The Hindu Business Line : A question of trust

Mistrust-Based Digital Rights Management. Dismal, it may sound, but that's the title of a new research paper by Randal C. Picker of the University of Chicago Law School. "You buy a music CD and pop it into your computer. Before you can rip the CD to your computer, a registration window opens. That window takes your name and credit card information. Once registered, you can rip the CD and play the music to your heart's content," reads a scenario that the paper begins with.

"What's the catch?" asks Picker, and answers thus: "The catch is that your identity travels with the songs — more precisely, not your full identity but an ID tag that can be matched with your stored account information — and someone in possession of the tag can access part of your account, can, say, turn in the tag and get $10 charged to the account holder's credit card."

This type of DRM or digital rights management, which is mistrust-based, may be difficult to implement for standard music CDs or DVDs, concedes the author. "But just as the VCR has gone the way of the dodo, physical media are dying as mechanisms for delivering content."

Online distribution of content will supplant physical media in the next decade, he declares, citing as examples Apple's iTunes, Google's new video service and Amazon's Upgrade. Even as we replace products with services, mistrust-based DRM will play a key role, "precisely because of the way that it leverages the content purchaser's incentives to protect identity and, in so doing, protect content."

Be happy that in the system that Picker talks of, "Content can be shared widely." Only, the content is worthless `absent access to identity'.

Too old-fashioned an idea, perhaps, to sell things on the basis of trust.

Private data in public domain!

How can the government ensure the availability of online public records, while at the same time securing the privacy rights of its citizens? This is the question that finds answer in `Privacy and Access to Public Records in the Information Age,' a recent research paper by Sol Bermann of the Center for Interdisciplinary Law and Policy Studies, Moritz College of Law.

"Online public record access brings a wealth of potential benefits ranging from greater government access and accountability to increased cost-savings and efficiencies. However, due to the presence of highly sensitive, personal data, an increase in public records access also brings potential dangers," he notes, and discusses `four possible approaches' to the public records policy dilemma.

The first is to provide the broadest access to public records by placing them on the Internet, unmodified from their current paper or electronic format, thus maximising access but minimising privacy. The second is a middle ground approach; data elements within the public record files are reviewed and modified to protect individual privacy interests (such as redacting social security numbers to help prevent identity theft). Third, "create a bifurcated records system that would limit online access to certain private or sensitive information, but leave the complete paper or electronic record available for public review at the record holder's office." And fourth, "Do not place any public records related to citizens online at all. This minimises access, but maximises privacy."

In conclusion, the author says that holding back online public records is akin to trying to plug a dike that has long since broken. "It is time to make decisions based on citizen need and government efficiency," he insists. The solution to privacy concerns, according to Bermann, is to create a single public record by redacting unnecessary, sensitive personal information from both office-bound (paper and electronic) and online public records.

"The growth of the information age should be a call to action or, at minimum, a wake-up call for government to bring policy in line with technological progress," exhorts the author. "Public policy surrounding the right of citizens to demand openness and transparency from their government and the right to expect their private lives to remain private is not a zero-sum game where one side's gain is the other's loss."

Thought provoking, though the government may not be too inclined to clean up its records of sensitive personal information.

Digital communications sexual harassment

Do you know that `digital communications sexual harassment' is on the rise? How sad, but what's that? Harassment that occurs "through sexually offensive and unwarranted e-mails, placing harassing messages on electronic bulletin boards, and other forms of harassment that occur through the Internet," explain Donald P. Harris, Daniel B. Garrie and Matthew J. Armstrong in `Sexual Harassment: Limiting the Affirmative Defence in the Digital Workplace,' an article in the University of Michigan Journal of Law Reform.

Should this type of harassment be treated any differently than what occurs in the physical space? "Yes," say the authors, because an employer has the ability "to monitor and block digital communications and thus prevent sexual harassment." Thus, in the new judicial framework that the paper suggests, courts can place "an affirmative obligation on employers with blocking and monitoring technology to take reasonable preventative measures." Such an approach will ensure "protection of the digital and physical workplace for employees," hope the authors.

The paper speaks of DWDT, short for Digital Workplace Defence Test, and six issues that a court should address. "First, a court should ask whether the defendant protects its valuable digital information such as financial data, customer records or sensitive intellectual property." An example cited by the authors is of an employer in the media industry who ensures that employees don't make unauthorised copies of the media for pre-release.

Second poser is about the use of "some form of real-time suspicious activity and policy violation detection technologies." For instance, financial institutions use messaging systems with `real-time logging capabilities' with "the ability to track instant message conversations." The third query is "whether the defendant utilises some form of user tracking," such as a research trail that enables "the employer to record the employee's actions with respect to a particular Web-based tool set."

Fourth issue that the authors would like courts to determine is "whether the defendant is monitoring its systems using real-time technology for suspicious user behaviour." Monitoring is trigged, for instance, "when a user mistypes his or her password three times". Fifth comes a review of the defendant's recording systems. An example in this context is of hospitals that have to ensure the protection of patients' records; hospitals have to "track and demonstrate that the digital records are released only to authorised parties."

And the sixth issue is the determination whether the defendant utilises a form of early end-user monitoring technology. "Employers frequently use this technology when employees are working off-site to ensure that the employees are performing the work as promised and the client is receiving authorised services."

It may seem that compliance to the framework is so elaborate as to be harassing. But the adverse economics of the vice in question can more than offset any cost involved in proactive preventive measures.

http://IT-in-the-works.blogspot.com

More Stories on : Software | Music & Dance | IT Works | IPR

Article E-Mail :: Comment :: Syndication :: Printer Friendly Page

Stories in this Section
It's easy to forget...

Sending the right signals

Trailblazers

Quiz

Manners in the e-age

Cartoon

Ringing music