Risks of Surveillance

authorized monitoring and unauthorized snooping. At present, telephone communications are relatively easy to intercept and computer systems easy to penetrate. The privacy communi ty wants to ensure that both telecommunications and computer system data cannot be read without proper authoriza~:ion, to protect individuals and corporations alike. (The importance of privacy is considered by Marc Rotenberg, "Inside RISKS," April 1992.) The security R&D community seeks computer communication systems that can resist losses of confidentiality, integrity, and availability, with meaningful assurances. The U.S. intelligence community apparently wants to retard the widespread availability of secure systems and communications. (See Clark Weissman, "Inside RISKS," October 1991, discussing export controls.) The law enforcement community wants to be able to eavesdrop on suspected individuals and businesses. (See D.E. Denning and others, March 1993.) For example, the proposed Clipper Chip (announced by the White House on April 18, 1993) would provide son, re measure of privacy, but would also enable telecommunications to be tapped by authorized agencies acting under court orders. Two keys are combined (by an exclusive or operation) to form a single key that is used for both encryption and decryption; the original keys are stored in separate escrow repositories, for retrieval only if they are requisitioned under a war:~ant. (See the on-line "RISKS Forum," beginning with w)l. 14, issue 51.) Considerable controversy erupted in the Risks Forum and other discussion groups surrounding the privacy that Clipper and its computer network counterpart Capstone might provide. The Skipjack encryption algorithm they both use is secret; it has not been subjected to the lengthy sociotechnical process that has resulted in both DES (the Digital Encryption Standard) and RSA (Rivest-ShamirAdleman) gaining an aura of relative uncrackability. The algorithm's secrecy raises concerns about why it is secret, suggesting to some skeptics that hidden weaknesses might exist and that unforeseen problems are likely to arise when the algorithm is eventually uncloaked. Keys may remain valid even afi-er warrants expire. There is a likelihood that persons operating in collusion or agencies not bound by judicial restraint could circumvent the legal process to gain access to the escrowed keys. Competitive disadvantages to computer communication providers, exportability, and international uses remain as murky issues. Open discussion is needed, as recommended by the NIST Computer System In compute r communica t ion systems, analytical surveillance is important in several contexts, such as detecting and perhaps hindering network outages, system intruders and misusers, and credit card fraud. However, inherent conflicts exist between the demands for privacy and the demands for surveillance; it is difficult to ensure both at the same time. Selection of what information can be monitored should be strictly limited to what is essential, and access to that information carefully protected. In computer audit-trail analysis, capturing every input and output character is highly undesirable, because of the risks of misusealthough those risks may be justified by reliability and recovery needs. Thus, surveillance and monitoring information must be protected with considerable care. Unfortunately, most computer systems are operationally not capable of ensuring adequate privacy, especially when confronted with malicious insiders and penetrators. Measures to increase system security and privacy are necessary but not sufficient. Potentially, accidental or intentional use of surveillance information can be damaging, and can be especially harmful if the information is incorrect. Even when carefully constrained, audit trails often contain sensitive information that could be easily misused--such as financial or status data, or even occasionally passwords and cryptokeys. In some cases inferences can be d rawn f rom aud i t t r a i l characteristics without explicit data. Also, the lurking possibility of employee performance surveillance can be extremely stress-producing. We live in a world that includes corporate competition, criminals, and clandestinely dishonest people. There is a need to protect systems from malicious misuse, and there is also a need for some surveillance. However, the use of surveillance must be carefully controlled, because it has many potentials for being antisocial and riskful. In some cases adequate controls are not possible, and difficult decisions must be made whether to err on the side of privacy or the side of surveillance. In either case, much greater attention must be paid to identifying and minimizing the risks, while attempting to recognize and satisfy the conflicting demands, r l