Chapter 9 – Security, Privacy, Ethics & Ergonomics

• Four pillars shaped by pervasive technology use:
- Privacy – threats to personal data collection/use & individual strategies to stay safe.
- Security – technical / behavioral controls to protect hardware, software, data.
- Ethics – moral impact of individual & corporate actions on society.
- Ergonomics – science of comfort, efficiency, safety in workplace design (e.g., chair height, keyboard angle).
• Technology’s impact is double-edged: great productivity & access to information, yet new avenues for abuse, injury, social harm.

• Security = protection of individuals / orgs from theft, danger, unauthorized access.
• Hacker = person seeking unauthorized access; intent can be malicious or merely exploratory.
• Cybercrime / computer crime:
- Requires a computer & network as tool, target, or place of evidence.
- Affects $400\ \text{million}$ + people annually; global cost exceeds $400\ \text{billion}$ each year.

• Written by “crackers” (criminal hackers); spreading malware is a federal offense under the Computer Fraud & Abuse Act.
• Key categories:
- Virus – attaches to legitimate programs & travels across networks.
- Worm – self-replicates to clog memory, disk, or bandwidth.
- Trojan Horse – masquerades as legitimate software; opens a backdoor.
- Zombie – infected machine remotely controlled to launch attacks (e.g., botnets).

• Denial-of-Service (DoS): flood a server with bogus requests, slowing or halting service.
• Rogue Wi-Fi Hotspots: fake “free” networks harvesting log-ins, credit-card data.
• Data Manipulation: intruder changes data or leaves prank messages.
• Internet Scams & Social Engineering:
- Identity Theft – illegal assumption of another’s identity for economic gain.
- Cyber-bullying – online harassment intended to harm.
- Phishing – spoof e-mails / websites to steal credentials.
- Numerous sub-types (auction fraud, romance fraud, Nigerian “ $419$ ” scams, etc.).

• Restricting Access
- Biometric scanning (fingerprint, iris) = unique physical traits.
- Passwords; beware of “dictionary attacks” (software submits thousands of words sequentially).
• Automated Defenses
- Security Suites – bundled anti-virus, firewall, anti-spam, etc.
- Firewalls – buffer between private network & internet.
- Password Managers – create & store strong, unique passphrases.
• Encryption (data converted to unreadable cyphertext unless key is known)
- E-mail, file, and website encryption (HTTPS).
- VPN – secures traffic between remote users & corporate LANs.
- Wireless: WPA2 the current standard.
• Anticipating Disasters / Data Loss
- Physical security for hardware; data security for software.
- Disaster-Recovery Plan – procedures to maintain operations after fire, flood, etc.
- Preventative steps: frequent backups, redundant storage, off-site/cloud copies (e.g., Carbonite).

• Privacy = right to control data about oneself.
• Three intertwined issues:
- Accuracy – collectors must ensure data are correct & secure.
- Property – ownership rights over data & software.
- Access – who controls data & under what conditions may it be used.

• $90\%$ of all extant digital data created within last $2$ years.
• Collected daily by gov’t agencies, telcos, credit-card firms, supermarkets, banks, search engines, social networks.
• Information Resellers/Brokers compile & sell electronic profiles.
• Issues:
- Harvesting publicly visible yet identifying data (e.g., Google Street View).
- Non-consensual sharing → identity theft.
- Inaccurate data → mistaken identity.
- Freedom of Information Act grants citizens inspection of gov’t records.

• Employee-monitoring software tracks e-mail, keystrokes, browsing; currently legal.
• Proposed legislation may necessitate employee notification or forbid certain monitoring practices.

• Browsers cache sensitive info locally:
- History Files (list of visited URLs).
- Temporary Internet Files / Browser Cache (HTML, images).
- Cookies (first-party vs third-party “tracking” cookies).
• Privacy Modes (Chrome “Incognito,” Safari “Private”) avoid local history & cookie retention.
• Additional threats:
- Web Bugs – invisible graphics that phone home when e-mail/web page is opened.
- Spyware – secretly logs sites visited, injects ads, records keystrokes.
- Keystroke Loggers – hardware/software that records every key press.
- Anti-spyware utilities detect/remove such threats.

• Online Identity = sum of user-generated content (posts, photos, comments) archived indefinitely by the Web.
• Major U.S. laws:
- Gramm-Leach-Bliley Act – protects personal financial info.
- HIPAA – safeguards medical records.
- FERPA – limits disclosure of student educational records.

• Ethics = standards of moral conduct; Computer Ethics = acceptable use guidelines.
• Copyright grants creators exclusive control over distribution of original works (text, art, music, software).
• Software Piracy = unauthorized copying/distribution; DRM technologies attempt to enforce rights.
• Digital Millennium Copyright Act (DMCA) criminalizes circumvention of DRM.
• Plagiarism = presenting another’s ideas/words as one’s own without attribution; detection tools (Turnitin, SafeAssign) assist educators.

• Ergonomics integrates comfort, efficiency, safety into device/furniture design.
• Physical ailments:
- Repetitive Strain Injury (RSI), tendonitis, Carpal Tunnel Syndrome (CTS).
- Computer Vision Syndrome (CVS).
• Computer Addiction Indicators:
- Craving computer time; euphoria while online; inability to stop; irritability offline; neglected relationships; work/school issues.

• Online forums/comments historically allow anonymous posts → misuse (harassment, stalking, reputation damage).
• Societal debate: balance free speech with accountability & safety.

• Define: privacy; online identity; security; cybercrime & malware (virus, worm, Trojan, zombie); DoS; rogue Wi-Fi; data manipulation; identity theft; internet scams; cyber-bullying.
• Explain protections: access restriction, encryption, disaster planning, backup.
• Articulate ethics concepts: copyright, DRM, software piracy, plagiarism.