Police investigation in the field of cloud computing Rubèn Mora, head of Technologies of Information Security Department, Mossos d’Esquadra [Catalan national police].
One of the problems of cybercrime in cloud computing might be that the actual regulation does not take into account especific illegal uses of the Internet. Thus, the police has always to catch up with both technology and the law.
On the other hand, in real life we are used to sue (or to complain after) someone whose actions hurt us, but when it happens online we just go and call the police: this is overwhelming for cybercrime prosecutors, as many times it is not their duty or it is not that clear that it is.
Nevertheless, it is understandable that the citizen goes to the police, as many times it is not that clear who is liable for you having been harmed. This ends up with the citizen, in general terms, being less secure in matters of who is liable. In the same way, the police is tied to geographical jurisdictions that are not always the same ones as the ones that affect the one that created the harm.
If that was already a problem in the first year of the Internet, with cloud computing it has been multiplied by orders of magnitude, as cloud computing works in three different layers (SaaS, PaaS, IaaS) that make reality much more complex. The creation of Certs has lightened bureaucracies, but their interaction is still slower than crime.
Francisco Hernández Guerrero, Prosecutor, Granada Prosecutor’s Office.
Law has to be practical, efficient. We have very nice laws and guarantees of rights that we never apply. There usually is a trade-off between efficiency and guaranteeing the citizens’ rights: the problem is finding the desired balance.
Against cloud computing, nowadays, there is no way to be efficient: prosecutors (police, courts) have no means of being efficient. Thus, should we give up to some guarantees? Cloud computing is about dematerializing everything: and, with dematerialization, the difficulty to trace and monitor. Cloud computing shifts the claim for ownership to availability (e.g. instead of downloading music, having it available through streaming). Cloud computing is also about delocalization: hardware and software are usually not where the user is.
The division of two concepts: the difference between being connected and being communicating. Your mobile phone might be on and connected and exchanging information with other devices, but you might not be communicating — strictly speaking — with anyone. And being so easy becoming a criminal — in full consciousness or unconsciously — the solution is to monitor and put surveillance on anyone.
Main characteristics of cloud computing:
Economic: money aimed;
Highly pro;
Botnet: the infrastructure as system;
Absolutely unbalanced: the bad guys are much more than the good ones, as the good ones’ computers are corrupted by the bad ones, thus becoming part of the crime network.
We definitely have to re-define the law.
We need a set of measures to enable surveillance of the citizen but distinguishing connection and communication. e.g. RFID-based crime should fall onto the category of data protection, not onto the right of communications.
Measures (legal and technical) have to be progressive: we have to distinguish an individual uploading photos of their ex-couple in a social networking site, from a terrorist network copying credit cards.
We need a catalogue of cyber-crimes, especially those characterized as serious.
And we need independence of the support or the holder of data: we need access to all data from a person wherever they are stored.
The model should, thus, split technicalities from guarantees: the police should lead the investigations, as they have the knowledge and the means; while prosecutors and courts should follow the processes to guarantee their righteousness.
Discussion
Jordi Vilanova: what is the liability of the owner of an infected device? Hernández Guerrero: Yes, in the same way that you are liable to a certain extent to do the maintenance of your car so that you don’t run over anyone, some knowledge of the power of a specific device and its maintenance (e.g. a PC and an anti-virus) should be a requisite and the owner liable for not acting according to that requisite.
Marcel Mateu: Right, we have to change the law. But how many policemen and prosecutors are able to work in the digital age? Mora: the resources of the police often depend on how the citizenry pushes their governments to fight this or that type of crime. If the priority is e.g. gender violence, then cyber-crime is less funded. Hernández: in general terms, agreed that cyber-crimes are not in the political agenda. Surely much of the “cyber-” is just crime done by electronic means, but maybe the politician needs an “e-Pearl Harbor” to realize that the world has changed.
Blanca Torrubia: what is the profile of the cyber-criminal? and what should be required to fight cyber-crime? Mora: the cyber-criminal is increasingly younger as years go by, astonishingly young. And the best way to fight cyber-crime is information and training. There is evidence that cyber-crime over minors drastically decreases if they are being informed and trained on the hazards of specific behaviours on the net.
Irekia is the open government project of the Basque Government to provide public data in a very accessible way, easy to reuse. Open Cloud Government is more a philosophy than a technology, it is another way to manage public affairs, to decide taking into account the citizens’ opinion. Irekia is not a services website, it is not an e-Administration website. Irekia is a website to listen to the citizen, to offer immediate information in search for debate and reflection.
Data are linked from the original source.
Transparency, participation, collaboration.
What does Irekia offer the citizen:
Tools for collaborative work.
Streaming of events.
Informations in real time.
Daily agenda
Audiovisual and multimedia material.
Tools to comment and share information.
This kind of initiatives are based on leadership and government commitment. Otherwise, they are neither possible nor sustainable. Besides political support and commitment, open government also requires a radical organizational change and, over all, a change in attitudes. It is in the daily tasks that open government succeeds or fails.
What does Irekia offer the members of the public administration:
On demand audiovisual material.
Internal agenda per department.
Possibility to diffuse events.
Active Internet monitoring (escucha activa, what is being said about you on the Net).
Consultancy 2.0.
Comment moderation.
Complete, tag and disseminate on the Web information published by the departments.
One of the goals of open government is not to have a lot of traffic, or a lot of sympathisers of the website, but to be a hub and distribute interests to their goals. e.g. what open government pretends is not creating online communities of patients, but that they are able to do it by themselves.
One of the problems, notwithstanding, of “all being open” is that anyone can create their own participation platform (government and citizens) and it is becoming increasingly difficult to know who’s “legitimate” to promote a certain activity; it is also becoming increasingly difficult to find out where to participate, or what for; there’s a big replication of projects that reinvent the wheel on and on, etc.
Open Administration Consortium: built upon the principles of collaboration, ICTs and change. Why collaboration?
Interoperability: not about technology, but about the citizen and the interaction between public administrations.
Reutilization: Avoid reinventing the wheel.
Security. Digital identity, electronic signature, long-lasting validation.
Cloud computing is not a new technology, but a new way to provide services. But, in the public service, this means some struggles:
82% of cities and towns are below 5,000 inhabitants which means they have no resources for an IT director. Same happens with organizational management.
Actually, in general city councils have increasing obligations and decreasing revenues/resources.
The management of (electronic) services is complex: more services, specific regulation, security, 24×7 availability, scalability, etc.
Reluctance to change.
The Open Administration Consortium works with district and province councils — as they are the more knowledgeable on the reality of city councils — and Localret, a consortium of municipalities to develop ICT strategies. The Open Administration Consortium provides, thus, different services to the different municipalities according to their needs, nature and resources. Among others, main services include public procurement, online invoicing, inter-administrative procedures, citizen documents, etc.
Reluctances are the usual about privacy, data security, liability of data management, fear of change, fear of cyberwar, etc.
I look forward a municipality that will have no physical space, no web servers, no… but a virtual desktop where all data, applications and services will be hosted. This will be especially useful for the secretary of several tiny towns (small towns usually share a single public officer) that will be able to manage three or four of them from just a virtual desktop and teleworking from home.
Freedom on the Net (FOTN) report analyses how are rights respected on the Internet, especially right of communications, privacy, etc. Questions asked:
Internet and new media dominating flow of news and information
What techniques do governments use to control and censor online content
What are the main threats
What are the positive trends
The methodology examines the level of internet and ICT freedom through a set of 19 questions and 90 subquestions, organized into three baskets:
* Obstacles to Access—including governmental efforts to block specific applications or technologies; infrastructural and economic barriers to access; and legal and ownership control over internet and mobile phone access providers.
* Limits on Content—including filtering and blocking of websites; other forms of censorship and self-censorship; manipulation of content; the diversity of online news media; and usage of digital media for social and political activism.
* Violations of User Rights—including legal protections and restrictions on online activity; surveillance and other privacy violations; and repercussions for online activity, such as prosecution, imprisonment, physical attacks, and other forms of harassment.
Negative trends
11 of the 15 countries censored content; 7 of the 15 countries blocked web 2.0 applications; there are also restrictions on infrastructures (speed restriction or broadband restriction, total access restriction, etc.)
In low-income countries, there are infrastructure and economic constrains, but, in general, economic issues are barriers that are overcome in low-income countries when a benefit can be made from ICTs.
Censorship is not always related to political or social content. We find significant lack of transparency in censorship procedures, including in some democracies. There is a wide range of techniques for blocking and/or removing content.
Censorship is being outsourced in some countries, the government hiring companies to run censorship or surveillance procedures themselves.
In many cases, it is ‘offline’ regulation, or general regulation the one that has an impact in online activity, like general media legislation against online activities, etc. This is leadind, in some cases, to “libel tourism”, where people have they web servers e.g. in the UK to put legal responsibility for posting or hosting content in a more democratic jurisdiction.
Of course, we find too extra-elgal repercussions, with detentions, intimidation, torture and extra-legal harassment and violence in general against “dissidents”. This also includes DDoS attacks, hacking, etc.
Positive trends
In general, there is more Internet freedom than press freedom, though the gap might be narrowing.
“Sneakernets” to avoid being monitored or scanned when being an activist on the Internet. Bloggers, though sometimes pushed-back because of threats, are increasingly creative in their usage of the Internet to have their voices heard.
Future trends:
more access to the Internet because of the mobile web and smartphones;
globalization and spread of Internet will not necessarily lead to greater freedom;
web 2.0 leading to Authoritarianism 2.0
foresight and creativity needed from more open countries to establish policies to protect free expression on new tecnologies.
Discussion
Albert Batlle: how is it that the UK scores worse in Freedom on the Net than Freedom of the Press. A: It might be because of “libel tourism”. Maybe because of that, maybe because of other issues, the reality is that it is easier in the UK to close a website than a newspaper, etc. All in all, it all highlights that though related, these are freedoms that can be taken independently.
Jordi Vilanova: what about the US and other western countries? A: Summing up, surveillance and even censorship are much more paramount that what would look like at first sight.
Mònica Vilasau: how do we tell censorship from e.g. fighting against copyright violation? A: It is always difficult to tell. It is nevertheless true that any kind of legal activity against online activity (legitimate or not) has chilling effects in the whole ecosystem.
Ismael Peña-López: the Wikileaks affair seems to have found a solution in a data haven in Iceland. Are data havens the solution to censorship? Will data havens allow people to act illegally under the flag of freedom? A: The problem with data havens, as with other barrier circumvention tools like TOR, is that they can be used both in good and evil ways. Nevertheless, it seems like, as now, there are more good uses than illegal ones, and way more need to enable transparency and to help democracy advocates rather than focus on prosecuting some illegal activities.
Teleworking taken to the limit or “nomadic working”: it is not about having an office and from time to time staying home and telework, but your office is where you are, provided there’s connectivity to the Internet.
Autoritas Consulting has 12 employees all over Spain and customers all over the world. Four key decisions: to work from home, to use open source, be an open business and be based in Apple devices.
Pros: Total freedom of schedules; no commuting costs; no license costs; no office costs; work on a self-service principle (you want it, you use/do it).
Cons: Reluctance to change and have to learn to adapt to the new realities; if there is no office, there is no support; cost of ownership (licenses) shifts towards cost of use (customize, external support, etc.); is this a standardized society? what if you do not work with standards (i.e. Apple)?; is self-service / DIY an inconvenient where you have to do it by yourself?; this design only applies if you work goal-based.
Issues: miss meetings (e.g. we are disorganized, etc.); routines are difficult to break, change of systems, new ways of doing things; where are the limits? what is my working time? from flexible schedules to flexible life; where does personal life and work life begin and end? does it matter?; need to see hear each other, to ‘see’ each other, do we need personal touch?
Changes in the law: what means workplace security when you don’t have a workplace in a strict sense? What actually means workplace when everyone stays at home?
In the Internet you are connected with many people, but it’s you alone in front of the computer. The coffee break with the colleagues does not compare with a “twitter break”. New rules, new procedures.
Opportunities: more self-responsibility; self-management; “the consultant kit”; comfortability in the many solutions.
Inconvenients: responsibility, discipline, common sense; difficulty in tracing the limits.
The impact of technological decentralization at the workplace: teleworking Javier Thibault Aranda, Complutense University of Madrid.
Several benefits:
For the enterprise: flexibility, more possibilities of hiring (no geographic limits), decrease of costs, etc.
For people: reduction of costs, more job market access for disabled people, etc.
For the society: specific collectives more hireable, etc.
Several risks:
Teleworking practices to hide actual outsourcing of jobs.
Some social agreements at stake: separation of personal and professional life, the concept of “breaks” and resting times, etc.
Limited impact of this working organization in Spain, huge reluctance at the corporate level, lack of explicit regulation.
Regarding the law, in Spain the Statute of the Worker has a 13th where “working at home” is referred to, but in very different terms as what now teleworking is. On the other hand, collective action of workers is based in critical mass working together and in the same place (sort of), which does not apply to teleworking. At the European level there is an framework agreement on teleworking, but it has not been translated to Spanish law.
Is another way of doing the same thing: teleworking is about changing your location, not your job specificities.
Physical externalization does not imply legal externalization.
Teleworking is volunteer and cannot be imposed. Sometimes the inner conditions of the enterprise could force the shift, but acknowledgement of the worker is needed. This only applies to working from home: if there is a need to work at the customers’ offices, then no acknowledgement is needed.
Teleworking can imply a technological control, which usually happens to be tighter than physical control. But, can the employer access the computer of the employee? It depends, but the employee must be aware of it, aware of any kind of control that will be put into practice.
The worker has the same rights as any other worker, but not more rights that other workers do not have.
Results of a survey about teleworking women: teleworking only adopted by 3-8% of people; most of them (in the sample) with dependants; and most of them working in great corporations, including some public administrations.
The definition of teleworking comes from Jack Nilles and has three requisites: work takes place in a different location from where it is intended to be delivered/used; intensive use of ICTs, a communicaton link from employer and employee.
More than 50% of teleworkers (of the previous sample) consider teleworking as a good option to be able to cope personal with professional life: take care of home and or kids and or other dependants, etc. The focal point is flexibility, and thus quality of life increases (or, at least, the perception of it).
Though positively evaluated, there are some drawbacks:
Social and professional isolation.
Longer working hours.
Feeling of guilt: really depending on whether teleworking is taken as natural, as a core value of the firm, or whether teleworking is seen as a “favour” that your boss allows you to benefit from. Normalization of telework leads to enjoying it, otherwise arises feelings of guilt or feelings.
Many times, telework is actually an extension of your working hours, not a change of workplace. You’re given the freedom to keep working from home. This is quite usual in many and many firms.
Many times, too, staying at home means assuming all the home tasks naturally: the one that “already is at home” is the one that “naturally” goes shopping, cleaning, etc. It is rarely seen teleworkers locking themselves in their home-office and forgetting about what is not work during working hours.
Sometimes too, the culture of “sitting at your desk” or remaining lots of hours home (definitely spread all over Spain) rewards the ones that do not telework. Thus, teleworking means less presence at work and giving up at being promoted. Most of the times it is a conscious choice — personal life or family vs. professional career — instead of a way to cope with both.
Summing up, the definition of telework and, over all, telling whether it is positive or negative depends on many variables that are by no means agreed or common ground among employees and employers. There is a need of a former and thorough planning, great transparency and agreement on the conditions, that teleworking is something for men and women (not only for “mothers”), and that teleworking is also an option for whatever level of the hierarchy.
Discussion
Ismael Peña-López: digital competences, are a pre-requisite of the worker that wants to telework, or an obligation of the firm to train them? And, related to training, what if the teleworker does any harm to a third party (e.g. online) or does any illegal activity (e.g. intellectual property right infringement). Thibault: the firm, as in the offline wold, it is the firm that is liable for any harm to third parties, at least when the employee is not an independent worker but dependent from the organization. Related to training, training is both an obligation (in Spanish law the employee has to keep up with the technical changes that happen in their workplace) and a right, the right to be trained by the firm. Pérez: The reality tells us that there is no or poor training and, most of the times, it is more about informing the employees (e.g. about some specific novelties) rather than explicit and planned training. Llinares: we have to take into account also the difference between switching to teleworking or directly joining a firm where teleworking is the norm. Same about being up-to-date: in some works (e.g. e-government consultancy) teleworking skills are not only a means or a tool, but also a goal, as it is part of the product being offered to the firm’s costumers.
Round Table: Key Legal Aspects for Putting your Business in the Cloud Chairs: Miquel Peguera
Controlling the provider Xavier Ribas, Landwell Global.
Increasing trend to outsource services at the enterprise, including some belonging to the core business. With cloud computing, even risk management is shared with or outsourced to a third party.
But, are you then losing control and even putting your firm in the hands of your providers? You lose control of the confidence chain, control of data, of the quality of service, of the available preventive measures, of reputation risk management (and there actually is an increase of risk of reputation loss), control of secondary and non-consented outsourcing, international data transfer, etc.
How to solve this? How to regain control over these issues? Possible clauses:
An obligations map should be drawn and agreed upon, including what happens once the relationship ends (e.g. what will happen to data in a blog once the service is discontinued?).
Manel Martínez Ribas, ID-LawPartners.
What is the difference amongst open source and open cloud? Is there any open source cloud?
The four freedoms of free software, do they still apply in cloud applications or services? More indeed: free software developers using cloud services, will they find their free code closed? This gives birth to new licenses where cloud service providers are able to use specific software, let it to the end user as software as a service (SaaS)… thus allowing for copyleft on one end and a sort of closeness on the other end.
Open cloud computing allows, as it happens with free software, to make modifications.
Fabrizio Capobianco: reasons to care about open cloud computing in the mobile arena:
It is already a big issue.
It is a necessity.
It should be interoperable
It normally depends of closed devices.
The Open Cloud Manifesto pretends to settle the debate and reach some agreement (equilibrium?) on how to respect the free software freedoms in cloud computing.
Principles:
Avoid lock in.
Use standards.
Go on with initiatives according to the needs of the customer.
Teamwork and network.
It seems that cloud computing will be the main entry point for institutions to (at last) use free software massively. Same with software providers, that will shift from proprietary software to free software.
Legal aspects to take your enterprise to the cloud Ramon Miralles, Coordinator of Information Security and Auditing, Catalan Data Protection Agency.
It really does not matter to read or not the terms of reference of cloud services: their providers will change them unilaterally and many without notice. So…
The problem is neither (only) that we do not know where our data are, but nor we know where our data pass through, because they constantly change paths.
A Cloud computing solution: self-service, broad access in the Net, full of resources, fast and easy, measurable and supervised. A solution which might be the end of corporate computing.
As said, one of the big problems is not only that data are elsewhere, but that they circulate across borders and jurisdictions. The European Directive, in this sense, looks more at what is happening, rather than trying to typify each and every procedure that takes place on the Internet. It nevertheless needs some updating as cloud computing has really challenged web usage as we knew it.
Information self-determination: the right to control one’s own data, to know who has our data, what is done with them, etc. Information self-determination is at stake with cloud computing.
IDC Enterprise Panel (august 2008) states the following challenges/issues of cloud computing: security, performance, availability, hard to integrate with in-house IT, not enough ability to customize, doubts about cost, bring-back in-house might be difficult, not enough major suppliers, etc.
Main challenges of Cloud Computing:
Decrease of control over information and services.
Data treatment and processing.
International movement of data.
Applicable law.
Discussion
Q: The Catalan Government is to move its education community to Google Applications. How are citizen rights guaranteed? Miralles: The problem can “easily” be solved by signing a contract. The problem is usually not as much as in privacy, but in transparency and availability of information by the user, to recover their information, etc.
Ramon Miralles: it makes no sense the distinction whether it is a human or a machine who processes the information, as this only creates legal defencelessness and insecurity. Indeed, it is in the core of data processing that it is automatized. So, we have to look at the essence of the data processing process, at what will be the end use, rather than at the how.
Manel Martínez: we have to differentiate between consented usage (contextual adds after reading your e-mail, as you agreed to that by accepting the terms of reference) and non-consented usage of data. Ramon Miralles: right, but the problem comes when the conditions are change unilaterally and, even if you are made aware of this, you are locked in and have really hard times migrating your data in a service you’re having difficulties to leave.
Q: how do we measure the cost of loss of reputation because a third party service failed? Xavier Ribas: this is very difficult to measure. It might be not very difficult to measure the non-returning customers, but it is definitely difficult to know how many new/potential customers will not use our services/products for the very first time after a reputation crisis has been suffered.
Jordi Vilanova: should not the WTO coordinate cloud computing services (in a legal and economic sense)? Miralles: it is clear that the traditional instruments to regulate economic activities (national and international regulation, contracts, etc.) might not perfectly fit in such activities as cloud computing. So, yes, WTO or another platform might be used to update regulation and procedures to brand new activities.
we do not to perform any backups, including software;
we have no more storage limitations, adding more storage room is quick and easy;
ubiquity, all services are available from anywhere.
Some problems with cloud computing that media repeat over time:
Closed applications that are difficult to expand or modify: you cannot change (add features, customize, etc.) Google Documents easily
Availability outsourced: to access a single Google Document we rely on our PC, our web browser, our Internet provider, Google, the government regulation (e.g. you depend on the Chinese government to allow Google to operate in China), etc.
But, where are our data? Where is our privacy? Most of our data/privacy is on Google, Microsoft and Amazon, the later the biggest provider of cloud platforms.
Indeed, some service providers cannot only access our data, but do have control over our devices:
What happened with Amazon’s Kindle and the novel “1984” affair: erased a novel from all books, got sued (and lost), but doubled their sales of Kindles.
Facebook will retain ownership of your photos: huge claims for intellectual property and privacy, but Facebook users in Spain almost tripled during the “scandal”.
The case of the accountability service that showed that no one reads the terms of service.
All in all: people do not read the terms of service and accept whatever terms. But the thing is that most service providers require this free access to data to be able to let data to third parties, the basis of the business plan.
Open Cloud Computing / Open Cloud Compliant: the services are in the cloud, but the user can choose where the data will be stored. At least, this allows for the user to know where their data are. It also avoids conflicts of interest: the one that provides the service is not the same that provides the infrastructure: the service provider will ensure that data are safe, and the infrastructures provider will ensure that the infrastructure supports the service.
We should then differentiate between infrastructure cloud computing and services cloud computing. Open cloud computing means that these are separate and there’s a possibility of choice, and closed means that they all come together with a single provider: in this case, privacy risks arise.
The average user prefers ‘easy’ to ‘nice’, even if ‘easy’ means ‘ugly’. This creates de facto standards. People prefer applications to be fast and easy, even if it is less powerful or less nice.
About eyeOS
eyeOS is an open-source browser based web desktop, which means that it acts as a framework that, once the user is logged in, logs the user to whatever application runs on this desktop. Thus, the user does not need to remember where the applications are (what third parties’ services) and how to log in them.
(NOTE: here comes an interesting discussion about institutional and individual uses of open cloud services, the free software community, etc.)
