'Surveillance minimization' needed to restore trust

Surveillance minimization -- where surveillance is the exception, not the rule -- could help rebuild public trust following revelations about the collection of personal data, according to a law academic from the University of East Anglia.

Dr Paul Bernal, whose research covers privacy, surveillance and human rights, says the role of government surveillance and of surveillance by commercial groups and others must be reconsidered.

He suggests surveillance minimization as a way forward and will present the idea today at the Computers, Privacy and Data Protection international conference, taking place in Brussels, Belgium. It comes after the announcement last week by American President Barack Obama of curbs on the use of bulk data collected by US intelligence agencies, including the National Security Agency (NSA). His speech followed widespread anger after leaks revealed the full extent of US surveillance operations, including the mass collection of electronic data from communications of private individuals and spying on foreign leaders.

"Surveillance minimization is a simple concept and uses one of the overriding principles of data protection, the idea of data minimization, and applies it to communications surveillance," said Dr Bernal, who is currently writing a book on internet privacy and data protection. "The potential impact upon individuals from surveillance by commercial organizations can be significant, and as the NSA's PRISM program in particular demonstrated there are inextricable links between the commercial and the governmental.

"Surveillance minimization requires surveillance to be targeted rather than universal, controlled and warranted at the point of data gathering rather than of data access, and performed for the minimum necessary time on the minimum necessary people. Surveillance minimization could play a part in rebuilding the trust that is vital in this field -- and in the construction of a more 'privacy-friendly' internet -- one where surveillance is the exception, not the rule."

Dr Bernal argues the debate and discussion around the issues has been "miscast" and the common understanding -- that there is a balance to be found between the individual right to privacy and the collective right to security -- significantly misses the point.

"Communications surveillance, and internet surveillance in particular, has become a topic of much discussion in recent years," he said. "The information released, revealing at least some of the true extent and nature of communications surveillance being carried out by the NSA and others, has come as a surprise to many and contributed to an atmosphere of confusion and of distrust in a field where trust is of the utmost importance.

"Surveillance impacts upon more than just individual privacy, but upon a wide range of human rights, from freedom of expression and freedom of association and assembly to protection from discrimination. The impact is not just on individuals but on communities and other groups, and casting the debate as one of individual versus collective rights is misleading, inappropriately downplaying the significance of the impact of surveillance. The nature of this impact needs to be understood better if a more appropriate balance is to be found between people's rights and the duties of states to provide security for their citizens. Consequently, a new understanding of the balance between the relevant competing rights, needs and imperatives has to be established."

View the original article here

Global attack needed to catch credit thieves

Stopping massive data breaches like the one that hit Target will require a more sophisticated, collaborative approach by law enforcement agencies around the world, a Michigan State University cyber security expert argues.

In a new research report for the National Institute of Justice, Thomas Holt found many hackers and data thieves are operating in Russia or on websites where users communicate in Russian, making it easier to hide from U.S. and European authorities. All countries need to better work together to fight hacking and data theft campaigns, he said, and use undercover stings in which officers pose as administrators of the Internet forums where stolen data is advertised.

The Target breach, which comprised 40 million credit- and debit-card accounts during the 2013 holiday shopping season, may have originated in Russia, the Wall Street Journal recently reported.

"This is a truly global problem, one that we cannot solve domestically and that has to involve multiple nations and rigorous investigation through various channels," said Holt, associate professor of criminal justice.

Holt authored the 155-page report with Olga Smirnova from Eastern Carolina University. The National Institute of Justice funded their research, the largest to date on this crime, with a $280,000 grant.

Holt and Smirnova analyzed 13 Internet forums through which stolen credit data was advertised. Specifically, they found:

Ten of the forums were in Russian and three were in English, though the forums were hosted across the world.Visa and MasterCard were the most common cards for sale.The average advertised price for a stolen credit- or bank-card number was about $102.The average price for access to a hacked eBay or PayPal account was about $27.

Skilled hackers who steal thousands or even millions of cards generally attempt to quickly dump the data to buyers found through advertisements the hackers create in Internet forums. The buyers then assume the risk of making purchases or taking cash advances on the cards in return for a potentially large profit.

In the United States, Holt said it is imperative more money and resources -- such as Russian-speaking analysts and new technology -- be allocated to the FBI, Secret Service and other federal agencies to more effectively combat cybercrime.

Tougher state and federal cybercrime laws should also be passed to promote security and corporate responsibility. While 46 states currently require companies to disclose any loss of sensitive personal information in the event of a security breach, Holt suggested the laws generally don't go far enough to protect consumers.

"Greater transparency is needed on part of both corporations and banks to disclose the true number of customers affected and to what degree as quickly as possible in order to reduce the risk of customer loss and economic harm," he said.

Consumers also need to be more vigilant.

"There is a big need for public awareness campaigns to promote basic computer security principals and vigilance against identity theft," Holt said. "Consumers need to understand the potential harm from responding to unsolicited email and clicking on suspicious web links as well as the need to run anti-virus and security tools on their computers."

?

View the original article here

Strong software protection needed for mobile devices

The massive adoption of mobile computing platforms creates the urgent need for secure application execution on such platforms. Unfortunately, today's mobile platforms do not support strong security solutions equivalent to smartcards in set-top boxes or to dongles to reliably control licensing terms. Furthermore, many of these mobile devices are shared for professional and private applications, and are thus intrinsically hard to control and secure.

Michael Zunke, chief technology officer of SafeNet's Software Monetization Business Unit states that "Security is ever more essential as an enabler for the sustainable innovation of mobile applications and services. Security solutions based on custom hardware security components like dongles and smart cards are not a natural fit for these mobile environments. The industry therefore needs a comprehensive security framework in which software protection is the key ingredient."

According to Brecht Wyseur, NAGRA's security architect, the big challenge in the next years will be to increase the security level of software solutions to allow for both cost effective deployment and long-term renewability, either stand-alone or in combination with a hardware root of trust.

Hence, more research is needed to come up with a solution that is strong enough to be a viable solution for an increasing number of applications in which privacy and security are essential. The ASPIRE project will create the ASPIRE software security framework which will develop, combine and integrate five different types of software protection techniques into one easy to use framework. It will deliver comprehensive, effective security metrics and a decision support system to assist the software developer.

"The integrated tool chain will allow service providers to automatically protect the assets in their mobile applications with the best local and network-based protection techniques," notes Bjorn De Sutter, coordinator of the project, adding that "ASPIRE will make mobile software more trustworthy by leveraging the available network connection and by developing a layered security approach of strong protections. We will also make it measurable by developing practical, validated attack and protection models and practical metrics."

Story Source:

The above story is based on materials provided by Ghent University. Note: Materials may be edited for content and length.

View the original article here