Civil Liberties and Security in Cyberspace - Hoover Institution

Hoover Press : Cyber DP5 HPCYBE0500 06-11-:1 11:53:04 rev1 page 203
Civil Liberties and Security in Cyberspace
203
crimes, anomalies in computer operation, network vulnerabilities,
modes of penetration, alerts, and warnings, fall into this category.
Such data—no doubt relevant and probably crucial for effective response
to cyber crime—are likely to contain sensitive security and
personal information, including aliases, identities, and passwords. Information
about the citizens of one country may be provided to entities
in other countries, whose privacy laws may not afford the same level
of protection. An agreed-upon privacy policy—whether deference to
domestic practices or a reasonable minimum level of protection—
acceptable to parties in the international exchange, would help guard
privacy during such information exchanges.
Businesses, such as information infrastructure or service providers,
may also be called upon to reveal sensitive information concerning
attacks, vulnerabilities, and personnel as part of investigative or preventive
measures. Even though the support of commercial entities is
often required, they are reluctant to share sensitive security-related
information with the government. 42 Disclosure and attribution of such
information may have the consequences of disrupting business objectives,
causing economic losses, triggering unwelcome legal proceedings,
and threatening individual employees. Employees are in many
cases subject to loss of their jobs for unauthorized revelation of suspected
criminal activity; and businesses should be concerned about the
personal safety and privacy of employees when dealing with a suspected
crime or perpetrator, or they should be compelled to have such
concern by legislation or economic incentives. Preserving the identity
of institutions and their employees in tracking, tracing, and investigating
crime against them may be a crucial vehicle for building the
necessary public–private sector cooperation in this area.
Automation is particularly important to enhance both security and
42. See Donn B. Parker, “Sharing Infrastructures’ Cyber Crime Intelligence,” SRI
Consulting, unpublished paper, December 1999, pp. 16–17; and David J. Thelander,
presentation at the Stanford Conference, December 6–7, 1999; testimony of Bruce J.
Heinman, executive director, Americans for Computer Privacy, on “Internet Security
and Privacy,” before the United States Senate Judiciary Committee, May 25, 2000.