Expertiza_Wiki - User contributions [en]

CSC 379:Week 4, Group 4

2007-07-28T17:38:35Z

Tmlangwo:

=Biometrics and Privacy of Genetic Data=
A concern with ID cards that contain biometric information is that once one is stolen, it would be more difficult for someone to reclaim their identity as the nature of the representation of biometric data that would be used would be something that would not change over a person’s lifetime (e.g. fingerprints or eye-scan)[http://en.wikipedia.org/wiki/Biometrics#Common_biometric_characteristics]. Thus for technologies that rely solely on the biometric data contained within the IDs to establish identity, once a card is stolen, ones “identity” may never be able to be reclaimed.

Ethical issues related to privacy of genetic data follow closely with this topic since it suffers from similar issues as biometrics, although genetic data is much more invasive to ones privacy as society becomes more able to interpret it. There have been discussions of a constitutional amendment to prohibit genetic discrimination. If ones genetic information is made available, or information derived from, it opens the person to an increased threat of discrimination (jobs, insurance, social), as well as other threats to privacy not yet realized, but that will likely be realized within ones lifetime as there becomes a greater capability to interpret genetic data.

'''What types of protections should be afforded to biometric data compared to other types of data? For genetic data? Should biometric/genetic data be incorporated into various technology from ID cards to diagnostic equipment? Examine ethical issues related storage and use.'''

==Resources==
===Relevant External Links:===
The National Science and Technology Council some good resources related to biometrics and privacy issues.
* [http://www.biometrics.gov/ReferenceRoom/Introduction.aspx Introduction to Biometrics]
* [http://www.biometrics.gov/nstc/publications.aspx Biometrics and Privacy]

Wikipedia's article on biometrics:
[http://en.wikipedia.org/wiki/Biometrics http://en.wikipedia.org/wiki/Biometrics]

EFF has an introduction to some concerns voiced about biometrics:
[http://www.eff.org/Privacy/Surveillance/biometrics/ http://www.eff.org/Privacy/Surveillance/biometrics/]

===Relevant Class Website Links:===
* [http://ethics.csc.ncsu.edu/privacy/web/identity/ http://ethics.csc.ncsu.edu/privacy/web/identity/]

==What are Biometrics?==
A biometric is a measure of some physical or behavioural characteristic of an individual. These measurements can then be used to identify and individual or at least aid in confirming a claimed identity. Some examples of human characteristics that can be conveniently captured in a biometric include: Fingerprints, Retinal scan, Voice, Signature, DNA, Gait. After your individual information is recorded it can be used in a biometric system.

===The Purpose of Biometrics===
Biometric systems have several purposes. They can verify that a person is who they claim to be by checking your information against the data the system has on you. A biometric system can identify you without you telling the system who you are by your physiological or behavioral characteristics. And biometric systems can also be used to screen individuals. The system may raise a flag or alert the police if it identifies you as being on its watch list.

===Flaws in Biometric Systems===
These systems are not flawless though. Depending on what characteristic is being measured, there is often a significant chance of error. Each biometric has its own false accept rate and false reject rate. A false accept rate is the chance that the biometric verifies that you are who you claim to be, when you actually aren't. The higher the percent chance for a false acceptance, the easier the system is to fool. A false reject rate is the chance that a system says you are lying about who you claim to be when you are telling the truth. The false accept rate and false reject rate of a particular biometric should be taken into account when designing an identification or verification system.

==Physiological Biometric Systems==
===Facial Identification===
Facial identification can either identify people based on the image of their face or a thermal scan of their face. At first glance this seems to be a sound method, after all it's how people identify each other without technology. Unfortunately, there are several issues with implementing it as a technology. For cosmetic scans, the image can look very different based on lighting or could be fooled with makeup. In addition, both facial and thermal scans will change as people age. While one of the easiest and least obtrusive means of identification, it is also one of the least accurate and most easily fooled.

===Fingerprint===
Fingerprint identification is one of the most widely used biometric means of identification in the world today. The ridges of the skin on the finger are taken and compared to known records taken in the past. It is well suited to its task for several reasons. A person's fingerprints do not change as they age nor are they easily copied. In addition they are completely unique. Due to its widespread use there are fewer personal issues with the scanning of fingerprints than some other biometric identifiers.

===Hand veins===
Similar to fingerprints, the lines of the hand may also be used for identification. It is harder to fool than a fingerprint scan, but also slightly less accurate. It is also more vulnerable to changes over time than fingerprints and sometimes harder to tell the difference between the scans of two individuals.

===Eye scans===
There are two kinds of eye scans, one that scans the retina(blood vessels) and the other that scans the iris(colored part). Both of these share the advantage of scanning an internal organ which is less vulnerable to damage over time. Both suffer from a difficulty in building a database to compare to due to how they have to scan in addition to a lack of public approval for getting their eyes scanned. People associate the technology with something they would see in a movie and pair it will a loss of privacy as is the case in such movies.

===DNA scans===
DNA is the most accurate way of identifying a person. Nobody, with the exception of identical twins, will have the same DNA. Unfortunately, a sample from someone else will allow a fraudulent person to trick the system. In addition, collecting information for a database to compare scans to would be a major issue, as most people do not want to go in to a government office to have their DNA sampled. This brings up the next issue, because it is so accurate there is would be a massive loss of anonymity which would receive large public backlash.

==Ethical Issues Surrounding Biometrics==
===The Permanence of Biometric Identification===
Many forms of biometric data do not expire. While a person's face or voice may change some as they age, for the most part your physical and behavioral characteristics are going to stay the same throughout your life.

With current forms of identification your can, for example, change your password or get a new credit card or driver's licence or passport. For the most part with biometric identification, you can't simply change your information (short of surgery). This posses a large privacy issue. Not only will anonymity be almost impossible in a world were biometric identification is the norm, but identity theft will be every more devastating because one can't simply adopt new identifying data to defeat the thief.

===Biometrics as a Means of Discrimination===
If a particular biometric can not be measured on a person-- they are missing a finger, for example-- then inherently that person is going to seem more suspicious. Administrators of the system might think: "Sure maybe they have a legitimate reason for not doing the fingerprint ID, but maybe they are trying to bypass the system."

Biometrics systems could be used in small scale discriminatory screening processes such as stores using a biometric ID system to deny business to those found guilty of shoplifting in the past.

===Steps to Take to Mitigate Invasion of Privacy===
Paraphrased from the [http://www.bioprivacy.org/ IBG BioPrivacy Initiative]

* Biometric systems should only be expanded when absolutely necessary.
* Systems should not be expanded without public knowledge.
* Biometric information should not be used as a universal unique identifier. <br>"Universal unique identifiers facilitate the gathering and collection of personal information from various databases, and can represent a significant threat to privacy if misused."
* These systems should not store more information about an individual than is absolutely necessary to verify or identify the individual.

==Links and Resources==
* [http://www.anu.edu.au/people/Roger.Clarke/DV/Biometrics.html Biometrics and Privacy] by Roger Clarke
* [http://www.eff.org/Privacy/Surveillance/biometrics/ Who's watching you?] by William Abernathy and Lee Tien
* [http://www.bioprivacy.org/ IBG BioPrivacy Initiative]
* [http://www.biometricwatch.com/privacy.htm Biometric News Portal]
* [http://www.pcworld.com/article/id,81444-page,1/article.html Biometrics: Security Boon or Busting Privacy?] by Saumya Roy
* [http://en.wikipedia.org/wiki/Biometrics Good ol' Wikipedia]

CSC 379:Week 2, Group 5

2007-07-15T01:30:34Z

Tmlangwo:

=GNU General Public License=

==Overview==

The General Public License (GPL) was created in 1989 by Richard Stallman as originally a way of allowing many projects to share source code under a unifying license. In simple terms, a project licensed with the GPL can be freely distributed and charged for, but any and all distribution must provide the source code to the consumer as well. Also, according to the GPL, any work which uses code licensed by the GPL must license itself with the GPL. It ensures that any software that was derived from open source remains available to the general public and freely distributable.

* GPLV1

* GPLV2

* GPLV3

==Discussion Questions==

'''What is the impact of GPL use?'''

* Personal Software Users

* Developers - Open Source, Commercial

* Software Companies

* Industry and Business

* Non-profit organizations

* Government

* Education and Research

* Foreign Countries

'''What are the ethical considerations for licenses like GPL that require their adoption if work licensed under it is incorporated into a parent work, with additional stipulations that include the acceptance of the most current version of the GPL license?'''

The main ethical issue with a license requiring the acceptance of the most recent version is that it forces the user to sign a contract which has not been written yet. While the user could agree with the current version, a future version may change in such a fashion as to restrict the liberties of the user beyond what they would agree to. This setup provides a large amount of leverage and power to the writers of the new versions of the license because they can force a huge tree of people into new agreements. If a small, but widely used section of code was licensed under the GPL and the new version required additional profit restrictions, it would affect every project which used that code, as well as the projects which used those projects ect. At the same time, if the license is changed in such a way that it benefits the users then that too can affect a large group. The main ethical issue is the amount of power given to the writers of the license and how it is used.

'''What ethical considerations are highlighted by the patent sharing/protection agreement between Microsoft and Novell?'''

CSC 379:Week 1, Group 5

2007-07-08T15:31:22Z

Tmlangwo:

==Techniques Against Spam==

===Block Domains===
'''Background'''
A Technique to black spam that creates a blacklist of known spammers that can be used by email providers by the user. This will cause suspect spam to be sent to a spam folder or the automatic rejection of emails from blocked domains

'''Positive'''

It will effectively block spam from known spamming addresses.

'''Negative'''

Legitimate domains could be blocked as a result of a computer being hijacked

===Require users to request permission to send your email===
'''Background'''
A Technique to black spam that requires senders to request permision to send you an email. Senders not on your approved list , or white list email will be rejected or sent to a differnt folder. One example of this is the [http://www.earthlink.net/software/free/spamblocker/ Earthlink Spam Blocker]

'''Positive'''

The user should never receive spam.

'''Negative'''

Could have emails that a user might want to see that is not spam, but also not on your approved list.

===Charge for e-mail sent===
'''Background'''
If there is a cost per email sent spammers sending out millions of spam then would not be able spam at such a high rate
http://www.cnn.com/2004/TECH/internet/03/05/spam.charge.ap/

'''Positive'''

Spam would be cut down due to the cost

'''Negative'''

users will have to pay a cost per email sent as well

===Opt in / opt out===

'''Opt-in''' is a type of permission-based mailing where recipients must first give consent before becoming part of a mass mailing list. This guarantees that the sender of the advertisement, newsletter, or other mass mailing is targeting only those who want the mail.

'''Opt-out''' is a less stringent form of acquiring permission because recipients are not asked for consent before receiving the mailing, but are permitted to opt out of further mailings by indicating they wish to receive no further messages from the sender. The process of opting out usually takes the form of a web link embedded in an email or a specially formatted reply to the sender.

The European Union Privacy and Electronics Communication Directive mandates that entities wishing to contact existing customers through email or text/SMS must provide an opt-out option in their message.

===Domain authentication===

'''Domain Authentication''' is a means of ensuring a valid sender identity in email to help prevent spam, email forgery, and fraud. There are different methods of domain authentication, such as Sender Policy Framework, Certified Server Validation, SenderID and DomainKeys, and different methods have different advantages. DomainKeys, for example, can authenticate the entire content of a message as well as the domain from which it originated, while SPF and CSV can reject a forged email before any data transfer occurs. However, they are all effective for authenticating a sender's domain, and it is yet to be determined which method or methods will become most popular.

===Bounties===

'''Bounties''' in a general sense are monetary rewards for either information leading to the arrest of criminals or for delivering the criminal in question to the authorities. In the case of bounties on spammers, some proposed plans would award money equal to a percentage of the penalty for the spammer. For example, information provided on a spammer who was not convicted or fined would yield no bounty, while a twenty percent (20%) bounty on a large spamming operation that was fined two million dollars would yield forty thousand(40,000) dollars.

[http://www.msnbc.msn.com/id/5326107/%20 news report of possible bonds law]

===The "Goodmail" approach===

The '''Goodmail''' approach to spam was an idea to have spammers pay isps to ensure that their mail was delivered past spam filters. In theory this would reduce spam because only legitimate companies could pay the fee and not individual con artists. Many nonprofit groups were concerned that they would not be able to send Email because they did not have the finances to pay for goodmail services. There was also concern among customers that all mail which was not Goodmail certified would be blocked, including personal Email. There is also the risk that if isps rely on goodmail to stop spam, they will defer development on their spam blockers until they are completely ineffective.

[http://www.goodmailsystems.com Goodmail homepage]

===Bonds with escrow agencies===

This system requires mail senders who are not whitelisted by recipients to pay a small fee to a bond agency. If the recipient feels the mail is spam and unwanted, they can then retrieve the bond money from the agency. In effect, this means that they charge the sender for wasting their time.<ref>[http://www.itu.int/osg/spu/spam/contributions/Spam%20economics-faq.pdf] For non-spam email, no money would change hands at all, the original bond amount would simply be returned to the sender.

[http://www.itu.int/osg/spu/spam/contributions/Spam%20economics-faq.pdf full description of bond system]