serious nonetheless. Computer viruses and denial-of-service attacks are the two most common types of cyber crime against which companies need to protect themselves.

A computer virus (or simply a virus) is software that is written with malicious intent to cause annoyance or damage. A virus can be benign or malicious. The benign ones just display a message on the screen or slow the computer down, but don't do any dam- age. The malicious kind targets a specific application or set of file types and corrupts or destroys them.

Today, worms are the most prevalent type of virus. Worms are viruses that spread themselves; they don't need your help ,just your carelessness.

A worm is a type of virus that spreads itself, not just from file to file, but from computer to computer via e-mail and other Internet traffic. It finds your e-mail address book and helps itself to the addresses and sends itself to your contacts, using your e-mail address as the return address. The Love Bug worm was one of the early worms that did a lot of

• White-hat hackers find vulnerabilities in systems and plug the holes. They work at the request of the owners of the computer systems.

• Black-hat hackers break into other people's computer systems and may just look around, or they may steal credit card numbers or destroy information, or otherwise do damage.

• Hacktivists have philosophical and political reasons for breaking into systems. They often deface a Web site as a protest.

•Script kiddies, or script bunnies, find hacking code on the Internet and click- and-point their way into systems, to cause damage or spread viruses.

• Crackers are hackers for hire and are the hackers who engage in corporate espionage .

• Cyberterrorists are those who seek to cause harm to people or to destroy critical systems or information. They t ry to use the Internet as a weapon of mass destruction .

MOBILE DEVICES: THE NEW BIG CORPORATE

SECURITY HEADACHE

"As mo bi le devices become a replacement for the

desktop computer, the problem of malware (malicious

software) will grow significantly on the mobile plat-

form," explains Anup Gosh, founder of Web browser

security firm lnvincea. "Unfortunately, the security

industry has not developed products suitable for

battery-constrained mobile devices, which makes it ripe

ground for malware writers."

have "lightweight" policies, and only 20 percent have

very strict guidelines in place.

In 2010, white-hat hackers and researchers found

163 security holes in various mobile operating systems.

That's up from 115 in 2009. These mobile OS security ~

holes present some real problems. In 2010, 40 percent of

Those are some pretty alarming statements, but

they're true. Employees are bringing more personal

mobile devices to work than ever before. The employ-

ees are not only performing work-related tasks on

their mobile devices, they're also mixing in personal

and social activities. Companies are having a difficult

time in developing policies to deal with the plethora

of personal devices in the workplace. According to one

survey, 21 percent of companies have no restrictions on

the use of personal mobile devices. Some 58 percent

surveyed organizations stated that mobile devices had

been lost or stolen, many of which held critical business

information. Theft is certainly a problem but so is down-

loading infected apps, which can allow a cybercriminal

to steal information. One attack on legitimate game

and entertainment apps corrupted 50 of the apps, all of

which totaled more than 250,000 downloads.

On a personal level the lesson learned here is that

you need to treat your mobile device like your laptop

(or equivalent) computer. Don't leave it lyi ng around;

don't download content from a provider you can't ver-

ify; and keep your protection software up-to-date. 34• 35

damage and got major press coverage. It's estimated that the Love Bug and its variants affected 300,000 Internet host computers and millions of individual PC users causing file damage, lost time, and high-cost emergency repairs costing about $8. 7 billion.36,37

Ford Motor Company, H.J. Heinz, Merrill Lynch, AT&T, Capitol Hill, and the British Parliament all fell victim to the Love Bug worm. Newer versions of worms include Klez, a very rapidly spreading worm, Nimda, and Sircam.

A denial-of-service attack (DoS) floods a server or network with so many requests for service that it slows down or crashes. The objective is to prevent legitimate custom- ers from accessing the target site. E*Trade, Yahoo!, and Amazon.com have all been vic- tims of this type of attack. For more information about viruses and hackers and DoSs see Extended Learning Module H.

As well as knowing what viruses can do, you need to know what they can't do. Computer viruses can' t

• Hurt your hardware, such as your monitor, or processor.

• Hurt any files they weren't designed to attack. A virus designed for Microsoft's Outlook, for example, generally doesn't infect Qualcomm' s Eudora, or any other e-mail application.

SECURITY PRECAUTIONS

In Chapter 7, Infrastructure, Cloud Computing Metrics , and Business Continuity Planning, you learned about business contigency plans and in Extended Learning Module E: Network Basics you read about intrusion detection. These are both very

248 Chapter 8 • Protecting People and Information

...

important components of any company's computer system security. There are also stan- dard precautions that a company, and any individual who wants protection from the computer-based attacks, should take.

The most basic protection is to have anti-virus software running on your computer. Anti-virus software detects and removes or quarantines computer viruses. New viruses are created every day and each new generation is more deadly (or potentially more deadly) than the previous one. You should update your anti-virus software regularly and make sure it's running all the time so that it kicks in when you download e-mail and other files.

Many of the anti-virus software packages on the market also protect you against other cyber evils, like spyware and adware. They will also block cookies, pop-up ads, and embedded objects and scripts such as you get if you download a Flash file , for instance.

Spam protection is good to have , although it may let some spam through and may mark as spam something that isn't. You can usually choose to have the spam deleted, quaran- tined (in its own folder), or marked so that it stands out when you look in your lnbox. Anti-phishing software is also available to protect you from identity theft. The MyVault feature of ZoneAlarm, for example, will block data such as Social Security Number, credit card numbers, and passwords from leaving your computer. Anti-phishing toolbars warn you when you arrive at a known phishing site. Symantec's anti-phishing software places a toolbar beneath the Address Bar which turns red if you land at a phishing site.

ZoneAlarm, which is a firewall program with additional features , will let you know if a program is trying to access the Internet for whatever reason, as spyware on your com- puter may be attempting to do ZoneAlarm from www.zonealarm.com is a very popular software firewall. ZoneAlarm also offers protection from ads and cookies . Afirewall is hardware and/or software that protects a computer or network from intruders. The firewall examines each message as it seeks entrance to the network, like a border guard checking passports. Unless the message has the " right" markings, the firewall will block it from entering. You can set your firewall so that it identifies certain programs that are always allowed to visit a Web site. Your e-mail program would be an example. Any com- petent network administrator will have at least one firewall on the network to keep out unwelcome guests.

There are also programs that will block certain sites, which is useful if you have underage children. Some people suggest using FireFox or Opera as your default browser since Microsoft's Internet Explorer has long been a favorite target of hackers.

ACCESS AUTHENTICATION While firewalls keep outsiders out, they don't necessar- ily keep insiders out. In other words, unauthorized employees may try to access com- puters or files. One of the ways that companies try to protect computer systems is with authentication systems that check who you are before they let you have access.

There are three basic ways of proving your access rights: ( 1) what you know, like a password; (2) what you have , like an ATM card; (3) what you look like (more specifically what your fingerprint or some other physical characteristic looks like).

Passwords are very popular and have been used since there were computers. You can password-protect the whole network, a single computer, a folder, or a file . But pass- words are not by any means a perfect way to protect a computer system. People forget their passwords, so someone may have to get them new passwords or find the old one. Banks spend $15 per call to help customers who forget their passwords. Then if a hacker breaks into the system and steals a password list, everyone has to get a new password. One bank had to change 5,000 passwords in the course of a single month at a cost of $12.50 each. 38

Summary: Student Learning Outcomes Revisited 249

Which brings us to biometrics, or what you look like. Biometrics is the use of physiological characteristics- such as your fingerprint, the blood vessels in the iris of your eye, the sound of your voice, or perhaps even your breath-to provide identifica- tion. Roughly a dozen different types of biometric devices are available at the moment, with fingerprint readers being the most popular. About 44 percent of the biometric systems sold are fingerprint systems. They work just like the law enforcement system where your fingerprint is stored in the database, and when you come along, your finger is scanned, and the scan is compared to the entry in the database. If they match, you're in. See Chapter 9 for more information on biometrics.

ENCRYPTION If you want to protect your messages and files and hide them from prying eyes, you can encrypt them. Encryption scrambles the contents of a file so that you can't read it without having the right decryption key. There are various ways of encrypting messages. You can switch the order of the characters, replace characters with other characters, or insert or remove characters. All of these methods alter the look of the message, but used alone, each one is fairly simple to figure out. So most encryption methods use a combination.

Companies that get sensitive information from customers, such as credit card numbers , need some way of allowing all their customers to use encryption to send the information. But they don't want everyone to be able to decrypt the message, so they might use public key encryption. Public key encryption (PKE) is an encryption system that uses two keys: a public key that everyone can have and a private key for only the recipient. So if you do online banking, the bank will give you the public key to encrypt the information you send them, but only the bank has the key to decrypt your information. It works rather like a wall safe, where anyone can lock it (just shut the door and twirl the knob), but only the person with the right combination can open it again.

SUMMARY: STUDENT LEARNING OUTCOMES REVISITED

I. Define ethics and describe the two factors that affect how you make a decision concerning an ethical issue. Ethics are the principles and standards that guide our behavior toward other people. How you decide ethical issues must depend especially on your basic ethical structure but also for better or worse on the practical circumstances. Your basic ethics you probably acquired growing up. The practical circumstances that you might allow to affect you include

• Consequences. How much or how little benefit or harm will come from a particular decision?

• Society's opinion. What do you perceive society thinks of your intended action?

• Likelihood of effect. What is the probability of the harm or benefit if you take the action?

• Time to consequences. How long will it take for the benefit or harm to take effect?

• Relatedness. How much do you identify with the person or persons who will receive the benefit or suffer the harm?

• Reach of result. How many people will be affected by your action?

250 Chapter 8 • Protecting People and Information

2. Define and describe intellectual property, copyright, Fair Use Doctrine, and pirated software. Intellectual property is intangible creative work that is embodied in physical form. Copyright is the legal protection afforded an expression of an idea, such as a song or a video game and some types of proprietary documents. The Fair Use Doctrine says that you may use copyrighted material in certain situations. Pirated software is the unauthorized use, duplication, distribution or sale of copyrighted software.

3. Define privacy and describe ways in which it can he threatened. Privacy is the right to be left alone when you want to be, to have control over your own personal possessions, and not to be observed without your consent. Your privacy can be compromised by other individuals snooping on you; by employers monitoring your actions; by businesses that collect information on your needs , preferences, and surfing practices; and by the various government agencies that collect information on citizens.

4. Describe the ways in which information on your computer or network is vulnerable and list measures you can take to protect it. '

• Employees can embezzle and perpetrate fraud of other types. Most of the financial losses due to computer fraud that is suffered by companies is caused by employees .

• Hackers and crackers try to break into computers and steal, destroy, or compromise information.

• Hackers can spread computer viruses or launch denial-of-service attacks (DoS) that can cost millions in prevention and cleanup.

Measures you can take include

• Anti-virus software to find and delete or quarantine viruses

• Anti-spyware and anti-adware software

• Spam protection software

• Anti-phishing toolbar

• Firewalls

• Encryption

• Biometrics

Sexting Now Almost Commonplace

Sexting is the sending of sexually explicit messages and/ or photos, primarily between mobile phones. Adult

sexting is sexting between two consenting adults. In short, you take a suggestive (and perhaps sexually

explicit) photo of yourself with your phone, attach a

message to it, and send it to someone else's phone. The

message itself is called a sext. Sexting first caught the public's attention in 2007 or so when numerous reports

and stories began to surface about teen sexting. In a few

instances, a teen took a sexually explicit photo of friends

while in the school's shower facility and then texted it to

numerous friends. Some teens have even been charged

with child pornography for participating in sexting.

Adult sexting really grabbed the public's attention

in mid-2011 when U.S. Congressman Anthony Weiner

of New York sent sexually explicit photos of himself via

Twitter to a 21-year-old woman in Washington . At first,

Weiner denied the allegations, stating that his Twitter

account had been hacked and someone was attempt-

ing to slur his good name. Later, it came out that

Weiner had sexted six women over a three-year period,

both before and during his marriage. Not long after,

Weiner admitted that the sexting was his own and he

resigned from Congress.

Earlier that year, U.S. Representative (also of New

York) Chris Lee had performed a similar type of sex-

ting . He had used Craigslist to solicit a relationship .

Eventually he used his Gmail account to send a shirtless

photo of himself to a woman. When the Gawker broke

the story, Lee resigned from his political position.

Below are some statistics related to teen and young

adult sexting.

• Teens who have sent sexually suggestive

messages:

o 39 percent overall

o 37 percent of teen girls

o 40 percent of teen boys 0 48 percent-teens reporting having received

sexts

• Teens who have posted/sent sexually explicit

photos/videos of themselves:

o 20 percent overall

o 22 percent of teen girls

o 18 percent of teen boys 0 11 percent of young teen girls ages 13-16

• 71 percent of teen girls and 67 percent of

teen boys who have sexted have done so to a

boyfriend/girlfriend.

• 21 percent of teen girls and 39 percent of teen

boys who have sexted have done so to someone

they wa~ted to date or to hook up with. Sexting statistics among adults have been much harder

to gather and have not yet been published. However,

psychologist Susan Lipkins performed an online survey of

people ages 13 to 72. She found that 66 percent had sent

sexually explicit messages. Her published study went on

to identify that individuals in a position of power or those

who thirsted for power were more likely to sext than

those who were not in a position of power or did not

crave power. According to Gary Lewandowski, both men

and women in power are more likely to cheat, flirt, and

participate in sexting. As Lewandowski explains, "I am this

great, powerful person. Who's going to question me?"

(He was of course paraphrasing what a powerful person

might say.) To many people, the statistics are absolutely alarming. Further, consider that many teens-for fear of

reprisal-probably did not answer the survey honestly.

Closing Case Study One 251

However, some people see the use of technology

to support sexting as just another communication

medium. If you have a phone conversation with your

partner and say something suggestive regarding sex,

have you committed sexting by telephone? What about

a face-to-face communication? If you bare part of your

body (something sexual obviously), have you commit-

ted a form of sexting without using technology?39· 4o, 41

Questions

1. Adult sexting is perfectly legal,~as it is the

sharing of sexually explicit content between two

consenting adults. But what about teen sexting-

should that be legal? If a 16-year-old boy sends

a sext to his 16-year-old partner, should that be

considered child pornography? Why or why not?

2. If you refer back to Figure 8.1 on page 228,

where would you place adult sexting-a minor

ethical violation, a serious ethical violation,

or a very serious ethical violation? What

circumstances-consequences, society's opinion,

likelihood of effect, time to consequences,

relatedness, and reach of result-might move

adult sexting from a minor ethical violation to

a serious ethical violation and then finally on to

a very serious ethical violation?

3. Consider the whole notion of power being

tied to sexting, flirting, and cheating. From

a psychological point of view why might this

be true? Do some research into Tiger Woods's

troubles with extra-marital affairs. Could his

cheating be tied to his position of power? Is

"power" and the temptations that go with it

an excuse for such behavior?

4. What role can and should employers play

in limiting {perhaps eliminating) sexting in

the workplace? What about employee-to-

employee sexting? What about employee-to-

customer sexting? Regarding the latter, what

sort of legal liability does an organization

have if an employee sends an unwanted and

unwelcome sext to another employee or to a

customer?

5. These are purely for you to answer to yourself.

Have you ever participated in sexting? Have

you received a sext? Has learning more about

ethics and the non privacy of technology-

enabled communications reshaped your

thinking about participating in questionable

activities like sexting?

I

252 Chapter 8 • Protecting People and Information

Sony Reels from Multiple Hacker Attacks

This may very well be a story with which you are

personally familiar. Between April 17, 2011, and April

19, 2011, the Sony PlayStation Network (PSN) was

hacked. Personally identifiable information (Pll) on

some 77 million users was compromised. On April 20,

Sony announced that it was taking down the PSN site,

preventing owners of PlayStation 3 and PlayStation

Portable consoles from participating in any online

activities on the PSN network. What followed is a story

you cannot make up.

The outage lasted for approximately 23 days, until

May 15, when Sony began bringing some gaming ser-

vices back on line on a country-by-country basis starting

with North America. During the 23-day outage, Sony

postured, hoping to downplay the significance of the

breach. At first, Sony understated the number of user

records compromised . Periodically, Sony stated that

it had the situation under control, that it had devel-

oped a clear and concise strategy for bringing services

back online, and that things would be up and running

within a few days.

In the end, Sony admitted that its PlayStation

Network had been the target of one of the larg-

est data breaches ever. It offered free game time

for returning customers and other perks . It even

announced that it was paying for $1 million in iden-

tity theft insurance for each of its compromised users.

The insurance was to last for 12 months and include

Internet surveillance and complete identity repair in

the event of identity theft and fraudulent use . Sony

estimated that the cost of the PSN outage would be $177 million . .~

Lawsuits quickly followed . On April 27, 2011,

Kristopher Johns filed a class-action lawsuit on behalf

of all PlayStation users. His lawsuit alleged many

things including : (1) Sony failed to encrypt data, (2)

Sony failed to provide prompt and adequate warn-

ings of a security breach to users, and (3) Sony cre-

ated unreasonable delays in bringing PSN services

back online. A similar lawsuit was filed in Canada by

Natasha Maksimovic. She sought $1 billion (Canadian

dollars) in damages which included free credit moni-

toring and identity theft insurance . The lawsuit con-

tained the following quote : "If you can't trust a huge

multinational corporation like Sony to protect your

private information, who can you trust? It appears to

me that Sony focuses more on protecting its games

than its PlayStation users."

But Sony's hacker troubles didn't end there . On

May 3, 2011, in the middle of attempting to bring its

PSN services back online, Sony Online Entertainment

was hacked. With this breach, another 24.6 million

user records were compromised. Sony stated that it

believed the two hacks were related. Then, on June

2, 2011, the SonyPictures .com Web site was hacked,

further compromising unencrypted password and per-

sonally identifiable information. 42 • 43 • 44• 4 s. 46, 47

Questions

1. Do some research on the Sony PSN debacle.

What are the new cost estimates for the

incident? How many customers have left Sony

because of the incident? Have there been any

reports of fraudulent use of identities obtained

from the hack? Has Sony's PlayStation Network

been hacked again?

2. Gaming and virtual services on the Internet,

like Sony's PSN, World of Warcraft, and Second

Life, boast millions of users. For each user,

the service must store credit card information

and personally identifiable information.

What must these organizations do to protect

the private information of their customers?

Is it even reasonable to assume that any

organization can have protection measures in

place to stop the world's best hackers?

3. If an extremely intelligent hacker is caught

by a law enforcement agency, should that

hacker be prosecuted and sent to jail? Is

there perhaps a way that the hacker might be

"turned" for the good of the digital world?

What would that be?

4. Every survey taken of businesses regarding

data breaches has found that many businesses

are reluctant to publicly announce a data

breach. Further, most businesses will

downplay the significance of the breach .

Why do organizations behave like this?

What is there to gain by not operating in a

transparent fashion? Is this an ethical issue, a

legal issue, or both?

KEY TERMS AND CONCEPTS

Adult sexting, 250 Adware, 240 Anonymous Web browsing

(AWB), 241

Ethics, 227 Fair Use Doctrine, 229 Firewall, 248 Friendly fraud, 232 Hacker, 246

Assignments and Exercises 253

5. What's your personal identity theft story? Has

someone used your credit card fraudulently?

How many phishing e-mails have you received

in the last year? How often do you check your

credit report?

Pirated softwar'"'e, 230 Privacy, 231 Public key encryption

Anti-virus software, 248 Biometrics, 249 Clickstream, 241 Computer virus (virus), 246 Cookie, 238

Hardware key logger, 237 Identity theft, 232 Intellectual property, 229

(PKE), 249 Sexting, 250 Spam, 239 Spear phishing, 235 Spyware (sneakware or

Copyright, 229 Denial-of-service attack

Key logger software (key trapper software), 231

stealthware), 240 Trojan horse software, 240 Web log, 241 Pharming, 235

(DoS), 247 Encryption, 249

Phishing (carding or brand spoofing), 234

Whaling, 235 Worm, 246

SHORT-ANSWER QUESTIONS

1. What are ethics, and how do ethics apply to

business?

2. What situation would qualify as an exception

to the copyright law?

3. What is privacy?

4. What is pirated software?

ASSIGNMENTS AND EXERCISES

1. HELPING A FRIEND Suppose you fully intend

to spend the evening working on an Excel

assignment that's due the next day. Then

a friend calls. Your friend is stranded miles

from home and desperately needs your help.

It will take most of the evening to pick up

your friend, bring him home, and return

to your studying. Not only that, but you're

very tired when you get home and just fall

into bed . The next day your friend, who

completed his assignment earlier, suggests

5. What is identity theft?

6. What does a key logger do?

7. What is spyware?

8. What is a denial-of-service attack?

9. What is public key encryption?

you just make a copy, put your own name on

the cover, and hand it in as your own work .

Should you do it? Isn't it only fair that since

you helped your friend, the friend should do

something about making sure you don't lose

points because of your generosity? What if

your friend promises not to hand in his or

her own work so that you can't be accused of

copying? Your friend wrote the assignment

and gave it to you, so there's no question of

copyright infringement.

254 Chapter 8 • Protecting People and Information

2. FIND OUT WHAT HAPPENED In December

2001, British Telecom (BT) filed a lawsuit

against Prodigy in New York federal court,

claiming it owns the hyperlinking process. If

BT wins this lawsuit then the company will

be able to collect licensing revenue from the

100 billion or so links on the Web . BT has

a patent that it says amounts to ownership

of the hyperlinking process. Prodigy (and

everyone else in the world) stores Web pages

with a displayed part, which the browser

shows, and a hidden part that the viewer

doesn't see, and which contains hidden

information including the addresses that

are used by the displayed portion. This, BT

said, is the essence of its U.S . patent No.

4873662. In reference to this case, answer the

following questions:

A. Has a ruling been handed down on this

matter yet? If so, what was the result?

B. If any kind of hyperlinking is, in fact, the

essence of the patent held by BT, what

about library card catalogs; are they

infringements, too? Why or why not? What

else could be?

- ---· DISCUSSION QUESTIONS

1. When selling antiques, you can usually

obtain a higher price for those that have a

provenance, which is information detailing the origin and history of the object. For example,

property owned by Jacqueline Kennedy Onassis

and Princess Diana sold for much more than

face value. What kinds of products have value

over and,.a bove a comparable product because

of such information? What kind of information

makes products valuable? Consider both

tangible (resale value) and intangible value

(sentimental appeal).

2. Personal checks that you use to buy

merchandise have a standard format. Checks

have very few different sizes, and almost no

variation in format. Consider what would

happen if everyone could create his or her own

size, shape, and layout of personal check. What

would the costs and benefits be to business

and the consumer in terms of buying checks,

exchanging them for merchandise, and bank

check processing?

3. INVESTIGATE MONITORING SYSTEMS The text

listed several monitoring systems, other systems

that defeat them, and an e-mail encryption

program. Find two more of the following:

A. Programs that monitor keyboard activity

B. Programs that find keyboard monitoring

programs

C. E-mail encryption programs

4. CHECK OUT THE COMPUTER ETHICS

INSTITUTE'S ADVICE The Computer Ethics

lnstitute's Web site at www.cspr.org/program/

ethics.htm offers the "Ten Commandments

of Computer Ethics" to guide you in ethical

computer use. The first two are

• Thou shalt not use a computer to harm other people. This one is the b'edrock for all the others.

• Thou shalt not interfere with other people's computer work. This one stems from the first and includes small sins like sending frivolous

e-mail and crimes like spreading viruses and

electronic stalking .

Look up the other eight and give at least two

examples of acts that would be in violation of

these guidelines.

3. Consider society as a business that takes steps

to protect itself from the harm of illegal acts .

Discuss the mechanisms and costs that are

involved. Examine ways in which our society

would be different if no one ever broke a law.

Are there ever benefits to our society when

people break the law, for example, when they

claim that the law itself is unethical or unjust?

4. Can you access all the IT systems at your

college or university? What about payroll

or grade information on yourself or others?

What kinds of controls has your college or

university implemented to prevent the misuse

of information?

5. You know that you generally can't use a PC to

access the information stored on a Macintosh-

formatted storage medium. What other

instances of difficulty in accessing information

have you experienced personally or heard of?

For examp le, have you used different versions

of MS Pow erPo int or MS Access that won't

work on all the PCs that you have access to?

-- II

6. Have you, or someone you kn ow, experienced

computer problems caused by a virus? What

did the vi rus do? Whe re do you think you

got it? How did you fi x the p roblem? What

was the cost to you in time, trouble, and

stress? 7. What laws do you think the United States

should pass to protect personal information?

Or none? Why? Should some personal

information be more protected than other

information? Why or why not?

8. The issue of pirated software is one that

the software industry fights on a daily basis.

The major centers of software piracy are in

places like Russia and China where salaries

CHAPTER PROJECTS

GROUP PROJECTS

• Assessing the Value of Outsourcing Information

Technology: Creating Forecasts (p. 294)

• Making the Case with Presentation Software :

Information Technology Ethics (p. 296)

• Assessing a Wireless Future: Emerging Trends

and Technology (p. 300)

• Evaluating the Next Generation: Dot-Com ASPs

(p. 301)

• Evaluating the Security of Information: Wireless

Network Vulnerability (p. 308)

Chapter Projects 255

and disposable income are comparatively

low. Given that people in developing and

economically depressed count ries will fall

behind the industrialized world technologically

if they can't afford access to new generations

of software, is it reasonable to blame someone

for using pirated software when it costs

two months' salary to buy a legal copy of

MS Office? If you answered no, specify at

what income level it's okay to make or buy

illegal copies of software. What approach

could software companies t:1se to combat the

problem apart from punitive measures, like

pressuring the government to impose sanctions

on transgressors?

E- COMMERCE PROJECTS

• Ethical Computing Guidelines (p. 314)

• Exploring Google Earth (p. 314)

• Privacy Laws and Legislation (p. 317)

• Protecting Your Computer (p. 317)

• Searching for Shareware and Freeware (p. 320)