Privacy and Security Part III: Worlds in Collision

Abstract

This article is the third and final in a series that explores the issues of privacy versus security. The first article, “Privacy and Security Part I: Privacy and Security in the Corporate World” covered the corporate side. The second article, “Privacy and Security Part II: It’s Personal” explored personal privacy versus security. This third installment will review the overlap from both sides corporate versus personal privacy: Who really owns your data?

Notes

i. Deere, S. (April 16, 2014). “Six Flags Season Pass Holders Now Must Provide a Finger Scan,” The St. Louis Post-Dispatch, www.stltoday.com/news/local/metro/six-flags-season-pass-holders-now-must-provide-a-finger/article_713d3869-8eae-594e-8399-5117f088bef5.html (retrieved April 2014).

ii. EPIC v. DOJ—Pen Register Reports, http://epic.org/foia/doj/pen-reg-trap-trace/#SAR (retrieved April 2014).

iii. Semiannual Report of the Attorney General on Electronic Surveillance and Physical Search under the Foreign Intelligence Surveillance Act, http://epic.org/foia/doj/pen-reg-trap-trace/025.%20June%202013%20SAR%20%5BPRTT%20pages%5D-OCR.pdf (retrieved April 2014).

iv. The provisions of Executive Order 12333 of December 4, 1981, appear at 46 FR 59941, 3 CFR, 1981 Comp., p. 200.

v. Moteff, J. (April 16, 2004). “Computer Security: A Summary of Selected Federal Laws, Executive Orders, and Presidential Directives, Congressional Research Service,” The Library of Congress, www.fas.org/irp/crs/RL32357.pdf (retrieved April 2014).

vi. Horowitz, R. “Summary of Key Sections of the USA Patriot Act of 2001,” www.rhesq.com/Terrorism/Patriot_Act_Summary.pdf (retrieved April 2014).

vii. Nice, K. “How Car Computers Work,” http://auto.howstuffworks.com/under-the-hood/trends-innovations/car-computer.htm (retrieved April 2014).

viii. Office of the Federal Register. 2006. National Highway Traffic Safety Administration—Final Rule. Docket no. NHTSA–2006–25666; 49 CFR Part 563 Event data recorders. Federal Register, vol. 71, no. 166, pp. 50998–51048. Washington, DC: National Archives and Records Administration.

ix. National Highway Traffic Safety Administration Event Data Recorder Working Group. 2001. Event data recorders: summary of findings. Final report. Washington, DC: U.S. Department of Transportation, and Gabler, H. C., Gabauer, D. J., Newell, H. L, and O’Neill, M.E. 2004. Use of Event Data Recorder (EDR) Technology for Highway Crash Data Analysis. NCHRP Project no. 17–24; Contractor’s final report. Washington, DC: Transportation Research Board.

x. Mitchell, R. (April 21, 2014). “4 Things to Do Now To Get Ready For the Internet of Things,” www.computerworld.com/s/article/9247616/4_things_to_do_now_to_get_ready_for_the_Internet_of_Things?taxonomyId=16 (retrieved April 2014).

xi. Internet of Things (IoT). WhatIs.com, http://whatis.techtarget.com/definition/Internet-of-Things (retrieved April 2014).

xii. Process Automation Control, www.pacontrol.com/wireless-standards.html (retrieved April 2014).

xiii. Osborne, C. (June 12, 2012). “Are Smart Meters a Privacy Risk?” www.smartplanet.com/blog/smart-takes/are-smart-meters-a-privacy-risk (retrieved April 2014).

xiv. Narayanan, A., and Shmatikov, V. “Robust De-Anonymization of Large Sparse Datasets,” in 2008 IEEE Symposium on Security and Privacy (sp 2008). IEEE, May 2008, pp. 111–125, www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf (retrieved April 2014).

xv. Manyika, J., Chui, M., Brown, B., Bughin, J., Dobbs, R., Roxburgh, C., and Byers, A. H. “Big Data: The Next Frontier for Innovation, Competition, and Productivity,” The McKinsey Global Institute, Tech. Rep., May 2011, www.mckinsey.com/insights/business_technology/big_data_the_next_frontier_for_innovation (retrieved April 2014).

xvi. Hasan, O., Habegger, B., Brunie, L., Bennani, N., and Damiani, E. “A Discussion of Privacy Challenges in User Profiling with Big Data Techniques: The EEXCESS Use Case,” http://eexcess.eu/wp-content/uploads/2013/07/2013.07_BigData-2013-04.pdf (retrieved April 2014).

xvii. Narayanan, A., and Shmatikov, V. “Robust De-Anonymization of Large Sparse Datasets,” in 2008 IEEE Symposium on Security and Privacy (sp 2008). IEEE, May 2008, pp. 111–125, www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf (retrieved April 2014).

xviii. Clarke, R. “Customer Profiling and Privacy Implications for the Finance Industry,” www.rogerclarke.com/DV/CustProfFin.html (retrieved April 2014).

xix. Privacy Policy, Spokeo, www.spokeo.com/privacy/terms (retrieved May 2014).

xx. “Geolocation Risk, Issues and Strategies” (September 2011). An ISACA Emerging Technology White Paper, www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/Geolocation-Risks-Issues-and-Strategies.aspx (retrieved May 2014).

xxi. The Latest on Workplace Monitoring and Surveillance, American Management Association and The ePolicy Institute. Last updated August 5, 2010, www.amanet.org/training/articles/The-Latest-on-Workplace-Monitoring-and-Surveillance.aspx (retrieved may 2014).

xxii. “Surveillance in the Workplace,” Citizens Information Board, www.citizensinformation.ie/en/employment/employment_rights_and_conditions/monitoring_and_surveillance_at_work/surveillance_of_electronic_communications_in_the_workplace.html (retrieved May 2014).

xxiii. Wakefield, R. “Employee Monitoring and Surveillance—The Growing Trend,” Information Systems Control Journal, 1 (2004), www.isaca.org/Journal/Past-Issues/2004/Volume-1/Pages/Employee-Monitoring-and-Surveillance-The-Growing-Trend.aspx (retrieved May 2014).

xxiv. Carns, D. (February 7, 2014). “Four Broad Considerations in Modern Data Security and What You Can Do to Make Necessary Changes,” www.insidecounsel.com/2014/02/07/technology-securing-corporate-data-in-an-internet (retrieved May 2014).

Additional information

Notes on contributors

Al Marcella

Albert J. Marcella Jr., Ph.D., CISA, CISM, is president of Business Automation Consultants, LLC. Dr. Marcella, is an internationally recognized public speaker, researcher, and workshop and seminar leader with over 35 years of experience in IT audit, security, and assessing internal controls. Dr. Marcella, has authored numerous articles and 29 books on various IT, audit, and security related subjects.

Carol Stucki

Carol Stucki, CISA, PMP, is a Project Manager with over 25 years of experience in operational and IT roles including providing internal systems consulting, portfolio management, and auditing services for companies both in the Unites States and abroad. Carol has worked for GTE (now Verizon), Arthur Andersen, Perot Systems, Los Alamos National Labs on DOE, DOD, HSD contracts, Church of Jesus Christ of Latter-day Saints, Capgemini, and HealthNow.