How to control your electronic assets when you become inactive: Google

E-Crime Expert starts today a series that enables users to manage their online data (electronic assets) if they become inactive (i.e accident, jail time, passed away, etc). Let’s say this is a WILL (testament) for electronic assests which is similar in scope to a WILL for material assests (i.e. house, boat, car, etc).

Google has a program called Inactive Account Manager, that allows those who use Google services decide exactly how they want to manage their online data stored with the company (i.e. Gmail, Picasa, YouTube, blogs, Wallet, etc).

What should happen to your photos, emails and documents when you stop using your account? Google puts you in control.

You might want your data to be shared with a trusted friend or family member, or, you might want your account to be deleted entirely. There are many situations that might prevent you from accessing or using your Google account. Whatever the reason, Google gives you the option of deciding what happens to your data.

Using Inactive Account Manager, you can decide if and when your account is treated as inactive, what happens with your data and who is notified.

i. How to set up your Inactive Account Manager

First, go to https://www.google.com/settings/account
Then, go to the bottom of the page to “Learn more and go to setup” (fig. 1)

Fig. 1

ii. Timeout period

You set a timeout period, after which your account can be treated as inactive. The timeout period starts with your last sign-in to your Google account. Click Setup (fig 2).

Fig. 2

Follow the instructions in the picture bellow (fig. 3).

Fig. 3

iii. Alert me

Inactive Account Manager will alert you via text message and optionally email before the timeout period ends (fig. 4).

Fig. 4

iv. Notify contacts and share data

Add trusted contacts who should be made aware that you are no longer using your account. You can also share data with them if you like (fig. 5, fig. 6 and fig. 7).

Fig. 5 (the time period after which your Account will be timed-out and the auto-response message after the account is timed-out)

Fig. 6 (auto-response-do not forget to click “save”)

Fig. 6.1 (click add trusted-contact)

Fig. 6.2 (insert email address for your trusted contact and click next)

Fig. 6.3 (select data to be shared with your trusted contact)

Fig. 6.4 (prepare email for the trusted contact when receiving your data. Click “save”)

Fig. 7 (Click enable to set up the Inactive account manager)

Fig. 8 (disable the Inactive account manager)

v. Optionally delete account

If you wish, instruct Google to delete your account on your behalf.

Fig. 9 (click “yes” for “delete my account” under “Optionally Delete Account”. Click “Enable”)

Fig. 10 (select either Delete Account + Content or Delete your entire Google profile)

Fig. 11 (select your choice as outlined in the Figure bellow. Click “Delete Google account”)

Any questions can be submitted to: dan@e-crimeexpert.com
Additional information can be found at: http://www.e-crimeexppert.com
Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog

Do you know what is your child’s age requirement to sign up online?

As the Internet permeates every aspect of the economy and society, it is also becoming an essential element of our children’s lives. While it can bring considerable benefits for their education and development, it also exposes them to online risks such as access to inappropriate content, harmful interactions with other children or with adults, and exposure to aggressive marketing practices.

Children online can also put their computer systems at risk and disseminate their personal data without understanding the potential long-term privacy consequences.

In addition, there are other risks for children using online environments, such as:

–Privacy risks

-cyber-bullying

-cyber-stalking

-age-inappropriate content

-online grooming

-identity theft

-emotional implications.

Beside support and guidance from parents when using the online environment, an appropriate mental development and understanding is important for a child when using an online platform. For these reasons, in both the United States and the European Union, a minimum age requirements for accessing the “online world” was set as a legal requirement.

E-Crime Expert thinks that the minimum age requirements a child should meet when signing up for an email account, Facebook, etc., should be a topic of interest for parents. For these reasons, we researched the minimum age requirements on some of the most popular online sites and platforms.

The Children’s Online Privacy Protection Act (COPPA) in United States applies to the online collection of personal information by persons or entities under U.S. jurisdiction from children under 13 years of age. It details what a website operator must include in a privacy policy, when and how to seek verifiable consent from a parent or guardian, and what responsibilities an operator has to protect children’s privacy and safety online including restrictions on the marketing to those under 13. While children under 13 can legally give out personal information with their parents’ permission, many websites altogether disallow underage children from using their services due to the amount of work involved.

In the European Union, the European Commission released in January 2012, a Proposal on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

This Proposal has specific requirements with regards to Children. They deserve specific protection of their personal data, as they may be less aware of risks, consequences, safeguards and their rights in relation to the processing of personal data. To determine when an individual is a child, this Regulation should take over the definition laid down by the UN Convention on the Rights of the Child.

“Article 8
Processing of personal data of a child

For the purposes of this Regulation, in relation to the offering of information society services directly to a child, the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child’s parent or custodian. The controller (i.e. the person in charge with the collection, use and disclosure of personal data) shall make reasonable efforts to obtain verifiable consent, taking into consideration available technology”.

Following, are the minimum age requirements for children using different Internet websites or Social Networking Services and other online platforms:

 1.      Facebook:

How old do you have to be to sign up for Facebook?

In order to be eligible to sign up for Facebook, you must be at least 13 years old.

The minimum age requirement on Facebook is more or less enforceable. Simply lying about your birthdate easily circumvents the policy.

The Children’s Online Privacy Protection Act (COPPA) mandates that websites that collect information about users aren’t allowed to sign on anyone under the age of 13. As a result, Facebook’s Statement of Rights and Responsibilities require users of the social network to be at least 13 years old (and even older, in some jurisdictions).

According to MinorMonitor, over 38 percent of children with Facebook accounts are 12-years-old and under. Even more worryingly, 4 percent of children on Facebook are reported to be 6-years-old or younger, which translates to some 800,000 kindergarteners on Facebook.

These results come from a survey of 1,000 parents of children under 18-years-old who use Facebook. The company provides a free, web-based parental tool that gives parents a quick view into their child’s Facebook use, including potential dangerous activities such as the friending of online predators, cyberbullying, violence, drug and alcohol use, as well as sexual references.

2.      Google:

Age requirements on Google Accounts:

•  United States: 13 or older
•  Spain: 14 or older
•  South Korea: 14 or older
•  Netherlands: 16 or older
•  All other countries: 13 or older

Some Google products have specific age requirements. Here are a few examples:

• YouTube: When a YouTube video has been age-restricted, a warning screen is displayed and only users who are 18 or older can watch it. Learn more about age-restricted videos.
• Google Wallet: 18+
•  AdSense: 18+
•  AdWords: 18+

3.      Yahoo

When a child under age 13 attempts to register with Yahoo!, they ask the child to have a parent or guardian create a Yahoo! Family Account to obtain parental permission.

Yahoo! does not contact children under age 13 about special offers or for marketing purposes without a parent’s permission.

Yahoo! does not ask a child under age 13 for more personal information, as a condition of participation, than is reasonably necessary to participate in a given activity or promotion.

Yahoo! is concerned about the safety and privacy of all its users, particularly children. For this reason, parents of children under the age of 13 who wish to allow their children access to the Yahoo! Services must create a Yahoo! Family Account. When you create a Yahoo! Family Account and add your child to the account, you certify that you are at least 18 years old and that you are the legal guardian of the child/children listed on the Yahoo! Family Account. By adding a child to your Yahoo! Family Account, you also give your child permission to access many areas of the Yahoo! Services, including, email, message boards and instant messaging (among others). Please remember that the Yahoo! Services is designed to appeal to a broad audience. Accordingly, as the legal guardian, it is your responsibility to determine whether any of the Yahoo! Services areas and/or Content are appropriate for your child.

4.      Hotmail

As on Hotmail’s Terms of Use is no reference to the age requirements to join the service, we did our own registration and it appears that 13 is the age requirement for joining Hotmail, as shown below:

I.                   Attempt indicating the user is 6 years old

Step 1   

Step 2                        

Step 3

 

II.                Second attempt, indicating the user is 13 years old.

Step 1

Step 2

 

5.        MySpace 

• You must be at least 13 years old to have a Myspace profile
• If you’re under 16 years old, you’re not allowed to list your age as over 16 and make your profile public (your profile must be set to private)
• If you’re under 18, you’re not allowed to list your age as over 18
• Users under 18 are not able to make changes to their listed age

Notes & Tips

• If you break any of the above rules, MySpace will be forced to delete your profile for safety and security reasons (it’s all in their Terms of Use)

6.      Skype

Skype not directly sets up an age restriction within their Terms of Use.

“Jurisdiction’s Restrictions: If the law of Your country prohibits You from downloading or using Skype Software because You are under the age limit or because the Skype Software is not allowed in Your country, please don’t use it”.

According to this, for US the minimum age requirement is 13 + (COPPA).

7.      LinkedIn

PRIVACY POLICY, 18!

In terms of LinkedIn’s Privacy Policy:

 ”Children are not eligible to use our service and we ask that minors (under the age of 18) do not submit any personal information to us or use the service.”

8.      Twitter

Age screening on Twitter

Age screening is a way for brands and others to determine online whether a follower meets a minimum age requirement, in a way that is consistent with relevant industry or legal guidelines. This makes it easier for advertisers and others with content not suitable for minors (e.g. alcohol advertisers) to advertise on Twitter.

There apparently, is now age restriction for setting up an account on Twitter (as we set it up without being asked about our age). See below:

Step 1

Step 2: Done!

For more advice on how children could stay safe online (you could also share this with your child), click here to visit the material E-Crime Expert specially created for this purpose.

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

WHAT TO DO WHEN YOUR EMAIL GOT HACKED OR COMPROMISED

E-Crime Expert explains in this blog post the steps to be taken when your email or Social Networking Site has been hacked or compromised.

When someone’s friends or close contacts start telling that they are receiving emails or messages that one never sent, or when appears online content that one never posted, it could mean that another person has gained illegitimate control over this individual’s email or Social Networking Site.

If this happened, in order to limit the damage and the possibility of spreading malwares/viruses to others, firstly the passwords to all accounts that have been compromised and to other important accounts should be changed*, and also notifications to all contacts regarding that they may receive spam messages that appear to come from the compromised account, should be sent.  

It could also happen that one cannot access his/her account anymore because a password has been changed.

If this happen, bellow are provided the contact details for the most popular email and Social Networking sites providers:

* Hacked account – click here:

* Account is sending spam – click here:

* Help Center – click here:

* Hacked account – click here:

* Inaccessible account – click here:

 * Hacked account – click here:

* Inaccessible account – click here:

* Help Center – click here:

* Hacked account – click here:

* Inaccessible account – click here:

* Hacked account – click here:

* Help Center – click here:

* Hacked account – click here:

TIPS:

* How to choose a strong password:

Watch video : “Creatting a strong password video tutorial”

Read blog post: “Tips for a better, stronger password”

Frequently check your account activity/log in history as explained in this blog post: “Does anyone snoop in your email account? Find out”

If you have any question you could contact: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

Have you seen your digital footprint lately?

Today, E-Crime Expert is featuring a very ineteresting article on digital footprint, provided by the Internet Society. This Article also provides three interactive tutorials developed by the Internet Society to educate users about online identity.

We are the raw material of the new economy. Data about all of us is being prospected for, mined, refined, and traded…

  . . . and most of us don’t even know about it.

 Every time we go online, we add to a personal digital footprint that’s interconnected across multiple service providers, and enrich massive caches of personal data that identify us, whether we have explicitly authenticated or not.

 That may make you feel somewhat uneasy. It’s pretty hard to manage your digital footprint if you can’t even see it.

 Although none of us can control everything that’s known about us online, there are steps we can take to understand and regain some level of control over our online identities, and the Internet Society has developed three interactive tutorials to help educate and inform users who would like to find out more.

 We set out to answer some basic questions about personal data and privacy:

 1. Who’s interested in our online identity? From advertisers to corporations, our online footprint is what many sales driven companies say helps them make more informed decisions about not only the products and services they provide – but also who to target, when and why.

 2. What’s the real bargain we enter into when we sign up? The websites we visit may seem free – but there are always costs. More often than not, we pay by giving up information about ourselves – information that we have been encouraged to think has no value.

 3. What risk does this bargain involve? Often, the information in our digital footprint directly changes our online experience. This can range from the advertising we see right down to paying higher prices or being denied services altogether based on some piece of data about us that we may never even have seen. We need to improve our awareness of the risks associated with our digital footprint.

 4. The best thing we can do to protect our identity online is to learn more about it.

 The aim of the three tutorials is to help everyone learn more about how data about us is collected and used. They also suggest things you need to look out for in order to make informed choices about what you share and when.

 Each lasts about 5 minutes and will help empower all of us to not only about what we want to keep private, but also about what we want to share.

 After all, if we are the raw material others are mining to make money in the information economy, don’t we deserve a say in how it happens?

 Find out more about the Internet Society’s work on Privacy and Identity by visiting its website.

 * Robin Wilton oversees technical outreach for Identity and Privacy at the Internet Society.

If you have any question you could contact: dan@e-crimeexpert.com

 

Does anyone “snoop” in your email account? Find out

E-Crime Expert presents today the basic tips for helping users know if their email account was accessed without authorization by someone else. In order to find out, users could use their sign-in history log or activity logs that are provided by Yahoo Mail or Gmail. Unfortunately, Hotmail does not yet offer such option.

I. Yahoo

Step 1.

Go to Account Info, located under the drop down menu when you click on your name on the upper right corner of your Yahoo page (you have to be logged on).

Step 2.

Then, you will be prompted to introduce again your password in order to Access your Info.

Step 3.

You will be re-directed to the page where all your account info are displayed.

Navigate to the right side bottom of that page to: View your recent sign-in activity.

Step 4.

Click on View your recent sign in activity box and you will be taken to your recent account log in activity that will display the place from were you loged on in the past weeks (Country and City), the IP address from where you were logged on, the Date and the Time you logged on, the Access Type (Browser) and the Event, which refers to the either log in, log out or mail access. If you would like to have a report that goes further in time than two weeks, click on View More option, on the bottom right of that page.

II. Gmail

 Step 1.

Log in your Gmail account and go to your name on the upper right corner of your account. and click View Profile.

Step 2

Then you click on the Account Activity tab and you will be re-directed to another page where you could view the basic information about your all Gmail-related account such as Picasa, Mail, YouTube, etc.

Step 3.

To order your Activity report, click on the Account tab and beside you will see the last Countries you signed in your account and the exact time, you could also order your Account Activity Report.

Step 4.

After you ordered your Google Account Activity Report, from your Account page, you will receive an email Notification in your Gmail account. Open the message and click Open Access Activity report, then you have to type your password again in order to access this Report.

Alternative way for accessing your Gmail Activity History:

 Step 1.

While logged in your Gmail Account, go to the very bottom-right corner of your account and click Details.

Step 2.

Then, you will be automatically redirected to another page where all your recent Account Activity will be displayed: Access Type, Location IP, Date and Time.

III. Hotmail

Unfortunately Hotmail does not provide such a function to access your Account History or Activity Log (as you could see in the picture bellow). Although anyone could send an email to Hotmail’s reps asking for their Activity Log Report. This Report will provide users with a maximum of two weeks of their Activity Log information. Further than two weeks account activity/log in history, Hotmail says, that it will be only provided for law enforcement purpose or requests.

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

Google’s “web history” – a threat to security!

Google having access to our search and browsing history was notorious. But to store all this browsing history in a well-organized file(s) for each user, is really scary! Why? For profiling purposes for example, which I have written about extensively in several blog posts and even my LLM thesis.

But also concerning is that if someone breaks into someone else’s Google account or someone leaves their account on, on a computer or there are family members/roommates sharing a computer. In all these cases, it could be granted full access to all user’s browsing history which can reveal very personal information and possibly even financial information such as bank logins and passwords (if that person chose to tick the box for automatic login). As you could see bellow, the visited page is in a form of a link. When clicked, it takes the user to the linked website, bank account, email account, online store, online purchasing account, which may bring serious security risks.

The very well-structured report on browsing history available now to Google users (when you have an account with Google), with precise dates, times, number of visualizations, browsing history based on different content categories such as blogs, videos, pictures, shopping, maps… and with a perfect synchronization of the information used even between the terminals a user used (e.g. work, home, internet café) it is really concerning.

Picture 1.

-Left: all history on the web, images, news, videos, blogs….

-Middle: web history, visited web links, with the date, time, number of loggins

-Right: calendar from where one could chose the date or time period to see the web history on a Google account.

See bellow Google’s description about this feature:

“Web History records information about the web pages you visit and your activity on Google, including your search queries, the results you click on, and the date and time of your searches in order to improve your search experience and display your web activity.”

Imagine this going hand in hand with the proposed ACTA, even downloading music for your personal use (which is legal in The Netherlands) will be a real threat in regards to policing the Internet and monitoring a user for ACTA enforcement purposes, having access to so much information about user web history including music downloads.

Picture 2.

-material downloaded, time, date and very important, from where it was downloaded.

I have personally considered for some time now that, no one has either anonymity or privacy on the Internet anymore. But in addition to this, now no one has much security either. If for some, the right to privacy is something immaterial, the security issues should be concerning and regarded as something tangible.

If you would like to remove your web browsing history (at least from your account because Google will always have it), follow the steps here:

1. Go to your Google account and on the right side and after you clicked on it, select “Account settings”

2. Go to “View, enable or disable web history” (very bottom of the page) and there click on “Go to web history”

3. Go to “Remove all Web history” and click “ok”

If you receive this message “Your search history is currently empty”, then supposedly your web history has been removed up to that date and time. From then on the history will be again stored under your account.

4. if you would like to turn the web history feature off, just press “Pause”

5. If you would like to have your all web history stored on, press “Resume”.

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Did you know about the web history? Are you going to change your privacy settings? Do you mind about this web history feature?

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

“Cookie” Directive

From the same series which is presenting the European legal framework regarding privacy and personal data aiming the help the readers be aware about their legal rights in order to better protect those legal rights, today it is presenting:

Directive 2009/136/EC amends and supplements Directive 2002/58/EC Concerning the Processing of Personal Data and the Protection of Privacy in the Electronic Communications Sector.

 

Directive 2009/136/EC addresses the issues of unsolicited commercial messages, the use of technologies for telemarketing purpose the use of traffic and location data, public directories and cookies: “a message given to a Web browser by a Web server. The browser stores the message in a text file. The message is then sent back to the server each time the browser requests a page from the server”. Through the implementation of this Directive, which complements and amends Directive 2002/58/EC, a better protection of users’ personal data is aimed at. Additionally, a new framework for disclosure of security breaches from the electronic communication provider to their users is set.

Regarding the access of the stored data (Article 4 E-Privacy Directive), in the view of this new Directive, the electronic communication providers should ensure that users’ personal data can be accessed only by “authorized personnel for a legally authorized purpose”. The new requirement essentially is that the communication service providers should implement security policies regarding the processing of users’ personal data. In regards to this stipulation, the national authorities are granted rights to audit the measures taken by the providers of communication services in regard to security and the processing of users’ data, and could provide best practices and techniques in achieving the best security measures for users’ data protection.

In the view of this Directive, regarding the breach of security, the communication service providers are provided with clear definitions and meanings of security breaches and risks, and the notion of personal data breach has been introduced. The scope of this Directive referring to security breaches is that the communication service providers should take appropriate actions to try stop or reduce the effect of security breaches, inform the user about the data that was at risk or breached, and when well-defined and potential security breaches could occur such as: “accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed in connection with the provision of a publicly available communications service.” The scope of identifying and defining those security risks is that from the moment this Directive will be implemented (e.g. June 2011), every communication service provider will refer to security breaches as to something well determined and are also obliged under the new Art 4 (3) to give Notice of security breaches to the competent national authority and to the user whose data is at risk, suffered an adverse effect or when data at risk could potentially disclose the user’s identity. The Notice is not required if the communication service provider proves that all the technical and security measures available were taken to protect users’ privacy and security breaches.

This directive applies to the collection of personal data placed on a EU user’s terminal (i.e. computer hard drive, smartphone, iPad) by using cookies as a mean of equipment. Consequentially, the EU users are protected against any website that uses cookies (without users opt-in consent),

The Directive requires before any cookie is sent to a user terminal, consent should be obtained. The user needs to express the opt-in consent before any cookie is sent. The user’s terminal is regarded as his personal and private space and an illegitimate installation of a program such cookies, is a privacy intrusion. In addition, if the user gives consent for cookies installation, the user should also be informed about any exchange of private information retrieved from his terminal. Precedent views regarding the user’s browser settings, assumed that if the browser setting allows cookies (i.e. the user set up his browser to accept cookies), then the consent is given. Furthermore, this Directive requires, even if the browser settings allow cookies, still the user must be informed regarding any exchange of private information between his computer terminal and the communication service provider.

For example, when a third-party website which uses Facebook “Like” button (even when the button is not clicked on that particular website, when the user visits it), when it is visited by a Facebook user, because of the cookie assigned to its unique Facebook ID number, makes him identifiable to the third-party website as well. The website “knows” then who is the visitor and can get access to that particular user’s Facebook profile (the “Like” button is designed to post on one’s Facebook Wall the website/business he likes). By getting access to private information this is a breach of this directive because the user should “be informed about any exchange of private information retrieved from his terminal”.

This Directive entered into force as of 2010, but the EU Member States should have transposed it into their national legislation by June 2011.

If you would like to read another E-Crime Expert Article on how the cookie “notification” is actually done in practice, check “Privacy: search for it and claim it“, post.

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Did you know about this Directive? Are you aware of the use of cookies? Are you informed about the use of cookies on your machine?

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

Data Retention Directive

From the same series which is presenting the European legal framework regarding privacy and personal data aiming the help the readers be aware about their legal rights in order to better protect those legal rights, today it is presenting:

Directive 2006/24/EC, on the retention of data generated or processed in connection with the provision of publicly available electronic communications services.

 

Under Article 1 “Scope”, the Directive objective is to establish legal provisions concerning public communications providers in order for the traffic and location data (necessary to identify a user) to be stored for at least 6 month to a maximum period of 24 months. The purpose of users’ stored data is when criminal investigations, detection and prosecution of serious crimes require access to users’ traffic data, the communication service provider has to make it available.

From the definition section point of view, outlined under Article 2 “Definitions”, two new terms are introduced which are not mentioned under the Data Protection Directive.

i)       user ID: refers to a unique identifiable number or sequence of numbers, letters or a combination of two, assigned to users when they subscribe to an Internet Service Provider (ISP) or Internet Communication Service (ICS).

ii)      cell ID: refers to any means which could identify a user in relation with a cellular phone call, by determining the cell phone from where the phone call was made or terminated.

Further, the authorities’ access to the retained data is regulated under Article 5 as following:

i)       any necessary data which traces and identifies the communication type and the person or entity that made it. Here no distinction is made between data in general, private information, natural person or legal person. The access is granted for traffic or subscriber of data.

ii)      any traffic data which is made available through a digital, analog fixed telephony network or mobile network should be retained by the service provider in the scope of this Directive, whether is the calling number or/and the name and address of the user.

iii)    the  Internet ID (e.g. Internet Protocol address) or the VOIP number (e.g. Skype offers phone numbers to its subscribers), should be retained and made available for the scope of this Directive. Furthermore if a user is subscribed to a certain SNS (e.g. Facebook or YouTube) under an ID number or nickname, the identity of that user (if it could be determined) should be provided by that SNS provider in the cases outlined under Article 1 “Scope” of this Directive.

The same categories of information regarding the identification of the communication should be retained as well, as stipulated under Article 5 (b) “data necessary to identify the destination of a communication”. No content data of the communication can be retained.

The duration of retention of users’ data is regulated under Article 6 “Periods of retention” where this period of time should be between 6 months minimum and 24 months maximum.

Article 7 addresses the “Data protection and data security” issue by requiring the communication providers in relation with the stored data, to:

i)       ensure that they have all the organizational and technical means to preserve and protect the data at the same quality as they protect the users’ data in their networks.

ii)      provide all the technical and organizational means to protect users’ data from destruction, alteration, deletion (partial or total), processing, access or unlawful storage.

iii)    make available all the stored data for access only by specially authorized personal.

iv)    destroy all the data after the period of retention expires, except that data which is subject to necessary, appropriate and proportionate measures to safeguard national security, defence, public security, or prevention, investigation, detection and prosecution of criminal offences or of unauthorized use of the electronic communication system, as indicated under Article 15 (1) Directive 2002/58/EC.

Article 8 details that the requirements and standards for retained data are to be transmitted from the communication provider to the authorities, with no delay, and more specifically the users’ data is to be accessible and available in real time.

Article 9 refers to the obligation of providing supervision by the MS on how users’ data is stored, if it is secure, and thus not vulnerable or altered, etc. The supervisory authorities could be the same as described in Article 28 of Directive 95/46/EC.

The scope of this Directive is to require the operators of publicly available electronic communication networks to store and provide location and traffic data (not content data) processed through their networks, to the State authorities (e.g. police, intelligence service, government, etc) for the purpose of serving the detection, investigation and prosecution of serious crimes.

The corespondent national law that implemented this Directive in MS, was found unconstitutional in several countries already: Romania, Germany, Bulgaria, to name few. For the moment this Directive is suspended until will be decided its necessity in the existing form, in a new amended form or at all.

Stay tuned for the next post that will present the Directive 2009/136/EC  known as “Cookie Directive Directive”.

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Did you know about this Directive? Do you think that the retention of data help you stay protected?

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

Cloud computing and the Internet part I

From the same series that aims to contribute to a better understanding regarding why privacy and personal data are so vulnerable in relation to the Internet and its adjacent services/platforms today, E-Crime Expert shows in two different posts (today and tomorrow), what cloud computing is and how it works.

According to Forrester, “Cloud Computing is buying Information Technology (IT) capacities and utilities as need for a utility provider”. Cloud computing is the IT capabilities delivered as an internet-based service, software or IT infrastructure by a service provider accessible through the Internet protocols and accessible from any terminal (e.g. computer or smartphone). These services could be accessible through pay-per-use, pay-as-you-go or the provider could support it from the revenue generate by advertising (e.g. Google docs). One of its main characteristics is customer self-service, which means that the customer needs no assistance in uploading, modifying, accessing her files, applications, documents, etc. It is accessible anytime and anywhere, and has instant scalability.

Cloud computing is delivered under three forms: software as a service (SaaS); Infrastructure as a service (IaaS) and Platform as a service (PaaS).

Software as a service is when someone needs, for example, to create a word document; the person goes on Google docs where the word processor is located and creates the document without having Microsoft Office installed on her computer. The document is created on the server by having access to Google docs, which is a software being used as a service.

Infrastructure as a service is when a business, for example, does not have the technical capabilities to store all its information in house and they need to store and access it on a server. That server is the host that provides service in storing the data. That service rents the infrastructure (e.g storage medium) to the client.

Platform as a service is when the provider offers facilities for application design, development, testing, computer coding or hosting. For example, GoDaddy is a platform service provider as it offers website hosting services to its clients. Another example related to this research is Facebook, which provides the platform for its clients to upload photos, videos, play games, send messages, etc.

Stay tunned for the second part of this blog tomorrow.

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Did you know what cloud computing is? Do you realize that already you are using it?

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

Targeting and profiling users on the Internet for advertising purpose

From the same series that aims to contribute to a better understanding regarding why privacy and personal data are so vulnerable in relation to the Internet and its adjacent services/platforms today, E-Crime Expert shows how targeting and profiling users on the Internet for advertising purpose it is done.

In order to sell advertising, the Social Network Services (SNS) need traffic and also to know what their users preferences are. As similar to TV or Radio advertising, where the commercials are addressed to a certain group of people based on age, sex, needs, preferences (i.e. milk, beauty products, cars, clothes), online advertising has the same goal. But because online the audience is much broader and the target is reached very fast, sometimes in real time, the advertising is offered or delivered differently and it opens huge potential exposure to the audience. In the case of TV advertising, companies provide advertisements and after the post-advertisement sales are monitored for a certain period of time to determine if the commercial clip was effective and reached its target audience.

The audience for TV advertising is established by market studies and questionnaires were the subjects are interviewed in person, anonymously and they have the opportunity to refuse to participate. In the case of online advertising, the profiles of the audience’s preferences are established mostly by the users’ behavior.

Also online and offline advertising are directly connected to the market shares in terms of revenue generated from advertising. In December 2008, according to Mary Meeker from Morgan Stanley publication’s chart named: “Media Time spent vs. Ad spent Out of Whack”, the traditional media which includes TV, radio, and newspapers it is accountable for 8% of the users’ time (in the US) but receives 20% of the advertising money when the online media (the Internet) is accountable for 29% of the user time (in the US) but receives just 8% from the advertising money.

These numbers will balance out between them in the coming five years but in order for the appropriate revenue to be reached and counter-balanced to reflect the real market situation, more online advertising will be generated and produced which implies different ways of approaching and delivering the advertising in order to meet the target (the customers).

More behavioral advertising could be generated along with better user profiling. For example, a user wants to buy something from an online store (which often are advertised or connected to SNS); the user logs in, and first he is presented with the options related to his previous purchases and shopping history on that particular online store. For example, someone shops for Nike shoes, and all the online options are related to the Nike brand based on his previous shopping history. By predicting the user’s preferences based on his shopping history, it is not always accurate because it could be the case that he uses a shared computer where his father regularly uses it, and their personal preferences are totally opposite. Providing a user with products or services based on his shopping history is called targeted advertising. This new type of advertising (i.e. targeted advertising) is seen on SNS and is based on users’ behavior, search history and preferences. However, it is not always the case that the subject’s behavior and search history lead to the subject’s preferences (e.g. the father uses his son’s computer).

The users are monitored for their web browsing history in an attempt to sell them specific products or advertising based on their known preferences. The question, which comes from this model of advertising, could be more complex in terms of: how can someone else’s personal preferences be used for targeted advertising without their acknowledgment?

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Do you feel monitored on the Internet? Does it ever happened to you to be surprised by the advertisng you were delivered on a particular site? Does the advertising changes to you when you are in a different location?

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.