Ｉｎｔｒｏｄｕｃｔｉｏｎ

The 1st International Privacy and Security Conference• Financial Ｃｒｉｓｉｓ

Ｓｅｓｓｉｏｎ ＩＩＩ
Globalism of Privacy and Information Security
Common issues under normal global economic environment,
privacy protection and information security after world financial panic

12 November 2008

Organizer: Takato NATSUILaw professor at Meiji Univ., Hayabusa-Asuka Law Office

New York Times September 14, 2008
http://www.nytimes.com/2008/09/15/business/15lehman.html

Copyright © Takato Natsui 2008, all rights reserved.

2Influence

Fundamental Elements for Management Systems

Ｐｒｉｖａｃｙ ｐｒｏｔｅｃｔｉｏｎ ａｎｄ Ｉｎｆｏｒｍａｔｉｏｎ Ｓｅｃｕｒｉｔｙ• Existence ofNormal Management– Management Body
– Organization– Management Plan– Controls– Methods– Objects (Information Assets, Personal Data etc.)

Normal Management

No organization

Controls

No employee

based on ISMS etc.
Privacy Protection– Operation– Performance– AuditAbsence of ManagementOrganization

Information Security• Possibility of Management

After Bankruptcy

based on JIS Q 15001 etc.

Information Security
Unable to function
Privacy Protection
Unable to function

34P

Presentations and discussions

×ＰA• Presentation

P– Mr. Robert Gellman– Mr. Yoshio Araki– Mr. Taro Komukai– Madame Toshiko Sawada

DD×C• Discussions• Summing up

PD×C561Three Dilemmas for American Privacy Policy• Mr. Robert Gellman

The Globally Integrated Enterprise• Mr. Yoshio Araki– Privacy and information policy consultant inWashington, D.C.
– Former member of the U.S. Department ofHealth and Human Service's National
Committee on Vital and Health Statistics(1996-2000)– Robert Gellman: Privacy and Information
Policy Consultant
http://www.bobgellman.com/– Chief Privacy Officer (CPO), IBM Japan, Ltd.
– Chairman of directors board, NPO Personal
Information Protection Knowledged-man
Meeting– IBM Japan
http://www.ibm.com/jp/ja/7International Personal Information Protectionin APEC

8Personal Information Protection
on Borderless Electronic Commerce- International Relationship of Trust Mark -• Mr. Taro Komukai• Madame Toshiko Sawada– Lecturer, Nihon University– Lecturer, Toyo University– Researcher, Tokyo University, graduate
school of Information– InfoCom Research Inc. (ICR)
http://www.icr.co.jp/– Director, NPO EC Network– Former researcher, Next Generation
Electronic Commerce Promotion Council ofJapan (ECOM)– EC Network
http://www.ecnetwork.jp/en/

910

Common Computing through Network Systems
in the near futureDiscussions• Ubiquitous• Part 1: Common issues under normalglobal economic environment– Terminal Equipments or PC may be– Radiofrequency Devices may be• However…

• Part 2: Privacy protection and information
security after world financial panic– Concentration and Virtualized Outlooks• Summing up– Impossible to Control and Audit correctly for everyone• Huge ISPs, Cloud Computing Provider etc.

– Monopoly• Google Search etc.

• Crisis of Privacy Protection and Information
Security may take place
11122

Cloud Computing

Cloud Computing

from point of view of law and business management
Communication
Cloud Computer

User Company(Virtual System)

Application:User Company

PhysicalResource

Application:

ISP’s Policy

User’s Policy

Domestic Laws
applicable tothe ISP

Domestic Laws
applicable tothe UserISMS,
ISMS-Tetc.

ISMS,
Privacy Mark,
Trust Marketc.
14

Use as a Terminal
Application:
Cloud Computing Provider’sPolicy

PhysicalResource13

If Ｃloud Computing Provider has bankrupted

Domestic Laws applicableto the Cloud Computing
ProviderWhere have all the flowers gone?

×
User Company
Unable to Use???
15

16

A Primly Lesson
for Artificial Intelligence Programming

Summing up• Recognition– Legal Issues– Policy Issues

mortal (X) :- man (X); woman (X).

• Resolution

also– Legislation– Reconstruction of Business Managements• Risk Management• Crisis Management

mortal (X) :- corporation (X).

• Perspectives• Acknowledgement
17183

Risk Management (1)SharedResource

Risk Management (2)Cloud
Computing
ProviderCompany

Cloud
Computing
ProviderCompany A

Company B

Company C

…...

Cloud
Computing
ProviderCloud
Computing
ProviderCompany N
Customer orUser Company

Concurring or Competitive Business Companies
Conflict Check between A and B, A and C, B and C…etc.
Anti-Trust and Fair-Trade (Unfair Competition)
Trade Secrets

FamilyCompanyChildCompany

1920Risk Management (4)Risk Management (3)• Detection of Zombie House, Zombie Town

• Detection of Ghost House, Ghost Town

– IP (Internet Protocol) exists and is used by someone.
– The formal owner of the IP hasn’t bankrupted but failed.
– Mafia or Yakuza obtained the control of the IP and computer system.
– But, you don’t know what happened at all.
– Who is using the IP now?
ZombieTown– IP (Internet Protocol) exists and is used by someone.
– The owner of the IP had bankrupted and escaped already.
– But, you don’t know what happened at all.
– Who is using the IP now?
GhostTown

Cloud Computing
Provider’s IP

Cloud Computing
Provider’s IPYourSystemYourSystemYour IPYour IP
IndividualCompany’s IP

GhostHouse
21Risk Management (5)ZombieHouse
22Crisis Management• Effective Scope of Policies• Absence of Business Entity in fact

– User Company’ Policy can not be enforceable to the Cloud
Computing Provider• Mirror or Copy of Important Computer Data of Customer
Company, Family Company and Child Company• Detecting a Signal of Crisis• Development of effective measures to assess andconfirm the level of privacy protection and Information
security of the Cloud Computer, including technologicalstandards, management systems and enforceable
contracts, in accordance with adequate policies• Cooperation of Chief Information Security Officer (CISO)– Safety Network by Chief Information Security Officer (CISO)– Mutual Assistance of CISO

– The government may not perform any control on thebusiness entity– Administrative control may not function normally• Absence of Management Body in fact
– Absence Chief Executive Officer (CEO)• Absence of effective judgment• Absence of Risk Management– Absence of Chief Information Security Officer (CISO)• Absence of Information Security– Absence of Chief Privacy Officer (CPO)• Absence of Personal Data Protection• Emergency Response Service Provider– Access Control, Reservation of Important Computer Data,
Notification

IndividualCompany’s IP• Who can response such a mortal Situation?
2324

4

Perspectives in International Level

Legislation in domestic level•

Integration of Privacy Commissioner (Data Protection Agency)– EU - Omnibus system• Amendment of Bankruptcy Act– Bankruptcy trustee has to reserve and manage personal data on behalfof a bankrupt person or company in accordance with PersonalInformation Protection Act.
– Except of total transfer of personal data to the third party case (includingmerge case), bankruptcy trustee has to remove every personal data
completely and inform the fact to every person whose personal data had
been collected by the bankrupt person or company.
– Every cost for the reservation and management of personal data shouldbe treated as priority credit in the bankruptcy procedure.

• Privacy Commissioner (Data Protection Agency) system already implemented andoperated– The United States - Sectoral system• Make chair agency and cooperation system of Agencies in relevant Sectors– Japan – Segment system or Pasticho system• Absence of Privacy Commissioner (chief responsible Minister is not Data ProtectionAgency)• Cooperation of chief responsible Ministers?
• Reconstruction of the Personal Information Protection Act, similar laws and regulations•– Application to simple closing of company, Escape of management andemployee, or similar cases– Privacy commissioner has an authority and adequate procedures toreserve, retain and control any personal data which might be collectedand managed by such business entities

Establishment of single Contact Point and International Corporation– Every nation should have a single contact point to converse with each otherinternationally, especially to avoid global collapse.

• New enactment of Personal Data Reservation Act• Similar examples might be the International cooperation on Antitrust, international
cooperation against Cybercrimes etc.

••

Establishment of global Privacy Commissioner (Data ProtectionCommissioner) as a neutral organization
Punishment and Prosecution– Against crimes relating to personal data, including fraud, illegal selling ofpersonal data, misuse of personal data
– Establishment of International mutual assistance on police and prosecution• Fundamental amendment of Data Protection Law– To response to the absence of management body of personal data or
when the management body lost.
25

In the case of bankruptcy ofCloud Computing Provider

26

Next issues to be examined• The government has to perform an international
responsibility and should:– own and nationalize the bankrupt Cloud Computing
Provider– get every superior access authority to the system– control every information resource– reserve and make backup or copy of important data(including personal data, business information of userbusiness entity)– perform adequate management– arrest and prosecute escaped managers– bring action for compensation of damages against
escaped managers• Very large sized ISPs which:– Have numerous number of user companies– Provide Cloud Computer like computer services on the Internet,
especially relating to e-Commerce by the user companies– Provide database service to manage personal data andimportant information which have been collected and stored by
the user companies– Provide main accounting service for the user companies• And user companies rely upon information resources
provided by the ISPs entirely to perform their business• If such ISPs will bankrupt….
• Please Imagine Similarity to the bankruptcy of Cloud
Computing Provider

27

My Personal Belief••

Reconstruction of business management
as Private recommendation

Many Legal Issues on the Internet have not been resolved enough yet,including:–––––––––

28

Identification and Certification
Intellectual Property Rights and Public Domain (Open Source or Public Source)
Personal Data Protection
Trade Secrets and other similar Secrets
Anti-Monopoly and Unfair Competition
Undesirable Commercial Activities (SPAM etc.) and Consumer Protection
Unlawful Contents Provider, Illegal Trading on the Internet
Cybercrimes, International Organized Crimes and their Prosecution
Lawful and reasonable Cooperation of Information Security Specialists and Law
Enforcement Officials

New Global Scheme should be established beyond and cooperate withtraditional Management System Models, for the purpose of:– Quick Response to critical Crisis including Financial Crisis and Physical Crisis– Adequate and reasonable Control over Global and Complicated Network
Services like as Cloud Computing– Avoid over specialized Legal Discussions relating to Jurisdiction and Applicationof Law– Construction of International Cooperation Network– Establishment of a good Balance between Private and Public, Private andAdministration, and Commercial and non-Commercial– And, especially, Making a little bit Better Future for everyone who loves Freedomand Happiness.

29• Ever management has to recognize that use of cloudcomputing itself may be critical risks and causes ofmortal damages• Every business management system has to bereconstructed to:– Re-assess correctly main risks of cloud computing– Have enough ability to response urgent and criticalenvironmental change, including world financial crisis– Make and prepare adequate substitute for keep a continuity ofbusiness and integrity of information– Add reasonable risk management system for crisis of cloudcomputing, including cases when any family companies orcustomer companies use cloud computing and rely upon cloudcomputing provider’s service
30

5

L'homme n'est qu'un roseau,le plus faible de la nature,mais c'est un roseau pensant.
Pascal, Pansee316