February 2017 - nexa - server-nexa.polito.it

Cookie Policy

by Stefano Traverso

Carissimi amici di Nexa, sono un ricercatore del Gruppo Reti del DET e mi occupo principalmente di misure su Internet e analisi di traffico web. Vi contatto per un quesito di carattere giuridico che solo voi esperti di Nexa potete aiutarmi a risolvere. Da esperimenti che abbiamo condotto scorsa settimana su 100 siti italiani piu’ o meno presi a caso, abbiamo visto che la stragrande maggioranza installa cookie persistenti e/o contatta servizi di tracciamento terze parti *prima* che l’utente dia il consenso all’utilizzo dei cookie tramite il famoso banner imposto dalla EU (http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0058:EN:H…) A quanto capisco dalla legge, i cookie persistenti (o di profilazione - quelli che sono usati dai servizi di tracciamento) possono essere installati solo dopo che l’utente ha dato il consenso. Molti interpretano pero’ che basti presentare il banner informativo per autorizzare l’invio di cookie persistenti. L’informativa del garante della privacy (http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/export/…) non mi ha aiutato a dipanare il dubbio. Tuttavia, il kit di implementazione (https://s3.amazonaws.com/iprs/files/attachments/20155/17bfe609-832b-4eb5-bd…) sembra confermare la mia ipotesi. Secondo voi qual e’ il modo corretto di interpretare la normativa? Vi ringrazio anticipatamente. Ciao, Stefano -- Stefano Traverso, PhD DET, Politecnico di Torino Corso Duca Degli Abruzzi 24 10129 - Torino - IT Tel: +39-011-090-4127 Skype: tigredcarta Web: http://www.tlc-networks.polito.it/public/phd-and-post-docs/stefano-traverso

Feb. 13, 2017

Sorry, Europe, but Trump wants your data (Da IrishTechNews ...=

by gabriele elia

Analisi su un tema che alla fine deciderà il futuro dell’impero americano Saluti Gabriele http://irishtechnews.ie/sorry-europe-but-trump-wants-your-data/ Home<http://irishtechnews.ie/> Big Data<http://irishtechnews.ie/category/big-data/> [http://irishtechnews.ie/wp-content/uploads/2017/01/donald-trump-1757562_128…] Sorry, Europe, but Trump wants your data Simon Cocking<http://irishtechnews.ie/author/sarah-paddle-swim/>January 31, 2017 Interesting guest post by Marc R Gagné MAPP<https://twitter.com/OttLegalRebels> Senior Privacy and Data Advocate, Cyber Intelligence and Director @ Gagne Legal. See more about Marc here<http://irishtechnews.net/ITN3/cyber-and-data-security-insights-with-marc-r-…>. Image from pixabay here<https://pixabay.com/en/donald-trump-politics-presidential-1757562/>. In the struggle between national security and individual privacy, President Trump has made it clear that he chooses security. What does this mean for the rest of the world? Just as it seemed the EU was finally managing to hoist U.S. companies up into higher standards for data protection, along comes a new administration to change everything. During his first week in office, President Trump signed an executive order that essentially unravels years’ worth of government and business negotiation toward better protection for data collected in Europe. The reason? It’s no less than national security. To quote the executive order itself, “Many aliens who illegally enter the United States and those who overstay or otherwise violate the terms of their visas present a significant threat to national security and public safety.” And how will the new order address that threat? Partly by altering the privacy rights of non-U.S. citizens, even though they may never set foot on U.S. soil. Sec. 14, entitled “Privacy Act”, states, “Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.” What’s at Stake: the EU-US Privacy Shield There’s a lot at stake here. Data transfer frameworks are a key policy issue these days and for many in the U.S., the topic suddenly came alive after Trump was inaugurated. The way companies like Facebook collect, handle, and store personal data on millions of users has been a hot topic of discussion and regulation for years now but only recently has it permeated the consciousness of the general public in the U.S. But here comes President Trump to put a spotlight on the heart of the matter for everyone to see: security vs. privacy. It may as well be “security or privacy”. Framed this way in no uncertain terms as a dichotomy – an “either-or” proposition, the whole issue of data transfer and privacy rights is now cast in an “us against the terrorists” framework. It’s a sentiment it seems Trump supporters can clearly understand and get behind. Others, including major blue-chip businesses, see the issue in a different light. This new development directly threatens an important agreement between the U.S and the EU, called Privacy Shield. Privacy Shield essentially holds U.S. companies to data privacy standards that rival the ultra-tight protection that’s already in place for EU citizens’ data. Essentially, raising the bar on privacy makes EU companies more willing to do business with U.S. companies. Privacy Shield governs the sharing of data between the EU and the U.S but with Trump’s rollback on privacy policy, the agreement may fall apart, hence business could suffer as U.S. companies find themselves in violation of EU data transfer and privacy protection laws. Big Companies Were On Board, Too Google, Apple, Amazon, IBM, and almost 1500 other companies were all set to uphold their end of Privacy Shield. They had signed an agreement under the guise of Digital Europe, a collective of tech companies who support the notion of stringent data protection policies like they have in the EU. By signing, companies essentially promised to uphold EU-level protection of data they collect there. That means, no matter where collected data eventually winds up, EU citizens can feel confident their personal information is protected. So, why doesn’t the United States have progressive data protection and privacy laws on the books yet? “Mom, It’s Not Fair- All My Friends are Doing it!” The problem here is governance. In the U.S., the Federal Communication Commission (FCC) has jurisdiction over Internet Service Providers (ISPs) but companies like Facebook and Google are regulated by a different agency, the Federal Trade Commission (FTC). When either one of these agencies tries to toughen up regulations, those affected cry “unfair!” and point out how the other agency isn’t imposing such strict rules. That’s exactly what happened when the new Broadband Consumer Privacy Rules were passed by the FCC. Imposed only last November, they require ISPs to ask for permission from users before they may share browsing data and other types of personal information with third-party organizations like advertising agencies. In protest, ISPs point out that Google and Facebook don’t have to abide by strict privacy standards so why should they? But the FCC maintains there’s a clear answer to ISP’s protests of unfairness. Since consumers often face limited choices when it comes to who they hire to deliver their data, it’s only logical that ISPs should be held to tougher privacy standards. The ISP industry isn’t exactly teeming with a multitude of competitors. It’s a case of two governing bodies setting different rules with different levels of stringency. Compare it to different sets of parents who set varying degrees of limitations on their children. Once the kids get wind of how “lenient” their friends’ parents are, all bets are off and you’ve got a mess on your hands. It’s going to be that much tougher to enforce your rules. This is the type of bickering that takes place when there’s no central authority, no over-arching regulatory body in place for settling matters on a national scale. The EU has it. Canada has it. But so far the United States has made no move toward forming a single, central authority on data protection and privacy matters. The Rest of the World For the rest of the world, it’s an uncertain future if you’re at all concerned with what happens to your personal information after you do business with a company in the United States. For the U.S., there could be negative repercussions for businesses who curry favor with customers in the EU. That may well be true for companies who want to take part in any type of international trade. For the rest of the world, it’s perhaps a larger message, that for now at least, U.S. domestic security and immigration matters take precedence over the privacy rights of the rest of the world. Marc-Roger Gagné CCIE, CHTI, CCII, CCTA, CIPP/G/C, CTFI, MAPP Services Juridiques Gagné Legal Services 275 Slater St, Suite 943 Ottawa,Ontario,K1P 5H9 @OttLegalRebels 613-688-0195 866-535-0896 If you would like to have your company featured in the Irish Tech News Business Showcase, get in contact with us at Simon(a)IrishTechNews.net<mailto:Simon@IrishTechNews.ie> or on Twitter: @SimonCocking <https://twitter.com/SimonCocking>

Feb. 12, 2017

Atlantic: "'Give Us Your Passwords'"

by J.C. DE MARTIN

*'Give Us Your Passwords'* / //What happens if border agents are allowed to demand access to your phone and online accounts—and turn you away if you don’t comply?/ Kaveh Waddell Feb 10, 2017 “What sites do you visit? And give us your passwords.” That’s what U.S. Homeland Security Secretary John Kelly wants foreign visitors to hear before they’re allowed to enter the United States. “If they don’t want to give us that information, then they don’t come,” he said, while testifying in front of the House Homeland Security Committee on Tuesday. The suggestion was met with horror among privacy advocates. “With that kind of access, they can not only see what you’ve publicly posted, but things you haven't posted yet, private messages, private lists, they can impersonate you, and even do these things on accident,” wrote Joseph Lorenzo Hall, the chief technologist at the Center for Democracy and Technology, on his website. “This kind of access is profoundly invasive.” Kelly’s proposal goes beyond most interpretations of the law—but that doesn’t mean it’s not already followed, occasionally and informally, by American border agents. And the U.S. isn’t the only country with unclear standards for border searches. […] Continua qui: https://www.theatlantic.com/technology/archive/2017/02/give-us-your-passwor…

Feb. 11, 2017

Data commissioner tells court US law fails to protect privacy

by Alessandro Mantelero

http://www.irishtimes.com/business/technology/data-commissioner-tells-court… Nel mirino le standard contractual clauses (SCCs), su cui personalmente nutro dubbi da tempo. Trascendendo dallo specifico caso dei flussi EU-US, va infatti osservato in via generale come criticità sussistano sia con riguardo al rispetto delle SCCs da parte degli operatori, sia in merito all'obbligo per il data importer di verificare se le norme vigenti nel Paese di destinazione comportino un "substantial adverse effect on the guarantees provided for under these clauses". Il tema, per chi volesse, è stato trattato nel volume curato da Resta e Zeno-Zencovich (La protezione transnazionale dei dati personali: dai 'Safe Harbour Principles' al 'Privacy Shield', Roma, 2016), nei seguenti contributi: - Mantelero, A. I flussi di dati transfrontalieri e le scelte delle imprese tra Safe Harbour e Privacy Shield. 239 ss. (specialmente 254 ss.) - Riccio, G.M. Model Contract Clauses e Corporate Binding Rules: valide alternative al Safe Harbor Agreement? 215 ss. Il volume è pubblicato sotto la Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License (CC BY-NC-ND 4.0) al seguente indirizzo: http://romatrepress.uniroma3.it/ojs/index.php/PTD -- Prof. Avv. Alessandro Mantelero Politecnico di Torino Nexa Center for Internet and Society | Director of Privacy Politecnico di Torino–Tongji University| Coordinator, Double Degree program in Management and IP Law Nanjing University of Information Science and Technology | Part-time Expert, School of Public Administration European Data Protection Law Review | Associate Editor http://staff.polito.it/alessandro.mantelero @mantelero EMAIL POLICY: once a day (Mon-Fri) ________________________________________ Le informazioni trasmesse sono indirizzate esclusivamente alla persona o al soggetto destinatario e sono da intendersi confidenziali e riservate. Ogni trasmissione, inoltro, diffusione o altro uso di queste informazioni a terzi differenti dal destinatario è proibita. Se ricevete questa comunicazione per errore, contattate il mittente e cancellate le informazioni da ogni computer. The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

Feb. 11, 2017

Re: [nexa] Are the US-EU data agreements still alive?

by Alessandro Mantelero

Segnalo in proposito l'analisi condotta dall' EPRS (European Parliamentary Research Service) "From Safe Harbour to Privacy Shield" www.europarl.europa.eu/RegData/etudes/IDAN/2017/595892/EPRS_IDA(2017)595892… AM > ---------- Forwarded message ---------- >From: Alberto Cammozzo <ac+nexa(a)zeromx.net> > Date: 2017-02-08 17:12 GMT+01:00 > Subject: [nexa] Are the US-EU data agreements still >alive? > To: "nexa(a)server-nexa.polito.it" ><nexa(a)server-nexa.polito.it> > > > Privacy Shield potrebbe essere già morto... > > <https://edri.org/are-the-us-eu-data-agreements-still-alive/> > > Late on the first day of Computers, Data Protection and >Privacy (CPDP) > Conference on 25 January 2017, word came through that US >President > Donald Trump had issued Executive Order (EO), “Enhancing >Public Safety > in the Interior of the United States”, which included >the following: > > Privacy Act. Agencies shall, to the extent consistent >with > applicable law, ensure that their privacy policies >exclude persons > who are not United States citizens or lawful >permanent residents > from the protections of the Privacy Act regarding >personally > identifiable information. > > Member of the European Parliament (MEP) Jan Philipp >Albrecht immediately > tweeted ><https://twitter.com/JanAlbrecht/status/824553962678390784> >that > the European Commission must suspend Privacy Shield and >sanction the US > for breaking the Umbrella Agreement. To the many experts >at CPDP, the > situation was less clear-cut. Much of the conference’s >closing > discussion, the Caspar Bowden panel on Privacy Shield >and Mass > Surveillance, focused on it. > > The executive order places three things at risk: Privacy >Shield, the > EU-US Umbrella Agreement, and the EU-US Passenger Name >Records (PNR) > Agreement. > > The Umbrella Agreement is a framework for transferring >law enforcement > data from the EU to the US, and was created under the >Judicial Redress > Act (JRA). Passed in 2015 as an enabler for Privacy >Shield, the JRA > gives citizens from the EU and its member countries >limited rights under > the US Privacy Act. The Umbrella Agreement and the list >of EU countries > were published in the Federal Register on 23 January >2017. Because the > pre-conditions have now been met, a data protection >lawyer Peter Swire, > speaking at CPDP, said that the Umbrella Agreement will >enter into force > on 1 February. > > [] > > > > Alberto > > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

Feb. 10, 2017

Passeggeri, marinai o navigatori dell'oceano digitale?

by Enrico Nardelli

Passeggeri, marinai o navigatori dell'oceano digitale? Il ruolo della formazione informatica per scuola e società http://www.ilfattoquotidiano.it/2017/02/09/internet-e-nuove-tecnologie-pass… -- EN ===================================================================== Prof. Enrico Nardelli Dipartimento di Matematica - Universita' di Roma "Tor Vergata" Via della Ricerca Scientifica snc - 00133 Roma tel: +39 06 7259.4204 fax: +39 06 7259.4699 mobile: +39 335 590.2331 e-mail: nardelli(a)mat.uniroma2.it home page: http://www.mat.uniroma2.it/~nardelli blog: http://www.ilfattoquotidiano.it/blog/enardelli/ ===================================================================== --

Feb. 10, 2017

[Call for Papers] InfoSec2017 in Bratislava, Slovakia | June 29-July 1, 2017

by FABIO NASCIMBENI

InfoSec2017 Invitation CALL FOR PAPERS and PARTICIPATION in The Third International Conference on Information Security and Cyber Forensics (INFOSEC2017) to be hosted by Faculty of Management, Comenius University in Bratislava, Slovakia on June 29-July 1, 2017. The event will be held over three days, with presentations delivered by researchers from the international community, including presentations from keynote speakers and state-of-the-art lectures. Conference Website: http://sdiwc.net/conferences/3rd-international-conference-information-secur… Email: infosec17(a)sdiwc.net<mailto:infosec17@sdiwc.net> Submission Deadline: May 19, 2017 The conference welcomes papers on the following (but not limited to) research topics: ***Cyber Security -Distributed and Pervasive Systems Security -Enterprise Systems Security -Formal Methods Application in Security -Hardware-Based security -Incident Handling and Penetration Testing -Legal Issues -Multimedia and Document Security -Operating Systems and Database Security -Privacy Issues -SCADA and Embedded systems security -Secure Software Development, Architecture and Outsourcing -Security for Future Networks -Security in Cloud Computing -Security in Social Networks -Security of Web-based Applications and Services -Security protocols -VOIP, Wireless and Telecommunications Network Security ***Digital Forensic -Anti-Forensics and Anti-Forensics Techniques -Cyber-Crimes -Data leakage, Data protection and Database forensics -Evidentiary Aspects of Digital Forensics -Executable Content and Content Filtering -File System and Memory Analysis Multimedia Forensic -Forensics of Virtual and Cloud Environments -Information Hiding -Investigation of Insider Attacks -Large-Scale Investigations -Malware Forensics and Anti-Malware techniques -Network Forensics and Traffic Analysis Hardware Vulnerabilities and Device Forensics -New threats and Non-Traditional Approaches ***Information Assurance and Security Management -Business Continuity & Disaster Recovery Planning -Corporate Governance -Critical Infrastructure Protection -Decidability and Complexity -Digital Rights Management and Intellectual Property -Protection Economics of Security -Fraud Management -Identity Management -Laws and Regulations -Security Policies and Trust Management -Threats, Vulnerabilities, and Risk Management ***Cyber Peacefare and Physical Security -Authentication and Access Control Systems -Biometrics Applications -Biometrics standards and standardization -Cyber Peacefare Trends and Approaches -Electronic Passports, National ID and Smart Card Security -New theories and algorithms in biometrics -Social Engineering -Surveillance Systems -Template Protection and Liveliness Detection Best Regards, Sandra Evans Conference Manager, The Society of Digital Information and Wireless Communications (SDIWC) 20/F, Tower 5, China Hong Kong City, 33 Canton Road, Tsim Sha Tsui, Kowloon, Hong Kong Fabio Nascimbeni Assistant Professor of eLearning Innovation Director of the Telefónica-UNIR Chair in Digital Society and Education UNIR Research Vicerrectorado de Transferencia y Tecnología Universidad Internacional de La Rioja (UNIR)

Feb. 10, 2017

Parenting for a Digital Future – Digital skills matter in the quest for the ‘holy grail’

by J.C. DE MARTIN

http://blogs.lse.ac.uk/parenting4digitalfuture/2017/02/07/digital-skills-ma… (Sent from my wireless device; please excuse brevity and typos (if any))

Feb. 10, 2017

Diffamazione: Facebook non è stampa

by Carlo Melzi d'Eril

Carissimi, mi permetto di segnalare un pezzetto a firma di Silvia Vimercati e mia uscito sul sito del Sole. Buona serata a tutti, Carlo http://www.ilsole24ore.com/art/norme-e-tributi/2017-02-08/diffamazione-faceb ook-non-e-stampa--161559.shtml?uuid=AEkN30Q avv. Carlo Melzi d'Eril ACCMS STUDIO LEGALE via Podgora 13 20122 Milano t. +39 02 54107715 f. +39 02 54114827 carlo.melzi(a)accms.it carlo.melzideril(a)cert.ordineavvocatimilano.it Nota di riservatezza : Il presente messaggio e gli eventuali allegati contengono informazioni strettamente riservate. Esso è riservato esclusivamente al destinatario sopra indicato, il quale è l'unico autorizzato ad usarlo, copiarlo e, sotto la propria responsabilità, diffonderlo. Si segnala, a chiunque ricevesse questo messaggio per errore o comunque ne avesse conoscenza senza averne titolo, che trattenerlo o divulgarlo a persone diverse dal destinatario è proibito. Grazie.

Feb. 9, 2017

Presentazione a Roma di "Università Futura"

by de petra giulio

Informo nexiane/i che siano a Roma il 23 febbraio (o che vogliano venirci per l'occasione...), che Il CRS ha organizzato una presentazione del libro di Juan Carlos "Università Futura". La presentazione si svolgerà nella sala ISMA del Senato a piazza Capranica 27 alle 16. Discuteranno del libro, insieme ai partecipanti, Walter Tocci, Carlo Batini, Paolo Rossi e Francesco Raparelli. A questo indirizzo tutti i dettagli. http://www.centroriformastato.it/universita-futura-democrazia-bit/ Per comunicare la propria partecipazione basta scrivere a roberto.angelini(a)senato.it Giulio

Feb. 9, 2017