New interaction strategies must be devised, throughout "public" communication highways, such as the Internet, for preserving by design the privacy of people. Currently, there is little that can help us in this area.

The simple answer is that communication tools are not secure - given enough time and resources, any security measure can be broken.

This leads us to risk management - understanding the different risks around, analyzing them, and deciding how to handle them. Using ISO31000, you can mitigate risk by Reducing them, Transferring them, or accepting them. In theory, all is well.

The challenge arise when new technology promise easier communication, faster communication or otherwise improved communication. Unless you really understand that new technology, how can you be expected to make qualified and informed risk assessments?

As an example, look at the insulin pumps which comes with WIFI for administration. The pump itself is a great technology, and the WIFI administration promise ease of use. Since the owner of the pump, and the manufacturer too, most likely do not have the imagination and competence to assess all the other, non-designated uses of that technology, they believe it is safe and secure.

Until some hacker decides to break into the wifi and take control over the pump - your pump.

The same is true with the electronic keyfobs of cars. They are meant to make the ownership of the car easier, and both car manufacturer and car owner believe they are secure. Until a surge of car thieves prove them wrong.

Again, this is most likely happing due to human/mental bias. We believe we are fool proof, and that our ideas are great. Its also well known that our mental bias´ makes us look for evidence that our solution/hypothesis are correct (verification bias) instead of looking for faults.

Combine our lack of ability for abstract thinking, which is paramount when it comes to assess risk in virtual systems, with our mental bias´ - and it is easy to see how we fall victims to trusting IT to be secure.

To evaluate if PRISM/TEMPORA has any consequences for practical research, I believe it comes down to a question of the kind of research and it´s potential commercial (or possibly defense) value. Only you and your peers can know the true value of your research. The higher perceived value your research have, the more concerned should you be with regards to security.

In the end, it all comes down to trust. Do you trust your peers? Do your trust your communication tools?

True to it, research and social interactions are as safe as not being shared (off-line). In the light of snowden's revelations, its clear that one can hardly assume confidence in the confidentiality of information exchange, especially when powerful companies like microsoft are involved. What we need are new approaches to communication that would emphasize three integral requirement simulteniously; secrecy or anonimity of Sender, of Receiver and secrecy of communication content. The relationship must take a logical AND perspective.

The question is always about what needs to be protected, who is the adversay and what form of protection is necessary. I consider that any electronic transfer of information can be eavesdropped upon by any number of adversaries (my ISP, some other ISP/service provider, law enforcement, an intelligence agency, etc. I also consider the sensitivity of the information being transferred and whether an adversary would be interested is said information. Not all adversaries have the same interests or are willing to expend the same level of resources to access the transferred information.

From a sensitivity perspective, one can classify information as:

- public: information that would not embarrass me if it ended up on the front page of the New York Times;

- confidential: information that could embarrass me or someone else if it ended up on the front page of the New York Times;

- restricted: information that could cause me or someone else financial harm; and

- highly restricted: information that could cause me or someone else legal or physical harm.

From an adversary perspective:

- is the adversary interested in knowing what I am doing, saying or working on (i.e., profile development for advertising, my personal or professional activities;

- is the adversary interested in knowing what I may do or work on in the future (i.e., plans, intentions);

- is the adversary interested in knowing who I am communicating with (traffic analysis);

- is the adversary willing/able to expend moderate resources to gain their objective(s); and

- is the adversary willing/able to expend significant resources to gain their objective(s).

Based on my determination of sensitivity and likely adversary(ies), I then determine what form of protection the information being communicated requires. Protection can range from:

- communication over data networks without any special protection added;

- communication over PSTN without any special protection added;

- communication over data networks with commercially available encryption techniques employed (e.g., PGP, openPGP, GPG, Zfone, Nautilus); and

- communication over data networks with enhanced encryption techniques (as in triple AES, one time pad) employed (e.g., modified openPGP, GPG).

One must keep in mind that traffic analysis over publicly accessible networks is very hard to defend against given the need for source/destination information to be clear-text although communication via email can be anonomized to an extent.

Consequently, parties to any communication activity need to determine the sensitivity of their communicated information, the adversaries of concern and agree on what form(s) of protection is(are) required.

I do agree with a previous post of "with enough resources, any security measure can be broken". With this in mind, the data being shared must be looked at closely. Sanitizing the data to ensure there is nothing leading to personal information is a must and a first step.

Secondly, what is the current trends in attacks? Recently the attacks in our area are not layer2/3 oriented but are stacked within the application. There is a growing need to install an application firewall to either clean or drop the infected packets. This however, does cost in increased latency not to forget budget. Huge consideration must be given to where the unit must reside like the DMZ or a particular server farm to reduce the amount of latency experienced.

Many of our partners are deploying certificates for encrypted downloads/uploads. This helps but with enough data, even this can be cracked.

Michael, the keywords are Ethical Conduct; spying does not conform to these properties. "Do the recent reports on spying on individuals and organizations 'worldwide' have any consequences for your practical research work?" Yes, this battle has been in existence for centuries. Solution is enforcement of intellectual properties (IP). Publishing and limiting disclosure shall protect researchers and their work.

This is now only a gut feeling that I can not entirely prove. Being in Finland, which is a very IT/telecom-dependent country, I find the takeover of Nokia by Elop and Microsoft very dubious. MeeGo would have been a huge success and Elop shut all of that down to force in Microsoft, which is deeply in bed with NSA/CIA/PRISM/Bonesaw (https://tinyurl.com/lrvcu25). Knowing that DARPA runs for a long time their total information-awareness project (https://tinyurl.com/qahhbbk), which is a global effort, it can not be that such a big mobile-phone company runs on an OS that would not spy on the user for NSA/CIA. I am just amazed that the Finnish media/government doesn't drop a peep about sacking Elop and kicking out Microsoft and also nobody else. There is not even a mini-product line with MeeGo in place. That is really very odd and I can only explain that with some behind-the-curtain agreement aligned with DARPA's total-information-awareness program given that Finland is a country where the government is in charge and running just about most relevant things. As Nokia still dominates Finland's business-ecosystem, the rest of the country is aligned with business/research activities to make Nokia "happy". My own research focus is enterprise computing based on the principles of free-market economics. While this should be a hot topic, I have experienced the funding for projects in that area collapse and companies have no interest any more to get involved in R&D for case-study delivery. Instead, there are these odd projects popping up that I find ethically dubious, make no sense with respect to business feasibility, but the outcome is reinforcing the corporatist (https://mises.org/daily/5963/) business model, enhancing big-data spying activities on people, using IT to secure government and big corporations while "enslaving" the public. This has been a slow transition and I find it very disturbing. Even when I check the EU Horizon 2020 framework, I see a comparable trend. With a bit of awareness, one can clearly see the philosophy behind the funding framework of the next round of EU-projects. It is all about chasing some odd bogeymen terrorists, fighting global warming (which can not be anthropogenic when we know the universe is electric: http://www.thunderbolts.info/wp/) and studying security in a way where we have a creeping militarization of society. Thus, the spirit of PRISM/Bonesaw is penetrating the research landscape in a subtle way when we know that EU-countries are in on the deal (https://tinyurl.com/qxq2jmh). In the end, money always talks and those who pay (openly or covertly) make the rules. Scientists just follow the money when they put their project proposals together and unfortunately ethics in research has been thrown out of the window a long time ago, which is a very worrying trend. At least for my type of research (free-market-economics based enterprise computing), the funding has evaporated for now.

Putting aside bad faith-laden intents of all sorts and taking a vantage point from the pure public scholarly perspective, IMHO there are two main issues here - (a) protecting personally identifiable information of research participants who confided their data in your hands, and (b) ensuring the scholarly integrity of publications and works. Given that there is no real means of total protection, any data can be compromised either remotely by cyberware means or locally by insider- or intruder-based means. Yet, if there is no specifically-directed monitoring campaign on your institution, you can frustrate the hack out of the mass-production practitioners using degrees of separation, conceptual coding, retouching identifiable idiomatic/biodata details without affecting your database, etc. The second issue is more acute as it is hard to overcome - affecting the scholarly awareness by directing research toward specific direction or preventing research to go specific places through selective grants, influencing editorial boards, and manipulating data. While the above mentioned cyber sensing programs are not functioning as cyber actuators, their combination with actuation means, may have posed and probably will pose a potential threat on non conformal scholarly works.

Thank you all for your valuable answers. I've got the impression that most of you are not much concerned about the NSA and GSQA activities.

Well Michael, I am very concerned. But maybe because of my background, I have a different approach than somebody who is a standard "Westerner" who thinks "it can't happen here". I was once born into Apartheid South Africa and also lived for 1,5 years in Burma when the country was Stalinist. My grammar school was only some 2 blocks away from where Adolf Hitler went to grammar school before he was kicked out. I used to cross-country ski right next to the iron curtain and travelled the former Soviet block. Being very sensitized to threats for liberty and freedom that way means I am very conscious of the creeping militarization of Western societies. As I have travelled around to conferences, I have seen how this militarization has unfolded in a coordinated way like a plan that was worked out a longer time earlier. This trend is flanked with very dubious events where the physics never matches the official story mainstream media spoon-feeds to the masses and in the background we have NSA/PRISM/Bonesaw lurking in collaboration with European intelligence agencies collecting all information possible of the public globally. I have studied carefully and experienced myself how tyranny sets itself up and operates. The pattern is always the same and the first step of setting up the vital infrastructure always happens by stealth until a turnkey point is reached. Step two means taking off the velvet gloves for bringing out the iron fist. The third step is mayhem until enough average people can't take it any longer and refuse to play along. If you ask me, we are right now in a transition phase from step one to step two. Honestly, I am very concerned, certainly when I see that science has dropped most considerations for ethical behaviour too. PhD stands for doctor of philosophy and a philosoph is a "lover of truth". But back in old Greece, there was also a second school of thought, the so-called sophists who decided truth is too hard to stick to and instead one should merely perfect polished ways of arguing for achieving selfish objectives. Today, we would call that spin, propaganda, public relations. Given the losses of liberty and freedom over the last years, I see also clearly the rise of doctors of sophism who have abandoned the love for truth. They have no problem to sell out ethics and truth for the sake of riding the funding wave for dubious objectives. Thus, the slow and creeping corruption one can clearly see on all levels of society are also very evident in science and at universities if one dares to see that trend.

@Alex, I appreciate your response very much. You have raised a point I didn't see before when asking the question, but which might bear enormous consequences for us (I mean, researchers). It's not enough to keep your data away from digital equipment or encrypt them; we also have to keep our academic temples clean from funded philistines bringing down academia and freedom.

@Erik and @Arnold, I have looked into some (not all) of the older materials about global and local NSA activities. I think the difference between those and Snowden's materials seems to be that he has evidence, whereas the former could easily be taken as conspiracy theory. The accusations on the whole might not be that new but their quality certainly is.

@Khalil, spying is exactly the correct word for some of the activities related to PRISM/TEMPORA. Your comments seem to advise heavily closed research, which I am disinclined to. I prefer Open Science but I do not want other groups (i.e. NSA etc.) to have my results before pubication.

Hello Michael,

I share your anguish but not only as a scientist. The fact is that there exitem more secrets. Now it is only a matter of knowledge, equipment, and conditions and power (state power, knowledge power, etc.). As said Charles Martin maybe the NSA (and others) do not want to stay in snooping but the fact is, if they want, they can and do. This, I think, is the central problem.

So, it is not to be researchers or not. The problem here is freedom, respect for individuality, intellectual property, knowledge produced etc. .. The state (or any other type of organization) can not be out in the scouring under what pretext.

I agree with Alex when he puts ethics as a discussion point. Except that I think the iron fists are already showing and simply, because as things occurred (spread of technology) we can not simply choose not to play. We're all playing. So I think we have passed from step three you mentioned.

So it is not protection (passwords, encryption, that sort of thing), as some have mentioned, but of freedom and independence. That is the question. And we know that for certains individuals, groups and powerful states no limits nor ethics. Only greed and need. And for them, the ends justify the means, you can be sure.

See you later,

S.

This may not prove to be a popular view, but it is my view nevertheless as someone who has experience working for the State. I am of the opinion that neither the UK nor the US have either the computing power or the will to monitor all communications, including research. My own research will potentially be of interest to them as I am examining the current statutory limitations to what the UK state is actually empowered to do!

9/11 provided the impetus for a massive stepping up of interception of comms, however the resources available to do it and the resources available to sift what is intercepted of necessity have to be directed at what the State perceives as threats to its national security, its economic wellbeing and to a lesser extent serious organized crime. No one can be particularly comfortable with the idea that their communications may or may not be being intercepted, however if those comms are not related to threats to the State's interests in the aforementioned theatres, then they are unlikely to be retained or acted upon. It is a reality that most of our comms are channelled through ISPs and servers belonging to corporations who have had to either accede to State requirements regarding sharing of info they perceive as threatening to States, or who have willingly bought in to the State's protective aspirations. As a result, anything we post anywhere, or anything we communicate electronically is potentially interceptible. Encyption of what we do is a red herring as the boffins within the State interception apparatus can get into anything they want. A bigger concern to researchers sharing work online etc I would have thought, is tthe idea hat private corps, or rogue states, or rival researchers gain the means to intercept those communications.

The State simply does not have the motivation or the wherewithal to intercept or act upon communications not affecting its national security aspirations. I accept this will not please those out there who seek to believe that governments want to know all about us and engineer a Big Brother State. The fact is that governments in the West come and go at the whim of the electorate. Interception is governed largely by the constant power in Western States (i.e. the executive) comprising the Civil Service apparatus and the Intelligence Services. The Intelligence Services have limited resources and are charged with protecting national security etc. They may mine and trawl the web for communications deemed threatening to State interests, but actual interceptions are limited (by very real considerations of budget, human resources, time and division of labour) to real and present dangers to the State, not the work of academic researchers. Analysis of intercept content, i.e. where it is to be acted upon and where it flags up a real person of real interest is a time consuming labour intensive process. PRISM et al may mine the communications, however they all require intelligence analysis and input. For that reason, the State can only become aware of a limited number of individuals/groups worth taking further action on. Academic researchers are unlikely to fall into that category (in Western democracies).

The interception of communications and electronic spying by corporations or non-democratic states is probably a much more significant concern.

Hello to all,

@ philip glover: the point is that governments (no matter what, because they are democratic only in accordance with their interests and it is not difficult to see), have interests, which may vary legitimate interests as in the case of terrorism , the interests of people and social classes that make up the state apparatus (or have intimate relations with him) as the arms industry or the oil industry for example, do not extend this list. So, the fact is that if they want, for whatever reasons (legitimate, corporate, private, etc.)., catch you, they will catch. That's the point!

See you later,

S.

PS: How do we know that our work does not interest them, or which of our work interest them?

:)

@ Sergio Silva. Thanks for engaging! We don't!! Quite often it probably will! i am guessing the current piece I am sending off in the hope of publication about "Snowdengate" will! However we have to accept the possibility that any electronic coomunication we make can potentially be intercepted by the State. There is no avoiding the fact of mass interception, and short of revolution, no way of reversing the post 9/11 trend of increased State interception, as it is controlled by the executive rather than revolving Parliaments (unless they legislate in that field). My point to the original questioner as one of reassurance, was that States carry out these interceptions largely on "national security" or related grounds, rather than to suppress freedom of expression or other European Convention rights. Whilst academic communications, like any other, may be intercepted, it is unlikely that democratic states will either retain or use that intercept content against the originator of the communication. The fact of interception in Western States is usually kept secret from the communicator. (This is the UK position). So unless the communicator is involved in terrorism, financial or serious crime, the State cannot use intercepted material to progress any State suppression of an individual's activities. Additionally, they simply do not possess the analytical resources to analyse the intercept content of communicators who are communicating about matters outside these areas of terrorism, financial crime or other serious crime. I should perhaps have grounded my original answer in UK law, as it only interception of communications in the UK that I can seek to reassure the original questioner. It is my belief that researchers or any other free-thinking academics have nothing to fear from the very real fact of mass interception of communications highlighted by the exposure of programmes such as PRISM. I am not condoning the use of these programmes, however their consequences for the vast majority of online communicators who are not involved in criminal behaviour are nil. I would stress again that interceptions in the UK are undertaken only by UK intelligence-gathering bodies (and in the US it is the same). Intercept content that is retained is not passed in these countries to private interests of any description.

Hello Glover,

Excuse me but is much innocence you think that the interest of the states (I'm not just talking about the U.S. and the UK, have also come to China spying and interfering massively inside and outside of China) is only related to political and terrorism. It's the economy, money, geopolitical interests (economic again) and power (political, economic, strategic, cultural, etc.). Dominate the state apparatus is not there only with politics but with the economy and maintaining status quo for individuals, groups, corporations, religions, etc.. So much fight to occupy it, is not it? But I think that Marx and his notion of superstructure are dead, it seems.

@ Charles Martin: we never know how our findings and conclusions will be used is not the same. The plane was not designed to drop bombs ... but he turned a gun? Fields of interest and application of knowledge are very diverse and what we know can be useful where less imagine. No work we do matters only to us, you can be sure. So states (governments) and corporations fund research and work :)

S.

I support Sergio's view of matters by mentioning only one point. Why were European Institutions in Brussels and Washington and the G8 summit communications intercepted by UK and US intelligence? Are they terrorists or their supporters? Or did they want to find out counter espionage measures? In the latter case they should have gone for the services themselves, and not for plain government officials.

@Philip, you may be more prepared than I to comment on Tim Berners-Lee's article on this, see

http://www.dailymail.co.uk/news/article-2348682/Founder-web-Tim-Berners-Lee-accuses-West-hypocrisy-internet-spying.html

@Michael, thanks. An interesting read. One of the problems I see with the UK law (RIPA 2000) and the associated intelligence services and anti-terrorist laws here, is that "national security" and "economic well-being" are not legally defined. In addition, interception carried out in the UK has no contemporaneous independent oversight, only retrospective oversight by an independent Commissioner. (Risible) With the 2 principal grounds under which UK Cabinet Secretaries can authorise interceptions lacking a legal definition, there remains room for the incumbent Government (by 'leaning on the intelligence-gathering apparatus via the executive) to include economic summits etc in their own concocted definition of "protecting the economic well-being of the UK" definition. I'm not a political scientist or international relations expert but I am guessing that all the G20 for example will use use whatever resources they have to protect and indeed increase their economic power. If they have the means, they will use espionage to do so. Developed nations are cyber-attacking each other constantly in the pursuit of greater power.

Change to interception regimes in developed nations would be very difficult to achieve I imagine. A great read in the UK context is David Vincent's "The Culture of Secrecy: Britain 1832-1998" which charts the evolution of the UK executive. Read in conjunction with the widely available histories of the British Secret Services, it becomes clear that civil libertarian concerns about State interference have been sacrificed, or at least come a very poor second, to post-9/11 policies to suppress terrorism and a very wide interpretation of what States perceive as threats to their economic interests.

Academic research in the G20 is, I would venture to suggest, unlikely to be prioritised amongst the intelligence-gathering apparatus in these countries. Like every other contributor, and indeed Tim Lee, the fact that States are using the internet to gather intelligence and that individuals need to realise/accept their communications of whatever description may or may not be monitored is not an overly pleasant fact to absorb, but it has to be absorbed. For me as an internet user in a G20 country, I am more concerned as to what the corporations behind the servers I use are doing with my personal info than what any State intelligence-gathering body is doing, as I know I pose no threat to them. I know that corporations are monitoring my comms because of the targeted advertising I receive and th ejunk mail about subjects I have an interest in that appear. This is significantly more privacy intrusive to me in personal terms than the idea that GCHQ or the NSA read this email, as I have no subversive plans or plans to undermine the UK economy!

We should however, all be subject to the honest rule of law, and where State's are carrying out these activities there should be clear statutory authority for it, proper credible independent checks and balances on State power and an effective means of redress such as in the European Court of Human Rights. In the UK, we appear well short of explicit statutory guidance and regulation of Government activity in intelligence-gathering. So if anyone in the intelligence ocmmunity is perusing this, I hope to have a helpful paper or two for you in the coming 2 years as part of my thesis...

.. and I hope you don't use the wrong keywords in your digital communication with people who have connections to people who have connections to people ... that pose a threat to whoever is able to read your statements and have the power to pose a threat to you afterwards. In German we have a word for the aftermath of such a situation, 'kafkaesk'. IIRC, there is a similar term in English.

Thanks for your extensive and valuable response. All the best for your thesis.

I wouldn't be surprised at all. We have a lot of problems, though, with those people. They intercept a lot but are blind on the eye to the right... I'm afraid I can't tell more, hush-hush.

Every freedom loving citizen should be concerned when governments impinge on its citizens freedom and rights. It appears that information collection net only capture data sets that have suspicious words like terrorist, bomb etc.

Hello to everyone,

@ Chris Foya is not only what they are doing or what descriptors or words they are using to monitor but it is what you are capable of doing. As said in the previous post the interest of states change constantly and Marx showed us very well what class interests the State represents, and we all know the intimate relations between states, domination (social class, economic status quo, etc.) and power is not the same. And we know whose side is the power: it is the iron hand of the powerful :)

congratulations,

S.

In the wake of the ongoing spying row BBC's Frank Gardner (not being notorious for sounding shrill) comments, 'The US has many shared interests with European nations like Germany - counter-terrorism being one of them. But when it comes to economic intelligence, their interests can often diverge into outright competition.'

It's a European perspective that can easily be extended to Latin America and other regions of the world. Outright competition together with shear unlimited technical resources pose a threat to work of scientists, engineers and all people who want to make profit with knowledge and development. They (we) have to face the reality and protect our data carefully, expecting the worst.

Are these warlike events?