Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Introduction:

The rapid advancement of artificial intelligence (AI) is reshaping various industries, and higher education is no exception. AI technologies, such as machine learning and natural language processing, hold great potential for transforming the landscape of teaching, learning, and administrative processes. However, with this transformative power comes the need for careful consideration of ethical implications, data privacy, and security challenges.

In this article, we delve into the multifaceted domain of AI in higher education, exploring its ethical considerations, privacy concerns, and security implications. While our focus lies within the context of Texas higher education, many of the insights and discussions presented here are applicable to institutions and organizations beyond state borders.

The transformative impact of AI in higher education is undeniable. AI applications, such as personalized learning, data analytics, and automation, have the potential to revolutionize the way students learn, educators teach, and institutions operate. By leveraging AI technologies, institutions can enhance student experiences, optimize administrative processes, and improve decision-making.

However, responsible implementation of AI is paramount. It is crucial to address the ethical considerations associated with AI in higher education and beyond. Ensuring the responsible and ethical utilization of AI technologies requires thoughtful examination of algorithmic biases, transparency, and accountability. By embracing ethical guidelines and frameworks, institutions can mitigate potential risks and maximize the positive impact of AI.

Moreover, the privacy and security of data in AI systems demand careful attention. With the integration of AI technologies, institutions handle vast amounts of sensitive information. Safeguarding data privacy and protecting against cybersecurity threats are critical to maintaining trust and compliance with relevant regulations.

To engage our readers in this exploration of AI in higher education, let us begin with an anecdote that illustrates the real-world implications of AI. Imagine a student experiencing a personalized learning journey, tailored to their unique needs and learning style, powered by AI algorithms. This scenario captures the potential of AI to revolutionize education and foster student success.

In the following sections, we will delve into key aspects related to AI in higher education. We will analyze the ethical, legal, and societal implications of AI deployment, discuss privacy and confidentiality concerns, examine the impact on academic integrity, and address the dual role of AI in cybersecurity. Throughout this article, we will provide insights, examples, and considerations to promote responsible and informed integration of AI technologies in higher education.

By exploring these topics, we aim to shed light on the challenges and opportunities that AI presents in the context of higher education. While our focus is on Texas institutions, the principles discussed can be applied to institutions worldwide. Together, let us navigate the complex terrain of AI in higher education, ensuring that it serves as a force for positive change, respecting ethics, privacy, and security.

Analysis:

In this section, we delve deeper into the multifaceted domain of AI in higher education. We undertake a comprehensive analysis of the ethical, legal, and societal implications of AI deployment, as well as its impact on privacy, confidentiality, and academic integrity. By exploring these critical aspects, we aim to shed light on the challenges and opportunities that AI presents in the context of higher education, emphasizing the importance of responsible and informed integration of AI technologies.

1. Privacy and Confidentiality:

2. Freedom of Information Act (FOIA)

The Freedom of Information Act (FOIA) plays a significant role in ensuring transparency and access to information in public institutions. As artificial intelligence (AI) becomes more integrated into higher education, it raises important considerations regarding the application of FOIA to AI-generated content and decision-making processes.

Under FOIA, members of the public have the right to request access to records held by public institutions. These records can include written documents, emails, reports, and other forms of information. However, the increasing use of AI systems and algorithms in generating content and making decisions poses unique challenges for FOIA compliance.

In the context of AI, questions arise regarding:

• The ownership of AI-generated content and the ability to disclose the underlying data and algorithms used in decision-making processes.
• The authenticity and source of the information as AI systems have the capability to generate text and responses.

Public institutions must grapple with how to navigate FOIA requirements while incorporating AI technologies. It is crucial to ensure that AI-generated content and decision-making processes are appropriately accounted for under FOIA regulations, allowing for transparency and access to information.

To address these challenges, public institutions need to:

• Develop clear guidelines and policies regarding the disclosure and transparency of AI-generated content and decision-making processes.
• Establish mechanisms to:
  • Identify and attribute AI-generated content.
  • Maintain records of AI system activities.
  • Ensure compliance with FOIA requirements.

Moreover, collaboration between public institutions, AI developers, and legal experts is essential to establish best practices and guidelines for FOIA compliance in the AI era. By working together, we can strike a balance between leveraging the benefits of AI technologies and upholding the principles of transparency and accountability that FOIA embodies.

Maintaining transparency and compliance with FOIA requirements in the context of AI integration requires careful consideration, clear guidelines, and collaborative efforts. This ensures responsible use of AI technologies while upholding the principles of transparency, access to information, and accountability.

3. Intellectual Property Ownership:

In the realm of artificial intelligence (AI), the question of intellectual property ownership becomes increasingly complex. As AI systems generate content, create innovative solutions, and produce valuable outcomes, it is essential to consider the ownership rights associated with these creations.

1. Factors to Consider in Intellectual Property Ownership:
   • Involvement of human creators
   • Level of autonomy and creativity exhibited by the AI system
   • Purpose and use of the AI-generated content
2. Role of Human Input:
   • AI systems often rely on extensive training data provided by human creators.
   • Shared ownership or joint authorship can be argued between the AI system and human creators when human input is involved.
3. Autonomously Generated Content:
   • As AI technologies advance, there may arise instances where AI systems generate content entirely autonomously.
   • Ownership becomes more complex in such cases, requiring careful examination and deliberation.
4. Purpose and Use of AI-Generated Content:
   • Ownership rights and licensing agreements become crucial if the content is created for commercial purposes or used in a way that generates economic value.
   • Clear policies and agreements should be established regarding ownership and use of the AI-generated content.
5. Reevaluation of Intellectual Property Laws and Regulations:
   • The evolving nature of AI technologies calls for a reevaluation of existing intellectual property laws and regulations.
   • Legal frameworks must adapt to encompass the unique challenges posed by AI-generated works.
   • Collaboration among policymakers, legal experts, and stakeholders is necessary to establish guidelines and regulations that balance innovation and protection of intellectual property rights.

In conclusion, intellectual property ownership in the realm of AI is a complex and evolving landscape. The involvement of human creators, the level of autonomy exhibited by AI systems, and the purpose and use of AI-generated content all influence the determination of ownership rights. It is essential for organizations, institutions, and policymakers to address these challenges and establish clear frameworks that uphold the principles of fairness, innovation, and protection of intellectual property rights as AI technologies continue to advance.

4. Regulations and Compliance:

Compliance with regulatory requirements is an important consideration when deploying or using AI technology in the field of higher education. In the United States, various laws and regulations govern the use of AI and the protection of sensitive information. Some key regulations to consider include:

• The Family Educational Rights and Privacy Act (FERPA):
  • Establishes guidelines for the privacy and security of student educational records.
  • Requires educational institutions to ensure proper protection and disclosure of personally identifiable information (PII).
• The Health Insurance Portability and Accountability Act (HIPAA):
  • Sets forth regulations for the protection of personal health information.
  • Compliance with HIPAA is crucial when AI systems handle health-related data.
• The Children’s Online Privacy Protection Act (COPPA):
  • Imposes obligations on operators of websites or online services when collecting data from children under 13.
  • Compliance with COPPA ensures appropriate consent and handling of children’s data.

At the state level, it is important to consider specific regulations that may impact AI deployment in higher education. In the State of Texas:

• Currently, there are no specific laws or regulations addressing the use of AI.
• Provisions in the Texas Government Code and Texas Administrative Code regarding data and system safeguards may apply to interactions with AI technology.

Furthermore, the proposed Texas House Bill 2060 (HB 2060) introduces the Artificial Intelligence Advisory Council, responsible for studying and monitoring AI systems in state agencies. The bill aims to:

• Protect privacy, prevent discrimination, and promote the development of ethical AI systems.
• It underscores the need for institutions to stay informed about emerging regulations and ethical considerations in the field of AI.

By ensuring compliance with relevant regulations and staying abreast of legal developments, higher education institutions can navigate the complex landscape of AI deployment while protecting the privacy and interests of their stakeholders.

5. Data Retention and Destruction:

6. Academic Integrity:

Maintaining academic integrity is a fundamental pillar of higher education, ensuring fairness, honesty, and ethical conduct among students and faculty. As artificial intelligence (AI) becomes more prevalent in educational settings, it is essential to examine how AI impacts academic integrity and explore strategies to uphold its principles.

• Bias and Fairness: AI algorithms are not immune to biases, which can have significant implications in the context of academic integrity. It is crucial to examine the potential biases present in AI algorithms and address fairness concerns. Particularly in areas such as admissions, grading, and student support systems, it is essential to ensure that AI applications are fair, transparent, and accountable. By proactively identifying and mitigating biases, institutions can uphold academic integrity and provide equal opportunities to all students.

• Plagiarism Detection: AI technologies have revolutionized the detection of plagiarism, allowing institutions to identify instances of academic dishonesty more efficiently. AI-powered plagiarism detection tools can analyze vast amounts of text and compare them against existing sources to identify potential cases of plagiarism. These tools play a crucial role in preserving the integrity of academic work and promoting a culture of originality and attribution.
• Enhancing Assessment Practices: AI can also enhance assessment practices by providing automated grading and feedback systems. Through machine learning algorithms, AI systems can analyze student responses and provide personalized feedback, helping educators identify areas of improvement and fostering a supportive learning environment. However, it is important to strike a balance between automated assessment and human involvement to ensure the integrity of evaluations.

• Student Well-being and Support: AI has the potential to play a significant role in student support services and promoting student well-being. AI-powered chatbots and virtual assistants can provide round-the-clock support, offering resources, guidance, and answers to common questions. Additionally, AI can contribute to mental health counseling by identifying patterns and alerting professionals to potential concerns. Personalized interventions based on AI analysis can support students’ holistic development, fostering their well-being and academic success.

By addressing these ethical considerations and integrating AI in a responsible manner, higher education institutions can leverage the benefits of AI while upholding the principles of academic integrity. It requires an ongoing commitment to monitor and evaluate AI systems, ensure fairness and transparency, and provide comprehensive support to students throughout their educational journey.

7. Ethical and Social Considerations:

As we delve into the multifaceted domain of AI in higher education, it is crucial to explore the ethical and social considerations that arise with its implementation. Beyond the technical aspects, AI has profound implications for society, and it is essential to examine its broader impact. In this section, we will discuss some key ethical and social considerations associated with AI in higher education.

• Ethical Decision-Making: AI systems in higher education raise questions about the ethical decision-making process. As AI algorithms make decisions that affect students and faculty, it is essential to ensure transparency, accountability, and the alignment of AI outcomes with ethical principles. This highlights the need for the development and implementation of clear ethical guidelines and frameworks to guide the responsible development and deployment of AI systems.
• Privacy and Data Protection: The extensive use of AI in higher education involves the collection, processing, and analysis of large amounts of data, which raises concerns about privacy and data protection. It is crucial to emphasize the importance of implementing robust data privacy regulations, obtaining informed consent, and employing secure data handling practices to safeguard the personal information of students, faculty, and staff.
• Social Impact: AI’s influence extends beyond the educational context, necessitating a comprehensive examination of its broader societal implications. It is important to explore the potential impact of AI in higher education on employment, workforce readiness, and equitable access to education. By understanding these social implications, we can shape AI strategies that contribute positively to society and foster equitable educational opportunities for all.
• Bias and Fairness: AI algorithms can perpetuate biases if not developed and deployed with care. By thoroughly examining the potential biases in AI algorithms, we can emphasize the importance of promoting fairness in AI applications, particularly within admissions, grading, and student support systems. It is essential to explore strategies for mitigating bias and ensuring fairness in AI-driven processes to uphold principles of equality and fairness in education.
• Student Well-being and Support: The application of AI in student support services offers potential for personalized interventions and enhanced mental health counseling. This prompts a focused discussion on the role of AI in promoting student well-being and academic success. It is crucial to address concerns surrounding the responsible use of personal information and strike a balance between AI-driven interventions and the need for human connection and support to create a holistic and supportive educational environment.

By addressing these ethical and social considerations, we can foster responsible and inclusive AI practices in higher education. It is vital to navigate the ethical complexities, promote transparency, and ensure that AI technologies align with the values and goals of higher education institutions and society as a whole.

8. Ethical Guidelines and Frameworks:

9. Collaboration and Partnerships:

10. Accountability and Transparency:

11. The Dual Role of AI in Cybersecurity: Defense and Offense:

12. Security Controls and Challenges for Defending Against AI Attackers in Higher Ed:

Implementing effective security controls to defend against AI attackers poses unique challenges in the higher education sector. In addition to the general challenges discussed earlier, higher education institutions face specific difficulties that require careful consideration:

• Limited Funding: Higher education institutions often face budgetary constraints, making it challenging to allocate sufficient resources for robust cybersecurity measures. Implementing advanced security controls, including AI-based solutions, requires adequate funding to ensure comprehensive protection.
• Governance and Compliance: Higher education institutions operate in a complex governance landscape with multiple stakeholders, regulatory requirements, and privacy considerations. Aligning security controls with governance frameworks, data protection regulations, and compliance standards can be demanding and time-consuming.
• Diverse IT Environment: Higher education institutions typically have diverse IT environments that include academic departments, research centers, administrative systems, and student networks. Coordinating security controls across these diverse systems and networks, each with its unique requirements, adds complexity to the implementation process.
• Limited Security Expertise: Cybersecurity expertise, particularly in the field of AI defense, can be scarce in higher education institutions. The shortage of skilled professionals and cybersecurity specialists hampers the implementation of advanced security controls and the ability to respond effectively to AI-based attacks.
• Balancing Openness and Security: Higher education institutions value open access to information and collaboration, which can potentially conflict with stringent security measures. Striking a balance between maintaining an open academic environment and implementing robust security controls is a challenge that requires careful consideration.
• Cultural Resistance to Change: Implementing new security controls, especially those involving AI technologies, may face resistance from faculty, staff, and students. Addressing cultural barriers and promoting a security-conscious culture within the institution requires proactive communication and awareness campaigns.
• Legacy Systems and Infrastructure: Higher education institutions often have legacy systems and infrastructure that may lack compatibility with modern security controls. Upgrading or integrating these systems to support AI-based security solutions can be costly and time-consuming.
• Research Collaboration and Data Sharing: Higher education institutions are hubs of research collaboration and data sharing. Ensuring secure data sharing practices, protecting intellectual property, and managing the security risks associated with collaborative projects present additional challenges for implementing effective security controls.

Despite these challenges, it is essential for higher education institutions to prioritize cybersecurity and implement robust security controls to defend against AI attackers. By addressing the specific difficulties faced by the sector and leveraging AI-based security solutions, institutions can enhance their resilience, protect sensitive data, and safeguard their academic environments.

Collaboration with industry partners, cybersecurity organizations, and government agencies can provide valuable insights, expertise, and resources to navigate these challenges. Sharing best practices, threat intelligence, and collaborating on defensive strategies can strengthen the overall security posture of higher education institutions.

In conclusion, higher education institutions must proactively address the unique challenges of defending against AI attackers. By considering the specific difficulties faced by the sector, investing in adequate resources, fostering a security-conscious culture, and leveraging collaboration, institutions can establish robust security controls and protect their valuable data and academic environments.

Summary and Conclusions:

In this comprehensive examination of AI in higher education, we have explored various aspects and implications of integrating artificial intelligence technologies in academic institutions. Throughout the article, we have analyzed ethical, legal, societal, and technical considerations, with a focus on privacy, intellectual property, regulations, academic integrity, and cybersecurity. Let’s summarize the key points and conclusions:

• Privacy and Confidentiality: Protecting the privacy and confidentiality of students, faculty, and staff is crucial when deploying AI technologies. Institutions should implement robust data governance frameworks, ensure transparency, and address algorithmic biases to maintain trust and compliance with ethical standards.
• Freedom of Information Act (FOIA): The application of FOIA to AI-generated content and decision-making processes poses unique challenges. Public institutions need to navigate FOIA requirements while incorporating AI technologies, establishing clear guidelines, and fostering transparency and access to information.
• Intellectual Property Ownership: Determining intellectual property ownership in the realm of AI is complex. Factors such as human input, AI autonomy, and purpose of AI-generated content influence ownership rights. Institutions must establish clear policies and agreements to protect the rights of all stakeholders involved.
• Regulations and Compliance: Compliance with relevant regulations is essential in AI deployment. Institutions should ensure adherence to laws like FERPA, HIPAA, COPPA, and state-specific regulations. Staying informed about emerging regulations, such as Texas House Bill 2060 (HB 2060), is crucial for responsible AI integration.
• Data Retention and Destruction: Responsible data management is vital for AI systems. Institutions should prioritize privacy, regulatory compliance, and effective data handling practices. Robust data governance and secure storage and retrieval mechanisms ensure the ethical use of AI technologies.
• Academic Integrity: AI technologies have implications for maintaining academic integrity. Addressing biases and ensuring fairness, leveraging AI for plagiarism detection, enhancing assessment practices, and supporting student well-being are key considerations for upholding academic integrity.
• Ethical and Social Considerations: The ethical and social impact of AI in higher education is significant. Exploring potential biases, examining social implications, and promoting fairness, transparency, and well-being contribute to responsible AI practices.
• Collaboration and Partnerships: Collaborative efforts between higher education institutions, industry partners, and government agencies play a crucial role in addressing ethical challenges, sharing best practices, and fostering innovation in AI. Partnerships promote collective expertise, resources, and effective solutions.
• Accountability and Transparency: Ensuring accountability, explaining AI decision-making processes, and addressing algorithmic accountability are essential. Institutions must promote transparency, establish guidelines, and uphold ethical principles to build trust and maintain transparency in AI systems.
• The Dual Role of AI in Cybersecurity: AI plays a dual role in cybersecurity, both in defense and offense. Leveraging AI technologies for proactive defense measures while being aware of the potential for AI-based attacks is critical. Implementing security controls, staying vigilant, and fostering a security-conscious culture are necessary steps.

In conclusion, the integration of AI in higher education offers immense opportunities and challenges. By considering the ethical, legal, societal, and technical aspects discussed in this article, institutions can navigate the complexities and harness the potential of AI while upholding principles of privacy, integrity, and transparency. Striking a balance between technological advancement and ethical responsibility is key to leveraging AI’s transformative power for the betterment of higher education and society as a whole.

Recommendations for AI Integration in Higher Education:

As higher education institutions embrace the integration of artificial intelligence (AI) technologies, it is crucial to consider the recommended next steps for responsible and effective implementation. While this article maintains an organization-agnostic approach, the following recommendations can guide institutions in their journey towards leveraging AI in higher education:

1. Develop AI Governance Frameworks: Establish comprehensive AI governance frameworks that encompass ethical guidelines, data privacy policies, and compliance measures. These frameworks should address the responsible use of AI, algorithmic transparency, data governance, and accountability for AI-related decisions.
2. Foster Ethical Awareness and Education: Promote ethical awareness and education among faculty, staff, and students. Offer training programs and workshops that highlight the ethical considerations associated with AI, ensuring that individuals understand the potential biases, privacy concerns, and social implications of AI applications.
3. Invest in Data Governance and Security: Strengthen data governance and security practices to protect sensitive information. Implement robust data protection measures, including encryption, access controls, and regular security audits. Establish data retention and destruction policies that align with privacy regulations.
4. Collaborate with Industry and Research Partners: Foster collaborations and partnerships with industry experts, research institutions, and technology providers. These collaborations can facilitate knowledge exchange, share best practices, and encourage innovation in AI applications for higher education.
5. Continuously Monitor and Evaluate AI Systems: Implement mechanisms to continuously monitor and evaluate AI systems. Regularly assess the performance, accuracy, and fairness of AI algorithms. Monitor data quality and address biases that may arise over time.
6. Emphasize Transparency and Explainability: Prioritize transparency and explainability in AI systems. Ensure that AI-generated decisions and outcomes are clearly communicated to stakeholders. Provide understandable explanations for how AI algorithms work and how decisions are made.
7. Engage in Policy and Regulatory Discussions: Participate in policy and regulatory discussions surrounding AI in higher education. Contribute to the development of guidelines, standards, and legislation that promote ethical AI practices, protect privacy, and ensure fairness.
8. Foster a Culture of Innovation and Collaboration: Cultivate a culture of innovation and collaboration within the institution. Encourage faculty, staff, and students to explore AI applications, contribute to research and development, and share insights and best practices.
9. Continuously Evolve and Adapt: Embrace the dynamic nature of AI technologies and continuously evolve and adapt strategies accordingly. Stay informed about emerging trends, advancements, and ethical considerations in the field of AI. Remain flexible and ready to adapt to new challenges and opportunities.

By following these recommended next steps, higher education institutions can harness the potential of AI while ensuring ethical, responsible, and impactful integration. The journey towards leveraging AI in higher education requires a multidimensional approach, with a focus on governance, collaboration, transparency, and continuous improvement.

Remember, each institution’s path will be unique, and it is essential to tailor these recommendations to fit specific organizational contexts and goals. With a thoughtful and strategic approach, higher education institutions can navigate the complexities of AI, contribute to innovation in education, and provide enhanced learning experiences for their students.

Authors Totally Unsolicited Comments:

Greetings, dear reader. Let’s embark on a grounded and fact-based exploration of AI together. In today’s fast-paced world, it’s crucial for all of us to familiarize ourselves with AI technologies. By doing so, we equip ourselves with the skills and insights to navigate the digital landscape effectively and embrace the future.

AI holds remarkable potential to revolutionize various aspects of our lives, including education, healthcare, industry, and beyond. Understanding AI enables us to harness its power, make informed decisions, and recognize the exciting opportunities and challenges it presents.

As we venture into the fascinating world of AI, let’s set aside any unwarranted fears and begin embracing this transformative technology. With a balanced perspective, we can appreciate the advancements AI brings while also being mindful of the ethical considerations it raises.

By staying informed, engaging in meaningful discussions, and fostering a deeper understanding, we become active participants in shaping a future where technology and humanity can progress together to everyone’s benefit.

In short, AI technology, by all current measures and standards, is going to continue advancing at a rapid pace. Unfortunately, for many who delay adopting the necessary skills or hope to “stand against the tide” until the last possible moment, there is a risk of being swept away or falling behind to a point where grasping the broad and expansive scope of AI advancements becomes challenging.

Let’s not miss out on the notable opportunities AI presents. By getting onboard with AI and actively acquiring the skills and knowledge needed, we can position ourselves for success in this rapidly evolving technological landscape.

References:

Ali, S., Irfan, M., & Murray, L. (n.d.). Integration of Artificial Intelligence in Academia: A Case Study of Critical Teaching and Learning in Higher Education. Global Social Sciences Review (GSSR). Retrieved June 18, 2023, from https://www.humapub.com/admin/alljournals/gssr/papers/SbiE3AUz6e.pdf

Bifet, A. (2023, March 29). ChatGPT – generating text and ethical concerns. Science and Learning Hub web. Retrieved June 6, 2023, from https://www.sciencelearn.org.nz/resources/3230-chatgpt-generating-text-and-ethical-concerns

Calhoun, V. A. (2023, May 23). The Future of Higher Education – The Rise of AI and ChatGPT on Your Campus. NASPA Web. Retrieved June 18, 2023, from https://www.naspa.org/blog/the-future-of-higher-education-the-rise-of-ai-and-chatgpt-on-your-campus

Capriglione (2023, May 3). TX HB2060 | 2023-2024 | 88th Legislature. LegiScan. Retrieved June 1, 2023, from https://capitol.texas.gov/tlodocs/88R/billtext/html/HB02060I.htm

Cardona, M. (2023, June 6). When Bad Guys Use AI and ML in Cyberattacks, What Do You Do? Security Roundtable web. Retrieved June 6, 2023, from https://securityroundtable.org/when-bad-guys-use-ai-and-ml-in-cyberattacks-what-do-you-do/

Credo, J., & Ingram, J. (2021, August 28). Perspective Developing Successful Collaborative Research Partnerships with AI/AN Communities. MDPI Web. Retrieved June 18, 2023, from https://www.mdpi.com/1660-4601/18/17/9089

Fernandez, S. (2022, December 3). ChatGPT: Who Owns the Content Generated? The Junto Gazette. Retrieved June 1, 2023, from https://blog.juntolaw.com/who-owns-the-intellectual-property-rights-in-ai-generated-content/

Grammarly (n.d.). Plagiarism Checker by Grammarly. Retrieved June 6, 2023, from https://www.nbcdfw.com/news/localhttps://www.grammarly.com/plagiarism-checker?

Haasdijk , E. (n.d.). A call for transparency and responsibility in Artificial Intelligence. Deloitte Web. Retrieved June 18, 2023, from https://www2.deloitte.com/nl/nl/pages/innovatie/artikelen/a-call-for-transparency-and-responsibility-in-artificial-intelligence.html

Hudson, B. Columbia Advisory Group (2023). Professional discussion and analysis concerning implications of AI conducted May 31, 2023.

Heikkilä, M. (2023, April 3). Artificial intelligence Three ways AI chatbots are a security disaster. MIT Technology Review. Retrieved June 1, 2023, from https://www.technologyreview.com/2023/04/03/1070893/three-ways-ai-chatbots-are-a-security-disaster/

Heinz, F. (2023, May 19). TAMU-Commerce Instructor Accuses Class of Using ChatGPT on Final Assignments. NBC DFW News. Retrieved June 6, 2023, from https://www.nbcdfw.com/news/local/tamu-commerce-instructor-accuses-class-of-using-chatgpt-on-final-assignments/3260731/

Murugesan, S. (2023, April 24). The Rise of Ethical Concerns about AI Content Creation: A Call to Action. IEEE Computer Society. Retrieved June 6, 2023, from https://www.computer.org/publications/tech-news/trends/ethical-concerns-on-ai-content-creation

OpenAI | ChatGPT web (2023). https://chat.openai.com/.

OpenAI (2023, March 13). Terms of use. Open AI. Retrieved June 1, 2023, from https://openai.com/policies/terms-of-use

Palmer G. Security Notes (2015-2023)

Pazzanese, C. (2020, October 28). Ethical concerns mount as AI takes bigger decision-making role in more industries. The Harvard Gazette Web. Retrieved June 18, 2023, from https://news.harvard.edu/gazette/story/2020/10/ethical-concerns-mount-as-ai-takes-bigger-decision-making-role/

Supra, J. D. (2023, April 7). ChatGPT: Who Owns the Content Generated? JD Supra. Retrieved June 1, 2023, from https://www.jdsupra.com/legalnews/chatgpt-who-owns-the-content-generated-2891692/

Urwin, M. (2023, February 15). 36 Artificial Intelligence Examples Shaking Up Business Across Industries. Built in. Retrieved June 1, 2023, from https://builtin.com/artificial-intelligence/examples-ai-in-industry

West, D., & Allen, J. (2018, April 24). How artificial intelligence is transforming the world. Brookings. Retrieved June 1, 2023, from https://www.brookings.edu/research/how-artificial-intelligence-is-transforming-the-world/

Whitepaper (2022, November 4). Cyber Threat Predictions for 2023, An Annual Perspective by FortiGuard Labs. Fortinet web. Retrieved June 6, 2023, from https://www.fortinet.com/content/dam/fortinet/assets/white-papers/wp-threat-prediction-2023.pdf

Wilson, J., & Daugherty, P. R. (2021, August 28). Collaborative Intelligence: Humans and AI Are Joining Forces. Harvard Business Review. Retrieved June 18, 2023, from https://hbr.org/2018/07/collaborative-intelligence-humans-and-ai-are-joining-forces

Related Content and Articles

Texas DIR Artificial Intelligence (AI) Center of Excellence

Artificial intelligence in higher education: the state of the field

5 Ways Artificial Intelligence Will Transform Higher Education

Educause: Artificial Intelligence in Higher Education: Applications, Promise and Perils, and Ethical Questions

How AI Is Shaping the Future of Higher Ed

Artificial Intelligence in higher education: Texarkana College navigating benefits and challenges for students and staff

ChatGPT: Learning Tool — or Threat? How a Texas College Is Eyeing New AI Program

Texas colleges are concerned about ChatGPT. Here’s how the new AI system changes learning.

Additional Articles

NIST Cybersecurity Framework: Introduction to the NIST CSF

Enhancing Cybersecurity with National Institute of Standards and Technology (NIST)

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Sarbanes-Oxley Act (SOX): Strengthening Financial Reporting and Accountability

Demystifying the Payment Card Industry Data Security Standard (PCI DSS): Safeguarding Cardholder Data in Transactions

Domain Name System (DNS) – Application Layer Protocol

Schema-Based Access Control for SQL Server Databases

Transparency Statement on Artificial Intelligence Collaboration

In the interest of maintaining professional and ethical standards, we want to provide full transparency regarding the role of AI in the creation of this analysis. We acknowledge that OpenAI | ChatGPT, an AI language model, assisted in generating suggestions and providing insights throughout the analysis process. However, it is important to emphasize that the primary research, core content, final analysis, and conclusions were conducted and determined through human actions, interpretation, and decision-making.

The collaboration with ChatGPT served as a valuable tool to enhance our exploration of ideas and considerations. By leveraging AI technologies, we were able to broaden our perspectives and delve deeper into the subject matter. It is worth noting that while ChatGPT contributed to the generation of content, the human researchers maintained full control and responsibility for the research process and final outcomes.

We believe that transparency in disclosing the involvement of AI tools like ChatGPT is essential for fostering open dialogue and promoting responsible utilization of AI in research and analysis. It is through such transparency that we ensure the integrity, credibility, and accountability of our work.

By acknowledging the role of AI and highlighting the human-driven nature of the analysis, we strive to uphold the highest standards of professionalism and ethical conduct in our research endeavors.

Disclaimer

Terms and Conditions of Use

The post Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security appeared first on .

Domain Name System (DNS) – Application Layer Protocol

Introduction:

Domain Name System (DNS) – An Application Layer Protocol for Efficient Name Resolution

The Domain Name System (DNS) is an application-layer protocol that plays a crucial role in the functioning of the World Wide Web (WWW) and other internet services. It enables the translation of human-readable domain names, such as www.zymitry.com, into machine-readable IP addresses. In addition to the World Wide Web, DNS is essential for enabling services such as email, file transfers, and other internet applications. By using DNS, users can navigate the internet using alphanumeric names instead of relying on IP addresses. DNS is an integral part of the application layer protocols, defining how applications on different systems communicate with each other.

Domain Name System and Application Layer Protocols:

An application-layer protocol defines how applications on different systems communicate with each other. In the case of DNS, it specifies the types of messages exchanged, their syntax, the information conveyed, and the rules for sending and responding to these messages. DNS is critical for efficient name resolution and is essential for web browsing, email services, file transfers, and various other applications.

DNS Hierarchical Structure and Name Resolution:

The Domain Name System follows a hierarchical structure that starts with thirteen root servers distributed worldwide. These root servers maintain a database of Top Level Domain (TLD) servers, such as .com, .edu, .net, and .org. The TLD servers, in turn, store information about Authoritative DNS servers, which manage databases of actual host names and their corresponding IP addresses. This hierarchical structure enables efficient and accurate name resolution.

Domain Name System Resource Records (RR):

DNS uses resource records (RR) to store mappings between host names and IP addresses. Each record consists of four fields: Name, Value, Type, and Time To Live (TTL). The Name and Value fields vary based on the record type. For example, an “A” record directly translates a host name to an IP address. Other record types include Name Server (NS) records for resolving DNS server names, Mail Server (MX) records for mail server resolution, and Canonical Name (CNAME) records for mapping IP addresses to host alias names.

DNS Messaging and Protocols:

DNS messages are sent and received over User Datagram Protocol (UDP) port 53. UDP is a lightweight, connectionless protocol used for fast transmission of DNS messages. While UDP does not guarantee message delivery, it is widely used due to its efficiency. TCP port 53 can also be used if UDP is not available, especially in IPv6 environments.

DNS Caching:

DNS caching is a mechanism used to improve DNS lookup efficiency and reduce network traffic. When a DNS resolver receives a DNS response, it stores the mapping between a domain name and its corresponding IP address in its cache. Subsequent requests for the same domain name can be resolved from the cache, eliminating the need for repeated queries to authoritative DNS servers. Caching occurs at different levels, including local DNS resolvers, ISP DNS servers, and web browser caches, helping to speed up the overall DNS resolution process. For example, a local DNS resolver can store frequently accessed domain name-to-IP mappings in its cache, reducing the latency and network traffic associated with querying external DNS servers.

DNS Security:

DNS security is of utmost importance due to the risks associated with DNS spoofing and cache poisoning. DNS spoofing involves falsifying DNS data to redirect users to malicious websites, while cache poisoning involves injecting false information into DNS caches. These attacks can lead to DNS spoofing, where users are directed to deceptive or harmful destinations. To address these risks, DNSSEC (DNS Security Extensions) was introduced. DNSSEC uses digital signatures to verify the authenticity and integrity of DNS responses, providing an additional layer of security and ensuring that users are directed to legitimate and trusted resources.

DNS Load Balancing and Redundancy:

DNS can be used for load balancing by distributing traffic across multiple servers. This helps optimize performance, improve response times, and ensure high availability of services. Various strategies, such as round-robin DNS, geoDNS, and Anycast routing, can be employed to achieve load balancing. Round-robin DNS rotates the order of IP addresses in DNS responses, distributing the load evenly. GeoDNS considers the geographic location of clients and directs them to the nearest server, reducing latency. Anycast routing involves using the same IP address for multiple servers located in different geographic locations, improving scalability and ensuring efficient load distribution. Load balancing provides benefits such as improved scalability, fault tolerance, and optimized resource utilization.

DNS Privacy and Anonymity:

Emerging concerns regarding DNS privacy highlight the need to protect user data and prevent unauthorized access. DNS queries traditionally transmitted in clear text can be intercepted and monitored, compromising privacy. The motivation behind DNS privacy concerns includes protecting user browsing habits, preventing surveillance, and combating censorship. To address these concerns, DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) have been introduced. DoH encrypts DNS queries using the HTTPS protocol, while DoT uses the Transport Layer Security (TLS) protocol. Both mechanisms ensure that DNS queries remain confidential and protected from interception, enhancing privacy and anonymity for users.

Conclusion:

The Domain Name System (DNS) is a critical application-layer protocol that enables the translation of domain names to IP addresses, facilitating seamless internet navigation. Understanding DNS, its hierarchical structure, resource records, and messaging protocols is crucial for managing and optimizing network resources. Moreover, considering enhancements such as caching, security measures, load balancing, and privacy mechanisms further enhances the reliability, performance, and security of DNS in modern network environments.

References

G. Palmer Security Notes (2015-2023)

Gonyea, C. (2010, August 25). DNS: Why It’s Important and How It Works. Retrieved July 5, 2017, from http://dyn.com/blog/dns-why-its-important-how-it-works/.

Hogg, S. (2010, August 22). Allow Both TCP and UDP Port 53 to Your DNS Servers. Retrieved July 5, 2017, from http://www.networkworld.com/article/2231682/cisco-subnet/cisco-subnet-allow-both-tcp-and-udp-port-53-to-your-dns-servers.html.

Kurose, J. F., & Ross, K. W. (2017). Computer networking: a top-down approach (7th ed.). Hoboken, NJ: Pearson.

TechNet DNS. (n.d.). Network Ports Used by DNS. Retrieved July 5, 2017, from Domain Name System (DNS) – An Application Layer Protocol for Efficient Name Resolution. https://technet.microsoft.com/en-us/library/dd197515(v=ws.10).aspx.

Related Articles and Content

Exploring the Implications of Artificial Intelligence

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Understanding Business Continuity Planning

Fortinet: What Is DNS (Domain Name System)?

What is DNS? | How DNS works

Definition,  domain name system (DNS)

Amazon: What is DNS?

Application Layer Protocol

What is the DNS Layer and How Do I Secure It?

Javapoint: DNS

Note: This article has been revised and improved with the assistance of AI, incorporating ChatGTP suggestions and revisions to enhance clarity and coherence. The original research, decision-making, and final content selection were performed by a human author.

Disclaimer

Terms and Conditions of Use

The post Domain Name System (DNS) – Application Layer Protocol appeared first on .

SunSpot Credit Union

Computer Incident Response Team—Access & Authorization Policy

1.0       Policy Statement

This policy applies to SunSpot Credit Union employees, temporary workers, contractors, and consultants who use or access SunSpot Credit Union information systems and computers.

2.0       Purpose/Objectives

Definitions for this policy are as follows:

• SunSpot Credit Union: (SCU).
• Incident Response Team: (IRT). Personnel designated to respond to security incidents.
• Incident Response Policy: (IRP). Establishes Incident Response (IR) procedures for dealing with incidents related to technology and information risk.
• Graham-Leach-Bliley Act: (GLBA).
• Chief Information Office: (CIO).
• Information Security Officer: (ISO).

This document establishes IRT membership, roles, responsibilities, and authority. IRT members and their authority are as follows:

• Information Security Officer (ISO): IRT team leader with authority over all SCU information systems in the event of a security incident. The ISO has the authority to perform any legal action necessary to protect SCU resources and private information, and customer personal and financial information.
• Senior System Administrator: overall responsible for monitoring internal systems and configurations. Designated by the ISO authority to change configurations and take actions as required to protect SCU information resources and customer private and financial information in the event of a security incident. Has the authority to represent and communicate with law enforcement.
• Network Administrator. Works closely with the Senior Systems Administrator. Granted the authority to take networks and systems offline if required to protect SCU information systems, and customer private and financial information.
• Human Resources Director: Granted the authority manage staff regulation and law related matters that may result from a security incident.
• Public Relations Director: Granted the authority to communicate with news and other public entities, stockholders, and other non-legal entities as dictated by the ISO.
• Law Firm: The authority to conduct legal matters related to security incidents per direction of the ISO. Has the authority to represent and communicate with law enforcement.

3.0       Scope

This policy applies to all SCU security domain areas to include computers and devices, SCU system users, security detection systems, firewalls, remote access VPN software and hardware, and applications, that are controlled and operated by SCU staff or its designated IT Infrastructure Implementation Agents, contractors, and vendors, throughout at all branches of SCU, SCU Enterprise Cloud, Web, and Data Center providers, and other offsite facilities.

4.0       Standards

Require compliance with section 501(b) of the Gramm-Leach-Bliley Act (GLB Act).4 and section 216 of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act).5 The Security Guidelines establish standards relating to administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity and the proper disposal of customer information. Specific standards are as follows:

• Develop and maintain an effective information security program.
• Ensure the security of customer information at all times.
• Procedures for notifying customers of confirmed or suspected private information exposure.

5.0       Procedures

Responsible IRT members must consider GLBA standards when responding to incidents. The ISO is responsible for overseeing the development, implementation, and maintenance of this policy. The CIO is responsible for enforcing this policy. The SCU incident response model is as follows:

1. Incident detection. The Senior System Administrator and Network Administrator are responsible for monitoring Intrusion Detection and Prevention Systems (IDS/IDPS), system logs, and maintain communications with the help desk in order to detect possible security incidents. If a possible incident is detected, they will notify the ISO who will determine if the IRT needs to be activated.
2. The ISO will direct team members to implement additional control configurations to stop an attack, secure systems, and begin collecting evidence. Per SCU IRP, the ISO will issue evidence bags, make available electronic collection media, and chain of custody forms. All evidence will be collected and chain of custody maintained per the SCU IRP standards. The ISO and CSU law firm will monitor evidence collection procedures.
3. After evidence collection is complete or to a point where normal operations will not interfere with collection, the ISO will direct team member to recover systems per SCU IRP, Business Continuity Plans (BIA)’s, and other applicable SCU technical and administrative publications and policies.
4. Conduct analysis and debrief. At the ISO direction, the IRT will meet to discuss, evaluate, and make recommendations to prevent future incidents.
5. The ISO will be responsible for constructing and disseminating an incident report based on the IRT analysis of the incident. The report is to be used by HR, the Public Relations Director, and retained law firm for communicating details of the incident and make decisions on possible disciplinary or legal action.
6. Process improvement. Policy updates and additional training as required are to be implemented per the SCU IRP and training policy.

6.0       Guidelines

In the course of business it is inevitable that situations will arise that policy does not specifically address. Guidelines for these issues are as follows:

• Unforeseen security events or conflicts in procedures are to be referred to the ISO for guidance. In the event that the ISO is unavailable, the Senior System Administrator or CIO, dependent on the most senior present, will fulfill the ISO duties.

7.0       Policy Enforcement and Violations

Violations of this policy will be addressed in accordance relevant SCU information security and human resource policies. The appropriate level of disciplinary action will be determined on an individual case basis by the appropriate executive or designee, with sanctions up to or including termination depending upon the severity of the offense. The ISO is responsible for official interpretation of this policy. Questions regarding the application of this policy should be directed to the SCU Information Technology department.

Disclaimer

The post Security Policy Example – IRT Access & Authorization Policy appeared first on .

The Dot Com crash of 2000 and corporate scandals such as Enron highlighted the need for better laws to oversee financial organizations, and also highlighted the need for better corporate governance. IT Governance is the part of corporate governance that includes policies, procedures, and controls that relate to information systems use, performance, Return on Investment (ROI), and risk mitigation

When a company moves services to the cloud it must naturally extend its IT governance to include cloud-based systems and services. Governance includes policies, procedures, and controls that ensure confidence in the accuracy and security of the cloud-based systems, and also ensures the strategic alignment of cloud-based systems with the organizations goals. A key component of the governance process begins with Service Level Agreements (SLA)’s that specify contractual obligations that a cloud vendor must provide and adhere to. One important governance issue that is normally specified in a SLA is limited liability provisions. Fox (2015) states that customers generally want service provider’s liability responsibility to include, among other obligations, coverage for claims arising out of the following:

• Allegations that the cloud services provided by the vendor infringe upon, or violate, the intellectual property or other proprietary rights of any third party.

• Negligence or willful misconduct of the cloud service provider, including its contractors and agents.

• Claims that the cloud service provider including its contractors and agents caused any bodily injury to the customer’s staff, or property damage to the customer’s property.

• A breach of any of the cloud service provider’s data or system security as well as any other customer data privacy obligations.

In contrast, cloud service providers usually try and reduce the scope of their liability towards customers by attempting to negotiate SLA provisions in their favor, for example, trying to limit its liability obligations to customers using a cap on the amount that it is obligated to indemnify the customer for. Customers who agree to caps run the risk of being held accountable for damages that exceed the cap limit even if the damages can be attributed to the provider, provider contractors, and other third-parties that may be associated with the cloud provider (Fox, 2015).

Summary

Regarding the governance of cloud-based systems, it is of utmost importance that customers clearly understand that if their IT systems are hosted on a cloud-based system, their IT governance extends to include those systems. Service Level agreements with cloud providers are a method that organizations can use to extend that governance to cloud-based systems which specifies a level of service that a vendor agrees to provide, and contains provisions that specify items such as liability.

References

Fox, A. (2015, May 07). Common Mistakes Made by Customers and Service Providers when Negotiating Cloud Services Agreements. Retrieved August 10, 2017, from Association of Corporate Counsel, http://www.acc.com/legalresources/quickcounsel/negotiating-cloud-services-agreements.cfm.

Disclaimer

The post The Governance of Cloud-Based Systems appeared first on .

Ethics Related to the Collection of Information

Revised July 01, 2023

When designing information systems, it is crucial to address various ethical considerations that relate to the Confidentiality, Integrity, Availability (CIA) security concept. The following points provide an overview of these ethical concerns and their relevance to the CIA security triad:

1. Benefit of Information Collection:

   • Confidentiality: Determine who benefits from the information collected and ensure appropriate confidentiality measures are in place.
   • Policies and Restrictions: Implement policies and restrictions that control how the collected information will be used and ensure compliance.

2. Privacy and Confidentiality:

   • Confidentiality: Protect users’ personal information and maintain its confidentiality.
   • User Consent: Inform users about how their information will be used and obtain explicit consent.
   • Transparency: Provide clear and accurate explanations of how collected information will be utilized to avoid misleading users.

3. Accuracy of Information:

   • Integrity: Ensure the accuracy and integrity of information by implementing data validation and verification mechanisms.
   • User Responsibility: While users may input information, organizations still hold responsibility for maintaining accurate data, especially in critical domains like healthcare.

4. Property and Ownership:

   • Confidentiality and Integrity: Respect copyright and ownership rights associated with information.
   • Permission and Use: Determine if alteration or use of copyrighted material is allowed and abide by the associated restrictions.

5. Accessibility:

   • Confidentiality, Integrity, and Availability: Implement controls to restrict access to authorized users only.
   • Data Amendments: Establish mechanisms to control data amendments and ensure data integrity.
   • Availability: Ensure consistent and reliable access to information for authorized users.

6. Purpose and Extensiveness of Information Use:

   • Confidentiality: Define the intended purpose of information use and establish boundaries to prevent unauthorized utilization.
   • Limitations: Avoid using information beyond its intended purpose without proper consent or legal authorization.

7. System Availability:

   • Availability: Ensure that information systems are consistently available, reliable, and accessible to authorized users.

8. Categorization:

   • Integrity: Categorize information to minimize variations within and between categories.
   • Data Consistency: Establish consistent categorization standards to maintain data integrity.

By addressing these ethical considerations during information systems design, organizations can uphold ethical principles, protect user privacy, maintain data accuracy and integrity, and ensure the availability of information in a responsible and ethical manner.

References and Related Articles

Capozzoli, E. A., Windsor, R. D., & True, S. L. (2006). Reading 7: Integration and Ethical Perspectives for Information Systems Management. In M. Whitman & H. Mattford (Authors), Readings and Cases in the Management of Information Security. Mason, OH: Course Technology.

https://www.promptcloud.com/blog/importance-of-ethical-data-collection/

https://www.oreilly.com/library/view/accounting-information-systems/9781118162309/c13-26.html

https://www.forbes.com/sites/forbestechcouncil/2020/03/31/the-ethical-data-dilemma-why-ethics-will-separate-data-privacy-leaders-from-followers/?sh=272064a14c6a

Additional Articles

Demystifying the Payment Card Industry Data Security Standard (PCI DSS): Safeguarding Cardholder Data in Transactions

Security Policy Template for Hand-Held Devices

The Process of Migrating an Application to the Cloud

Exploring the Implications of Artificial Intelligence

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Note: This article has been drafted and improved with the assistance of AI, incorporating ChatGPT suggestions and revisions to enhance clarity and coherence. The original research, decision-making, and final content selection were performed by a human author.

Disclaimer

Terms and Conditions of Use

The post Ethics Related to the Collection of Information appeared first on .

Consumer Privacy Bill of Rights

Introduction

The Consumer Privacy Bill of Rights (CPBR) was proposed as a draft bill by President Obama on 27 February 2015. The CPBR is intended as a law that will govern the collection and dissemination of consumer data. The Obama administration re-introduced the CPBR as an enhancement to the Data Security and Breach Notification Act of 2015 which requires organizations to disclose data breaches in a timely manner to mitigate the risk of identity theft (Chernichaw & Freeman, 2015). This paper will explore the key provisions of the CPBR, related legal cases where the CPBR could have applied, explore how the CPBR could affect consumers and business, and discuss safeguards that would be used by organizations upon implementation of the CPBR.

Consumer Privacy Bill of Rights Background

Lustigman & Solomon (2015) state that the reintroduction of the CPBR should come as no surprise to anyone involved in data collection due to a number of data gathering organizations that have come under FTC scrutiny for lax or ineffective privacy practices. For example; in 2011, Google was subjected to a Federal Trade Commission (FTC) investigation and penalties for misrepresenting a new social network. The privacy policy for this network provided misleading information on privacy controls. Another example incident occurred in 2012 when the FTC settled with the popular social networking site Facebook over its lack of transparency in its privacy policies, and deceiving its users about information that their users thought was private, when in fact this information was made public (Lustigman, & Solomon, 2015).

Kerry (2015) states that the Edward Snowden leaks have brought about concerns among the public regarding government surveillance, and has also brought attention to how much electronic data can be collected and how much it can reveal about a person. Additionally, a rash of highly publicized cyber-attacks and data breaches that have affected organizations such as Target, Sony Pictures, and Anthem, has created anxiety among consumers about the vulnerability of personal information. As a result, it has brought to light an acute need to renew global trust in the United States government protection of privacy and in the companies that operate under U.S. privacy law. Currently, forty seven states have breach notification laws in addition to other federal laws that govern the protection of private information, but it has been noted that there are gaps in these laws due to the increasing proportion of electronic data collection that falls outside currently existing privacy laws. The CPBR is intended to fill in these gaps and provide a federal government established baseline standard for the protection of private information (Kerry, 2015).

Consumer Privacy Bill of Rights Key Provisions

The current discussion draft of the CPBR was submitted to the U.S. Senate with the last formal action on the bill performed in April of 2015 (Congress.gov Bill 1158, 2015). The following are the major key provisions of the current discussion draft:

• Transparency: Covered entities are required to provide individuals with concise, conspicuous, and easily understandable notices that provide accurate, clear, and timely information about the entities’ privacy and security practices. This provision specifies requirements for notices to include; information about retention practices, disclosures, and mechanisms for obtaining access to personal data (Whitehouse.gov CPBR Act, 2015, pg.6-7).
• Individual Control: Covered entities are required to provide individuals with reasonable means to control the processing of their personal data that are proportionate to the privacy risks. The provision defines privacy risk as “the potential for personal data, on its own or when linked to other information about an individual, to cause emotional distress or physical, financial, professional or other harm to an individual.” The provision requires that covered entities provide individuals with the means to withdraw consent to the processing of personal data (Whitehouse.gov CPBR Act, 2015, pg.7-8).
• Respect for Context: A covered entity is required to processes personal data in a manner that is reasonable compared to its context. Context would be determined by evaluating the interactions between an entity and individuals and what reasonable individuals would understand about the covered entity’s practices. The provision states that “covered entities shall provide individuals with notice regarding personal data practices that are not reasonable in light of context at times and in a manner reasonably designed to enable individuals to decide whether to reduce their exposure to the associated privacy risk, as well as a mechanism for control that is reasonably designed to permit individuals to exercise choice to reduce such privacy risk”. A privacy risk analysis would include; reviews of data sources, systems, information flows, partnering entities, and data and analysis uses. Exceptions for certain data analysis is governed by FTC-approved industry Privacy Review Boards that can exempt covered entities from providing heightened notice and individual control where the Privacy Review Boards supervise data processing that is otherwise not reasonable in terms of context (Whitehouse.gov CPBR Act, 2015, pg.8-10).
• Focused Collection and Responsible Use: Covered entities are permitted to collect, retain and use personal data only as is reasonable in the context that it will be used. Entities are required to delete, destroy, or de-identify personal data within a reasonable time after collected data has served the purpose for which it was collected (Whitehouse.gov CPBR Act, 2015, pg.10-11).
• Security: Covered entities are required to secure personal data against loss, compromise, alteration, and unauthorized use, or disclosure. Furthermore, entities are required to conduct security risk assessments and implement reasonable security safeguards (Whitehouse.gov CPBR Act, 2015, pg.11).
• Access and Accuracy: Covered entities would generally be required to provide individuals, upon request and proper identity verification, with reasonable access to the personal data about them that entities have collected and control. Entities are required to take reasonable and appropriate steps to mitigate related associated privacy risks and ensure that personal data held by entities is accurate (Whitehouse.gov CPBR Act, 2015, pg.12-13).
• Accountability: Covered entities would be required to provide training to employees, conduct privacy assessments, adopt privacy policies and procedures, require those working with personal data to use the data consistently with the entities goals and policies, and take reasonable steps to ensure compliance with the all provisions of the CPBR (Whitehouse.gov CPBR Act, 2015, pg.13-14).
• Enforcement and Civil Penalties: The FTC is responsible for enforcing the CPBR on a federal level. The bill makes provisions for State Attorney General’s to also enforce the bill with notification provided to the FTC. Civil penalties for violation of the bill are calculated by multiplying the number of days that the covered entity violates the Act by an amount not to exceed $35,000. The total civil penalty determined by the court shall not exceed $25,000,000 (Whitehouse.gov CPBR Act, 2015, pg.14-16).
• Safe Harbor: The Secretary of Commerce may convene interested stakeholders, such as members of industry, civil society, the public safety community, and academia, to develop codes of conduct. Covered entities that adhere to this code of conduct can apply to the commission for Safe Harbor. Covered entities that can demonstrate that they have maintained a commitment to adhere to the Commission-approved code of conduct shall have a complete defense (Whitehouse.gov CPBR Act, 2015, pg.17-20).

Related Legal Proceedings Discussion

 Currently the United States does not have a single comprehensive federal law that covers consumer information privacy and security. Instead it has enacted several industry specific laws, for example; the GLBA and HIPAA that cover personal information privacy for financial information and health information. For this reason most states have enacted their own data privacy and security laws that cover gaps on how to handle private information and its security. The issue is that the provisions and penalties of these laws can vary from state to state (Grama, 2015, pg. 248). The CPBR is intended to fill in the potential gaps not covered by existing federal and state laws, and establish a single baseline standard for the protection of private information (Kerry, 2015).  Since the CPBR has not been implemented as law yet, there are no historical cases or case studies directly related to the bill. The following case studies examine a few privacy related incidents where provisions of the CPBR would have been beneficial to the protection and securing of consumer private information.

Related Legal Proceedings Case Study (1), Sony Pictures.

On 21 Nov, 2014, Sony Pictures Entertainment executives received extortion emails from a cyber criminal group warning of an attack. On 24 Nov, 2014 Sony discovered internal documents, emails and movies had been leaked and that it had lost control of its IT network (Tamir, 2015). Apparently hackers targeted Sony employees in Russia, India and other parts of Asia with spear-phishing e-mails to which a malicious PDF document was attached, which included a remote-access Trojan. After some Sony employees opened the PDF file, their PCs became infected with the malware, and the hackers used this to gain access to the Sony Pictures network. The hackers provided Sony with samples of stolen documents, emails, and other data that proved to be authentic. The hacking group claimed to have initiated the attack because of a movie titled “The Interview” which portrayed the country of North Korea in an unflattering light. The attackers sent the warning message demanding that Sony pull the movie from release. When Sony failed to pull the movie release by the allotted time specified by the attackers, the hacking group proceeded with the attack (Schwartz, 2015).

In this case most of the publicity and target of investigation was related to intellectual property and company business data that was exposed. It was noted that since Sony was not a health care organization or a type of financial institution, there wasn’t a requirement for Sony to meet a specific and detailed regulatory requirements for data security involving personal data even though a very large quantity of the data exposed was personal in nature. This included documents, correspondence, and salaries of employees, as well as other private information about staff and actors. While Sony faces regulatory action and lawsuits from former employees, most of the attention and negative business implications have nothing to do with personal data (Nahra, 2015).

In Corona v. Sony Pictures Entertainment, Inc., No. 14-CV-09600 (RGK), U.S. District Judge R. Gary Klausner approved a settlement between Sony and 15,000 current and former employees for an undisclosed amount of money. Sony still faces potential liability for negligence based on its three-week delay in notifying its employees of the data breach, as well as statutory claims under the California Confidentiality of Medical Information Act and the Unfair Competition Law (Hunton Privacy Blog Sony, 2016).

There are still many questions that remain unanswered about this case today to include questions about Sony’s information system security at the time of the breach. The most important item of note though is that most federal and state investigations into the incident are not related to the personal information that was exposed. It is also of note that any future potential liability is only partially being pursued using the California Confidentiality of Medical Information Act and the Unfair Competition Law. There is no other legal mechanism in place that applies specifically to information privacy on its own that can be used in the Sony case (Hunton Privacy Blog Sony, 2016). Since the Sony breach did not fall under specific existing industry laws such as HIPAA or GLBA, the possibility of any legal penalties being leveled against Sony for the exposure of staff personal private information is still unclear and being explored (Nahra, 2015). The information privacy loopholes revealed in this case are an example of where a law like the proposed CPBR would cover the exposure of the staff’s private information related to this breach. The employees would still have the option of pursuing civil suits, but Sony would also still be liable for penalties under the CPBR. Furthermore, if a law like the CPBR was implemented, it specifies that Sony would have a legal obligation to protect this private information and compel them to implement security safeguards to protect private information, even the private information of its employees.

Related Legal Proceedings Case Study (2), Uber

The popular ride-sharing service Uber has been the target of several complaints alleging the exposure of the private data of its customers and drivers the past few years, and is currently involved with many lawsuits. Currently, Uber uses a technology that is referred to as “God Mode” which Uber claims is an application that allows them to track all Uber customers in real time. However, it has been reported that Uber often used this function as entertainment for parties, showing the Ubers in a city and the silhouettes of waiting Uber users who had flagged cars. One party attendee reported that real-time information was used and as a result individuals were identifiable. It has also been reported that it is not just employees who have too much access. A reporter for the Washington Post interviewed for a job at Uber in 2013 and was given unrestricted access to customer data for an entire day, just as if he were an employee. The data collected by Uber during the normal course of business to include; name and credit card information are private information protected by many existing privacy laws. The issue in these cases is that other private information is routinely being misused, and this misuse is not covered by many state information privacy laws. Additionally, since Uber is not a health related organization or a financial organization, federal laws such as HIPAA and GLBA do not apply (Mueffelmann, 2015).

On 22 June, 2015, the FTC filed a “Complaint, Request for Investigation, Injunction, and Other Relief” against Uber related to the privacy infractions described above. The filing states that Uber has ignored the FTC’s prior decisions, and their current actions threaten the privacy rights and personal safety of American consumers. The filing further states that Uber continues to ignore past bad practices of the company involving the misuse of location data, an action that poses a direct risk of consumer harm (Epic Uber Injunction, 2015).

The Uber case is a good example of why laws such as the proposed CPBR need to be implemented. The CPBR contains provisions that specifically address much of the misuse described in this case, specifically, the provisions for Transparency, Individual Control, Focused Collection and Responsible Use, and Security.

The Transparency provision requires organizations to provide individuals with concise, conspicuous, and easily understandable notices that provide accurate, clear, and timely information about the entities’ privacy and security practices. Something Uber currently does not do.

The Individual Control provision requires organizations to provide individuals with reasonable means to control the processing of their personal data that are proportionate to the privacy risks. The provision defines privacy risk as “the potential for personal data, on its own or when linked to other information about an individual, to cause emotional distress or physical, financial, professional or other harm to an individual.” The provision requires that covered entities provide individuals with the means to withdraw consent to the processing of personal data. The “God Mode” application can be used to provide accurate location information on Uber users. As such this information is private. Uber sharing this information with other customers exposes this private information. Additionally, Uber does not provide customers a method to “opt-out” of being tracked by the application.

The Focused Collection and Responsible Use provision states that entities are permitted to collect, retain and use personal data only as is reasonable in the context that it will be used. Uber using data collected by the “God Mode” application for entertainment purposes would violate this provision.

The Security provision would specifically cover incidents such as allowing prospective employees to have unrestricted access to private information of its customers. This provision would also provide instruction for safeguarding private information (Whitehouse.gov CPBR Act, 2015, pg.6-11).

Impact of the CPBR on Information Security Safeguards – Security Provisions

The CPBR Security provision (Whitehouse.gov CPBR Act, 2015, pg.11), states that safeguards must adhere to several sub-provisions that are as follows:

• “Identify reasonably foreseeable internal and external risks to the privacy and security of personal data that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information”.
• “Establish, implement, and maintain safeguards reasonably designed to ensure the security of such personal data”.
• Regularly assess the sufficiency of any safeguards in place to control reasonably foreseeable internal and external risks. Evaluate and adjust safeguards as required. Make any material changes to operations or business arrangements as required to ensure compliance.

The provision further states that the reasonableness of the safeguards that a covered entity adopts must account for: the degree of the privacy risk associated with the personal data under the covered entity’s control, the foreseeability of threats to the security of such data, widely accepted practices in administrative, technical, and physical safeguards for protecting personal data, and the cost of implementing and regularly reviewing such safeguards (Whitehouse.gov CPBR Act, 2015, pg.11)

Impact of the CPBR on Information Security Safeguards – Discussion

The first item noticed about the Security provision of the CPBR bill in its current form is that it does not reference any specific standard or law. It simply states that safeguards must meet “widely accepted practices in administrative, technical, and physical safeguards for protecting personal data”. The Safe Harbor provision states that there is to be the creation of codes of conduct that would be overseen and approved by the FTC, but this code of conduct has not been created yet (Whitehouse.gov CPBR Act, 2015, pg.17-20).

Lustigman & Solomon (2015) state that the largest impact of the CPBR if implemented would be on organizations such as online marketers, retailers, service, and sales oriented businesses, since they often do not fall under many of the existing privacy laws such as HIPAA and GLBA. Organizations that currently fall under existing laws usually already meet compliance standards of the CPBR. The implementation of the CPBR would force the sales and retail organizations mentioned above to change their privacy policies and how they currently handle and secure private information.

A safeguard baseline standard could reasonably be derived from the health and financial industries governed by laws such as HIPAA and the GLBA, or, generated using guidelines provided by the National Institute of Standards and Technology (NIST), and The International Organization for Standardization (ISO). NIST computer security publications for example are a widely-recognized as a standard for  information security guidelines that identify key security web resources to support users in industry, government, and academia (NIST Computer Security, n.d.).

Since most organizations that are subject to existing federal and state information privacy laws use publications from organizations such as NIST, these publications would be a good source to use in the implementation of security safeguards required by the CPBR.

Impact of the CPBR on Information Security Safeguards – Safeguards

The following are security safeguards that can be implemented to meet CPBR Security provisions using NIST publications as guidelines:

• The Transparency provision requires organizations to provide individuals with concise, conspicuous, and easily understandable notices that provide accurate, clear, and timely information about the entities’ privacy and security practices (Whitehouse.gov CPBR Act, 2015, pg.6-7). Technical safeguards are not well suited to enforce this provision, an administrative safeguard such as a policy would work best. The NIST 800-14 provides guidelines that can be used to generate policies and procedures (Swanson & Guttman, 1996, pg.11-15).
• The Individual Control provision states that entities are required to provide individuals with reasonable means to control the processing of their personal data that are proportionate to the privacy risks. In the case of this provision, a means would have to exist that allowed users to access private information held by the entity. One privacy concern would be authentication. An example technical safeguard could entail an online authentication where a user would need to provide two-part authentication.
• The Respect for Context, Focused Collection and Responsible Use, and Access and Accuracy provisions, would be best addressed with policies and procedures as outlined by NIST (Swanson & Guttman, 1996, pg.11-15).

The overall objective of security safeguards is to protect private information. This process requires a method for determining risk and exactly how an entity handles privacy, determine which safeguards are in place and how effective they are, and what additional safeguards need to be put into place. The CPBR Security provision instructs that entities must conduct risk assessments which would satisfy the need to  identify risks and implement security safeguards against these risks. NIST Publication 800-30 provides guidance on how to organize and conduct risk assessments, as well as guidance on implementing controls (Gallagher. NIST 800-30, 2012, pg.4-38).

Conclusions

Upon research and examination of the proposed Consumer Privacy Bill of Rights bill it appears that the provisions proposed do in fact fill in many gaps and loopholes in privacy laws. In the cases of Sony and Uber, it clearly shows that much of the private information exposed in these incidents did not fall directly under existing federal and state laws. The CPBR would provide a baseline standard that would fill in the gaps not already covered. The law is proposed as one that sets a standard, but it is important to note that it will preempt current and future state privacy and security laws (CDT, CPBR, 2015).

The CPBR initially appears to be an excellent proposal, but it does have a few areas of concern in its current form. Sullivan (2015) discusses the political environment that surrounds the law and also discusses the alternative Consumer Privacy Bill proposed after the CPBR by Senators Leahy and Franken. This particular proposal goes a few steps further than the CPBR in regards to not requiring demonstration of harm before notice (Sullivan, 2015). This lack of vision and direction appears to be slowing down the passing of either bill while legislators work them out.

Another primary concern of the CPBR includes penalties for violation. Penalties in the bills current form are for amounts not to exceed $35,000 per incident (Whitehouse.gov CPBR Act, 2015, pg.14-16). If these penalties were to be applied to very large organizations, the $35,000 per incident for a violation is not much of a deterrent.

Overall the proposed CPBR appears to have the potential to be a valuable law that fills in private information protection gaps, however, in its current form, it still has a few issues that need to be resolved or it will be in danger of becoming an ineffective law.

More privacy and censorship news can be found at Online Censorship News

References

CDT, CPBR. (2015, March 02). Analysis of the Consumer Privacy Bill of Rights Act. Retrieved June 16, 2016, from https://cdt.org/insight/analysis-of-the-consumer-privacy-bill-of-rights-act/.

Chernichaw, A., & Freeman, B. (2015, April 08). White House Re-Introduces Consumer Privacy Bill of Rights Act. Retrieved May 05, 23, from http://www.whitecase.com/publications/article/white-house-re-introduces-consumer-privacy-bill-rights-act.

Congress.gov Bill 1158. (2015, April 30). S.1158 – Consumer Privacy Protection Act of 2015. Retrieved June 13, 2016, from https://www.congress.gov/bill/114th-congress/senate-bill/1158/action.

Epic Uber Injunction. (2015, June 22). Complaint, Request for Investigation, Injunction, and Other Relief. Retrieved June 15, 2016, from https://epic.org/privacy/internet/ftc/uber/Complaint.pdf

Gallagher. P. NIST 800-30. (2012, September). Guide for Conducting Risk Assessments. Retrieved June 16, 2016, from http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf

Grama, J. L. (2015). Legal issues in information security (2nd ed.). Boston, MA: Jones & Bartlett Learning.

Hunton Privacy Blog Sony. (2016, April 18). Federal Court: Sony Pictures Data Breach Class Action Settlement Approved. Retrieved June 15, 2016, from https://www.huntonprivacyblog.com/2016/04/18/federal-court-sony-pictures-data-breach-class-action-settlement-approved/.

Kerry, C. (2015, March 06). We need a Privacy Bill of Rights. Retrieved May 27, 2016, from http://thehill.com/blogs/congress-blog/civil-rights/234741-we-need-a-privacy-bill-of-rights.

Lustigman, A., & Solomon, A. (2015, March 12). An overview and the impact of the Consumer Privacy Bill of Rights. Retrieved May 27, 2016, from http://www.insidecounsel.com/2015/03/12/an-overview-and-the-impact-of-the-consumer-privacy.

Mueffelmann, K. (2015, February). Uber’s privacy violations a cautionary tale for others. Retrieved June 14, 2016, from http://www.financierworldwide.com/ubers-privacy-violations-a-cautionary-tale-for-others/#.V2G3xbsrKHs.

Nahra, K. J. (2015, March). Lessons to Be Learned from the Sony Breach. Retrieved June 13, 2016, from http://apps.americanbar.org/buslaw/committees/CL925000pub/newsletter/201503/fa_2.pdf

NIST Computer Security. (n.d.). Computer Security Resource Center (CSRC. Retrieved June 16, 2016, from http://csrc.nist.gov/.

Schwartz, M. J. (2015, February 04). Report Claims Russians Hacked Sony. Retrieved June 13, 2016, from http://www.bankinfosecurity.com/report-claims-russians-hacked-sony-a-7873?rf=2015-02-04-eb&utm_source=SilverpopMailing&utm_medium=email&utm_campaign=enews-bis-20150204%20%281%29&utm_content=&spMailingID=7476382&spUserID=NTQ5MzMyMzQ1ODIS1&spJobID=620402043&spReportId=NjIwNDAyMDQzS0.

Sullivan, B. (2015, April 30). Will the New Consumer Privacy Bill Protect You? Retrieved June 16, 2016, from http://blog.credit.com/2015/04/new-consumer-privacy-bill-protect-115438/

Swanson, M., & Guttman, B. (1996, September). Generally Accepted Principles and Practices for Securing Information Technology Systems. Retrieved June 16, 2016, from http://csrc.nist.gov/publications/nistpubs/800-14/800-14.pdf

Tamir, D. (2015, February 05). Who Hacked Sony? New Report Raises More Questions About Scandalous Breach. Retrieved June 13, 2016, from https://securityintelligence.com/who-hacked-sony-new-report-raises-more-questions-about-scandalous-breach/.

Whitehouse.gov CPBR Act. (2015). Administration Discussion Draft: Consumer Privacy Bill of Rights Act of 2015. Retrieved May 23, 2016, from https://www.whitehouse.gov/sites/default/files/omb/legislative/letters/cpbr-act-of-2015-discussion-draft.pdf

Additional Articles

Exploring the Implications of Artificial Intelligence

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Demystifying the Payment Card Industry Data Security Standard (PCI DSS): Safeguarding Cardholder Data in Transactions

Sarbanes-Oxley Act (SOX): Strengthening Financial Reporting and Accountability

Disclaimer

Terms and Conditions of Use

The post Consumer Privacy Bill of Rights appeared first on .

The concept of “Safe Harbor” refers to specific actions, example; encryption of private data, that an individual or an organization can take to show a good-faith effort in complying with the law. This good-faith effort provides a person or organization “Safe Harbor” against prosecution under the law (Grama, 2015, pg.253).

The State of Texas Statute 521.002 states that when a an individual’s first name or first initial and last name are combined with other private information, example, Social Security Number, that the information must be encrypted. The State of Texas Bus. & Com. Code 521.002, 521.053; Ed. Code 37.007(b)(5), and Pen. Code 33.02 all have provisions for personal private data protection, but none of these set a specific encryption standard. According to this law as long as an organization encrypts personal private information as the law specifies, theft of encrypted information would not require a breach notification which fulfills the principle of Safe Harbor (State of Texas Statutes 521.053, 2009).

Further research into Texas information system requirements revealed that encryption standards for state agencies are controlled by the agencies themselves. Texas Administrative Code 202.1 was the only law found addressing encryption at a state level for all other agencies and it also did not provide an encryption standard. Note: this law was repealed March of 2015 and no other laws were found (Texas Administrative Code 202.1, n.d.).

References

Grama, J. L. (2015). Legal issues in information security (2nd ed.). Boston, MA: Jones & Bartlett Learning.

State of Texas Statutes 521.053. (2009, April 01). Business and Commerce Code Title 11. Personal Identity Information Subtitle B. Identity Theft Chapter 521. Unauthorized Use of Identifying Information Subchapter A. General Provisions. Retrieved June 2, 2016, from http://www.statutes.legis.state.tx.us/Docs/BC/htm/BC.521.htm#521.053

Texas Administrative Code 202.1. (n.d.). Texas Administrative Code Title 1. Part 10. Chapter 202. Sub Chapter A. Rule 202.1. Retrieved June 2, 2016, from http://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=2&p_dir=&p_rloc=142456&p_tloc=&p_ploc=&pg=1&p_tac=142456&ti=1&pt=10&ch=202&rl=1&dt=&z_chk=&z_contains=

Disclaimer

The post Safe Harbor and State of Texas Breach Notification Laws appeared first on .