Thoughts

I’ve started reading Book 2 in this series - Snow Crash by Neal Stephenson. I’ve read it before, just like the last book, The Cuckoo’s Egg. It feels exciting to revisit a well-known book and take my time with it. I’m thinking of reading 5 chapters at a time, pausing, writing something when I get time (hopefully in a two-week cadence), and then continuing. As I progress, I’m highlighting parts on my Kindle, and I’ll choose one of those highlights to write about, just like I did before.

When I read the quote, “Videotape is cheap. You never know when something will be useful, so you might as well videotape it,” I remembered how we used to bring extra SD cards on vacations in case our camera ran out of space. That actually happened to me a few times. Now, with smartphones, we don’t have to worry about that anymore. Storage is much cheaper than it was 10 or 20 years ago. Because of this, people take a lot more photos, which can fill up their phone storage quickly. Smartphone companies have solved this by offering cloud storage, so your old photos are backed up and it feels like you have endless space. Of course, you pay a monthly fee to Apple or Google for this convenience.

So when friction is removed, people end up creating or consuming far more than they need. If energy becomes cheaper, you might as well record the entirety of your daily life, just in case you need to revisit some moment later. But how much cheaper can energy get? I think, even if we harness a lot more solar energy than we do now and make nuclear energy cheap, and if energy costs are low, usage will exceed production. If people are able to find ways to consume energy so fast, think of AI agents and robots. They could help build incredibly complex systems (like the cars and skateboards in Snow Crash) that consume a lot of electricity super fast. It all seems a bit too much for an ordinary person to handle.

Brief Summary

Chapter 1

• In a near distant future, the world is run by corporations. We’re introduced to a deliverator who delivers pizzas to homes. He has a fancy car. When he is about to pick up the next pizza, the franchise is on fire due to being operated by a new immigrant. So when he gets the pizza to deliver, he is already late.

• If a pizza is delivered late, it’s a big embarrassment for Uncle Enzo, the owner of the chain. He has to visit the customer’s home to apologize in person, and the customer gets a free pizza.

Chapter 2

• As he rushes to deliver the pizza, a courier on a skateboard attaches themselves to his car using a long string to hitch a ride.

• Trying to shake off the courier, the deliverator ends up crashing into an empty swimming pool.

• The courier turns out to be a girl named YT. She offers to deliver the pizza on time. The deliverator thanks her and gives her his card, which says ‘Hiro Protagonist’.

Chapter 3

• Hiro and his friend Vitaly live in a rented storage container that’s 20 by 30 feet and has a door, which makes it nicer than the bunk beds others have. Even though their real-life living situation is basic, Hiro spends time in a virtual world called the Metaverse. There, he owns a big house in a prime spot because he and his friend bought the space early on.

• He was a coder in the past and had helped write most of the initial portions of the metaverse. He now owes the mafia a car (since it crashed earlier and got totaled), and he now makes money by providing intel to the large digital library.

Chapter 4

• YT maneuvers herself through the burbs expertly and delivers the pizza almost in the nick of time, much to the disappointment of the family, who were expecting to celebrate by getting a free pizza.

Chapter 5

• Hiro walks around the Metaverse and sees people walking around. He gets into a pyramid-shaped building named “The Black Sun” that others are not able to enter. He is able to since he knows the owner, Da5id, and he was one of the people who designed it. He is met by a stranger who tries to sell him a drug named Snow Crash, which is a hypercard. A hypercard is a digital card that, if his avatar takes it in the metaverse, data gets transferred from the card to his system. He ignores and moves on.

Notes

Chapter 48: Meeting with DoJ & CIA

Apr, 1987. Cliff flies over to the East Coast and meets Bob Morris at the NSA. They chat about puzzles for a bit. (One puzzle was pretty interesting - Bob asks Cliff to complete this -> 1, 11, 21, 1211, 111221. I tried this for a bit and finally asked Gemini for an answer. The next numbers are 312211, 13112221, 1113213211 … and so on. It is called a Look-and-Say sequence.) Then they go over to the DOJ, where Cliff gets to meet high-ranking officials who ask him insightful questions. The next day, he speaks with the NSA’s X-1 dept. They give him a list of questions, like - 1. How was the penetrator tracked? 2. What auditing features exist?, etc. Cliff feels he needs to make the questions more personal to be able to answer better. So he changes them to 1. How does this scoundrel break into computers? 2. Which systems does he slither into? , etc. Then he goes over to the CIA office at Langley. To his surprise, they give him a certificate of appreciation, wrapped up formally like a diploma, and Cliff is happy. He gets back to Berkeley after that.

Chapter 49: The Letter from Pittsburgh

Apr 22, 1987. The FBI is very much interested in the case now. They are even working on getting a warrant in Europe. Someone named Laszlo J. Balogh sends a letter to the fictional Barbara Sherwin asking for a physical copy of the SDINET files. Cliff immediately informs the authorities. FBI asks him not to touch the file and send it in a glassine envelope. Other agencies are also very interested in this. Cliff asks his sister to find out where the name Balogh originates from. She suggests Hungary. Looks like a Hungarian from Pittsburgh is also part of the hacking operation. Air Force OSI sends over an investigator to look at the letter. Mike Gibbons from the FBI calls often to check on the hacker’s activities.

Chapter 50: Navigating SDINET files again

May 18, 1987. The hacker tries to use x-preserve vulnerability of the vi editor. But Cliff and Dave had already patched this. The hacker goes through the SDINET files and ends up spending a lot of time on those fake files since Cliff had deliberately put long file names that the hacker had to type out to view the contents. When the hacker accesses a major defense contractor, Cliff wonders about the irony of companies that make secure computers for others not being secure themselves.

Chapter 51: Searching for SDI port

June, 1987. Martha is preparing for her bar exam. Cliff remembers his grad school days. He had an 8-hour exam and, after passing that, had a tough oral exam from a panel of 5 professors. The hacker logs in and finds Dave Cleveland’s email that says that he has hidden the port number of the SDI network. The hacker ends up wasting over an hour searching for this. Cliff asks if the arrest warrant is ready, and he said the FBI is working on it and it is almost imminent.

Chapter 52: The Police Raid

June 22, 1987. Steve calls Cliff to inform him that he got a message from Wolfgang at the Bundespost that they have a policeman on full-time watch outside the hacker’s apartment, and once Cliff gives a signal that the intruder is in the network, they are ready to apprehend the culprit. The next day, Cliff learns from Mike that the German police raided the apartment and the office of the hacker, didn’t find anyone, but took floppy discs and printouts. Cliff doesn’t get more details in the next few days, but Mike tells him that it is handled now, and he can close all the holes. He also tells Cliff to keep silent on the whole matter. Cliff decides to write more notes and keep them ready when the time comes to publish.

Chapter 53: Chaos Computer Club

A month before the Hannover hacker was caught, a brilliant programmer named Darren Griffith joined Cliff’s team. Cliff explains the situation to him, and he immediately gets it. He knows Unix pretty well. In the meantime, the Chaos computer club was wreaking havoc on the network just for the fun of it. Cliff doesn’t endorse these methods. He calls them vandals and not people who are exposing flaws.

Chapter 54: The Story becomes public

End of August 1987. This marked the first year anniversary of starting the quest to find the hacker. It was two months after the hacker was caught. The FBI was still asking Cliff to keep quiet about this. Cliff wanted to write and publish his findings. Martha tells him that the First Amendment gives him the right to write what he wants.
To take their minds away from the pressure of the bar exam due in 3 weeks, they start sewing a quilt. Laurie tells them that this should be their wedding quilt. When they were alone, Cliff asks Martha if she would marry him, and she agrees.
By October, Cliff starts thinking about the hacker again. Wonders about publishing and saving further hacking. But it would also enable potential hackers.
By January, Cliff sends his paper to the Communications of the ACM. The paper was scheduled to come in the May issue, the same month they were planning on getting married. But by April, a German magazine, Quick, publishes the results based on Cliff’s logbook notes. This forces LBL to have a press conference and American news outlets to also publish the story.

Chapter 55: Details of the Hackers

The American journalists get to know who the hackers are, and Cliff reconstructs the events once he gets to know the details. The main hacker was Markus Hess, a 25-year-old programmer from Hannover, who was involved with the Chaos Computer Club. There, he got to know a hacker named Hagbard (Karl Koch). Hagbard had a cocaine addiction problem and needed money. Hagbard collaborated with Pengo (Hans Huebner), who had contacts in West Berlin and the KGB. Hess & Hagbard gave information to Pengo, who sold it to the KGB in return for cash. Pengo was just an 18-year-old programmer and was so accomplished that he said he was in it only for the technical challenge. But it is also revealed that he needed money for his computer company. KGB wanted to confirm if the information was correct. So, they contacted Lazlo in Pittsburgh to ask Berkeley for physical copies of SDINET files. The chapter ends with the revelation that Hess was still free on bail and Hagbard, after spending all the money he had, was in debt and had apparently killed himself.

Chapter 56: Rumination

Cliff says it took a lot of crap to make him give a damn, and now he is very serious about computer security. He laments that many people waste their talent breaking into computers instead of helping build great systems that will benefit a lot of people. He considers returning to astronomy.

ps: There are a couple of Epilogue chapters about the Morris worm, which was pretty interesting to read.

Thoughts

The quote - “the shoemakers’ kids are running around barefoot” with reference to the security vendors themselves being vulnerable, reminded me of the recent news of the FBI Director Kash Patel’s emails being hacked.

Security vendors charge millions of dollars for protecting their customers, but they themselves may not be using the safeguards they tell others to use. Also, a high price tag does not mean a great security product. Moreover, even if you pay a lot of money to cybersecurity vendors, you should still be vigilant about your security since no system is fully secure. Only you know about the intricacies of the systems in your company.

Back in 1987, people assumed that being open on the network was okay, and that people would rarely spend the time and effort to prowl around. But that was proven to be false. Now the assumption is that security vendors can provide foolproof security. But that is also called into question. Now, with AI, hackers are able to infiltrate faster than ever.

“Cybercriminals are increasingly operating like highly-efficient businesses, establishing partnerships that have collapsed the window for defenders to intervene from hours down to just 22 seconds.”

source: Google Cloud Blog

Notes

Chapter 42

Cliff tells Martha that he needs to sleep in the office again, and he might be able to catch the hacker this time. She says he already told her this so many times in the past. This time, the hacker logs in and, instead of going through SDINET files, he goes to many other places. Finally breaks into Fort Buckner Army Communications Center. Cliff finds it strange that the time was showing Sunday, though it was only Saturday. He realizes that Fort Bucker is in Japan. Meanwhile, the German Bundespost completes the manual trace and finally finds the exact phone number and location. Cliff, Martha and Claudia celebrate.

Chapter 43

The hacker returns the next day (Sunday) and goes through a bunch of computers across the network, including some Air Force computers in Germany. He breaches the Navy Coastal Systems Center in Florida using a default backdoor password for the Ingres database. Cliff wonders why the hacker copies the password file with all the encrypted passwords. He has done it many times in the past. Cliff talks to Mike Gibbons from the FBI, who tells him that once the US legal attache gives the papers, the German authorities will be able to arrest the hacker.

Chapter 44

Another week goes by, and an arrest has not been made. German authorities are ready to capture the hacker. But they haven’t yet received FBI paperwork from the US legal attache. The hacker breaks into the BBN (Bolt, Beranak and Neumann) computer in Cambridge, MA. They were the ones who built Milnet. So breaking into this computer gave the hacker more range to explore many more computers on the network.

Chapter 45

Cliff is called to a meeting with all the agencies that he’s been working with - FBI, NSA, CIA and DOE. He meets Mike Gibbons from the FBI, Jim Christy from the CIA and Zeke Hanson from the NSA and is happy to put faces to the voices. The discussion goes poorly. The FBI’s stance is that they cannot extradite the hacker since there is not much evidence. 75 cents loss and accessing unclassified information is not a serious crime. Cliff gets to meet Bob Morris, chief scientist at CSC. Bob takes him to Harry Daniels, who is the Assistant Director of the NSA. Daniels is impressed by Cliff’s work. He says this is the first documented case of a network security breach of this magnitude.

Chapter 46

Cliff returns to Berkeley. Martha’s best friend, Laurie, visits. Laurie has some strong opinions about the military and thinks the hacker might be a peace activist. Cliff gets upset by this and tries to explain that the issue is about invasion of privacy and espionage. Later, Cliff gets to know that the FBI has officially closed the case. Cliff finds out that the hacker has broken into Petvax computer, which is used for medical work. Steve White from Tymnet is in town, and he plans to come for dinner. Cliff gets drenched in rain and tries to microwave his shoes to dry, and the rubber melts.

Chapter 47

Cliff gets to know that the hacker uses ‘dictionary attack’ to find out the passwords when the hacker uses an account of a scientist who was giving a lecture in the same building. The password happens to be ‘Messaiah’, a word in the dictionary. This is the reason the hacker was copying over encrypted passwords. He contacts Bob Morris, who says that the NSA has known about the issue for some time. But their main focus is to build an algorithm that can’t be decrypted.

Thoughts

The early vision of the Internet was for it to be a digital world that was vast, free, a shared library or a public park. But that faded away very easily when people discovered that important things could be done online, similar to the physical world. Once money gets involved, values go out of the window, and then laws and regulations are needed to bring back some values. But still, the original free world remains permanently out of reach.

I guess this pattern is similar to how human societies have changed over time. When people didn’t have anything valuable in their homes, they left their doors open or probably didn’t have doors (similar to not having passwords to accounts in the past). But as societies started becoming affluent or when disparity grew, people started having valuables at home that had to be locked up. But they also had laws and police to keep them safe.

Same with the Internet. People have their entire lives on their machines and cloud accounts. Data about people - their family, friends, spending habits, search history, health records, etc. are goldmines for companies wanting to profit. So there has to be some reasonable expectation of feeling safe to interact online. Our digital spaces are extensions of our homes, not public streets. There must be a distinction between what we share publicly and what is not. Just as we use laws and regulations to protect our homes as society becomes more complex, we need digital rules to protect privacy online. When someone breaks into our home, the violation isn’t just about what they take; it’s about the fact that they were there. It is a breach of a boundary. So, digital trespassing is wrong no matter what the purpose is.

The good thing is that there have been many privacy laws in the past decade or so, and things are looking better for the average person, at least in developed countries.

Summary

Chapter 37: Jan 1987 - Getting into Air Force Systems Command

Jan 4, 1987, Cliff and Martha are happily stitching a quilt, and Cliff’s beeper goes off. He finds that the hacker has broken into the Air Force Systems Command, Space Division computer in El Segundo, California. The hacker tries different logins and finally succeeds with ‘field’ account, where he gets access to a lot of files. He tries to print out a list of files, and that gives him a lot of unnecessary file names that he is not able to stop. When he logs out, he is not able to log back in since he had ignored the ‘reset password’ instruction at the beginning of the first login.

The hacker gets back in after a technician resets the ‘field’ account to its original ‘service’ password. This time, the hacker creates a new privileged account under Col. Abrens. Cliff tries calling several agencies for help, but gets nowhere. Meanwhile, Steve starts tracing the call, but says it will take a few hours to manually trace the wires in Germany. Cliff sees that the computer files are ‘unclassified’ and not ‘sensitive’, so there is no immediate alarm. Still, he realizes that someone could collect a lot of unclassified data from a place like the Air Force, piece it together, and gain insights/secrets.

Chapter 38: Bevatron

Cliff gets to know that the hacker is poking around the computers at Bevatron, a particle accelerator used for curing cancer patients. He realizes that the hacker may not know that he is putting real people in danger. The FBI contact at Alexandria informs Cliff that the Oakland office would not handle this since the monetary amount is small and there are no classified documents stolen. Cliff is frustrated with the lack of cooperation and the German Bundespost not getting the search warrant. Martha asks him to find a way to work around the constraints.

Chapter 39: FBI Out and In

The FBI decides that there is insufficient evidence to continue the investigation. They ask Cliff to handle it through the local police, and he feels like he is back to square one. Cliff calls Teejay at the CIA, and then he calls back to say that the FBI is back on the case. The folks at the University of Bremen tell them that the hacker was costing them hundreds of dollars a day.

Chapter 40: SDINET

Martha wakes Cliff up to prepare their tomato garden. During shower, Martha comes up with an elegant plan. Since the hacker is looking for secrets, give him fake documents. Lots of them. They create documents that look like sensitive information under an account named SDINET. They also create a form for the requester to submit an address to send files to.

Chapter 41: The Bait

Cliff sees that “Operation Showerhead” is ready, but realizes he hasn’t asked for permission. He checks with his boss, Roy Kerth, who approves. He also asks the other agencies. They don’t want to take responsibility, but they don’t object. As expected, the hacker logs in, makes himself a superuser, and accesses the files. He even reads the message telling him to provide a physical address to receive all the documents by mail.

Thoughts

When Cliff says, “The hacker wasn’t just poking around a computer. He was playing with someone’s brain stem”, it really gave me chills. I started imagining millions of bots or AI agents roaming the internet, looking for computers to break into. What if a hospital’s computers get hacked, and a bot accidentally causes medical devices to malfunction? An automated script can’t tell the difference between a simple gaming server and a hospital’s life-support system. To a bot, they’re just IP addresses with vulnerabilities to exploit.

In a world where everything is connected, cybersecurity is a branch of public health; in fact, it is a branch of every domain. AI adoption in development is spreading so fast that it makes one wonder if ‘move fast and break things’ could cost us more now than in the past. There is a lot of optimism that we can move much faster than in the past without breaking things. At the same time, the exploiters can also move fast to find vulnerabilities and vulnerable devices to exploit.

Summary

Chapter 31: Slowing down the Hacker

Cliff stayed late on Saturday updating his logbook. Wanted to sleep longer on Sunday, but got paged around 10 when the hacker broke into his system at LBL. He called Steve to trace the call, who confirmed that the hacker was dialing in from Germany. Cliff rushes to his office, but by the time he reaches it, the hacker is gone. But he comes back and tries to log into 30-odd different Army and Air Force locations across the US, but is not successful. When he comes back again later to copy over the password file from the LBL computer, Cliff short-circuits the physical connection to slow down the copy. The hacker gives up after some time.

Chapter 32: Chaos Computer Club

Cliff reaches out to the FBI, Air Force OSI, CIA, etc. His boss, Roy, is upset that he is spending so much time on the hacker. But he doesn’t shut him down. Cliff also browses Usenet for possible news on this. He gets in touch with Bob, a scientist at the Univ of Toronto who is upset about hackers infiltrating his system.
“Bob realized that damage wasn’t measured in dollars ripped off, but rather in trust lost. He didn’t see this as fun and games, but a serious assault on an open society.”
Cliff gets to know about the Chaos Computer Club, whom Bob refers to as vandals, and learns about hackers using pseudonyms like Hagbard and Pengo. Cliff gets a call from Mike from the FBI and exchanges info. Then he calls NSA, talks to Zeke and gives him information that the hacker is from Germany.

Chapter 33: Univ of Brennen Connection

Over the next few days, many people from different agencies call Cliff to get details about the hacker. Even a famous Unix guy named Mike Muuss calls him. Meanwhile, Steve White says he heard back from the person at Bundespost who said that the hacker dialed from the University of Bremen. Zeke from the NSA asks Cliff whether the hacker could be a computer program since he was so methodical and organized. Cliff says some of the typing errors point out that the hacker is human. Steve gets to know that the University of Bremen would be closed for 3 weeks for Christmas.

Chapter 34: FBI Rescue & Hannover Connection

Cliff’s boss, Roy Kerth, asks him to stop working on finding the hacker, saying that this has gone on for too long and they cannot afford it anymore. So he needs to shut down the access to the hacker. Mike Gibbons from the FBI calls Roy and tells him not to stop the investigation. The next time the hacker dials in, Cliff gets to know that the hacker is in Hannover. Things are faster now since Steve has automated a part of the tracing process.

Chapter 35: Search Warrant from the US to Germany

Steve gets to know from Wolfgang at Bundespost that they need a search warrant and a request has to come from ‘a high-level US Criminal office’. Cliff calls Mike from the FBI, and he says they will get the necessary paperwork done through the US Legal Attache. Roy stops by to tell Cliff that DOE (who pays their bills) is going to reprimand them for not informing them. Cliff says he did. His logbook shows he informed DOE two months ago.

Chapter 36: New Year’s Eve of 1987

Cliff and Martha go to SF for New Year’s Eve - Mission District, Chinatown, etc. There were light shows, dancing, etc. (no mention of fireworks, though). The beeper wakes Cliff up in the morning, and he finds that the hacker had broken into the Army’s computer at the Pentagon and was looking at the Army’s plans of nuclear force structures in Europe. When Cliff calls the FBI, he gets to know that Mike Gibbons is no longer working on the case.

Thoughts

Cliff says he was thrown into a loop by Zeek’s question - “If he’s so methodical, how do you know you’re not just following some computer program?” This made me think.

Is being methodical and disciplined not being human? One reason why many corporate leaders, especially from the US, are revered, is because they are so methodical and disciplined in their work. There is a precision in them that common people feel they lack. Being methodical is the hallmark of a professional. There are a lot of self-help books that promise to take ordinary people to that level. Even major religions expect people to strive towards perfection that is not human but divine - like “you need to be perfect as Jesus” - humble, sacrificing, perfect in words and deeds, etc. If AI models that are being trained become more intelligent and handle many of the day-to-day aspects, they might also expect humans to strive to be more perfect, as they are.

But a downside of writing that I see sometimes is that people are not putting that much effort into polishing their writing, fearing that if they write and rewrite and make it polished, it might give the impression that AI wrote it, and now there seems to be some sort of stigma to this. In fact, it is an opportunity to be even more methodical and precise with less effort than before, and it is now accessible to more people than before. In fact, from a work standpoint, we can be more on top of things, write documents and slides easily and actually get time to do more interesting stuff, like talking to people!

From a cybersecurity standpoint, is there now a difficulty in really knowing if the attacker is human or not? Earlier, we could clearly know if an attacker was a bot trying to DDoS through IoT devices or a human accessing unauthorized stuff. But now, an AI agent could perfectly mimic a human, and what could appear as a slow attack targeting a small set of machines could be much larger. But does agentic identity really matter if all that you’re doing is defending your assets? An intruder who violates the confidentiality, integrity and availability of your resources is an intruder who needs to be stopped. I guess it does matter if you need to find out who the intruder was.

Summary

Chapter 24: The Dead End in McLean

Cliff talks with Dan Kolkowitz at Stanford, who thinks he has found their hacker, a high school student who leaves his calculus homework on the system. His name is Knute Sears and the professor is Maher. Dan says there is no such student or teacher there. Cliff wonders if the student is in a school near McLean. He asks his sister, who lives in the DC area, to get McLean High School. She reaches there and finds that it is an elite school of rich kids. There is a teacher named Maher who teaches history, but no student of the name Knute. Cliff gets in touch with Mike Gibbons, an FBI agent who understands computers and Unix.

Chapter 25: Becoming the Hacker

When the hacker disappears for two weeks, Cliff decides to act like a hacker himself to test his ideas about Mitre. He finds that Mitre’s network is indeed insecure, letting anyone make calls across the country at Mitre’s expense. While investigating, he discovers a Trojan Horse program on their Aerovax computer that has been stealing passwords since June. Cliff realizes that Mitre is being used to hide the hacker’s real location, so he asks Bill Chandler at Mitre to send him their long-distance phone bills for analysis. Cliff gets the Mitre phone bills and sees that the call costs were worth thousands of dollars. He uses correlation analysis and writes a program on his Mac to match the hacker’s Berkeley sessions with calls from Mitre. He finds that the hacker has broken into more than a dozen important military and research sites across the U.S.

Chapter 26: The Keck Telescope Program & New Revelation about the Hacker

Cliff’s boss, Roy Kerth, asks him to write a program to model their telescope output. Cliff thinks of putting the hacker investigation on the back burner since it is not his main job. He needs to spend at least a week to learn a programming language in the new “object-oriented paradigm” and then write the program. But after talking to Jerry and Terry, he learns that a professor in Pasadena has already written a similar program. Cliff contacts the professor, gets the program, adapts it for his needs, and has it working by 2 AM. Then he returns to his investigation. After Cliff sees no activity for some time, he checks and finds that Mitre has plugged their security hole. Cliff worries the trail has gone cold. His review of the phone bills leads him to Ray Lynch at a Navy data center in Norfolk. There, he learns the hacker created an account called “Hunter” months before. Cliff realizes the hacker is skilled in both Unix and the VMS operating system, often using default passwords like SYSTEM/MANAGER. This changes Cliff’s view of the hacker: the hacker is not a kid, but a professional or system administrator. He feels that

“he had been following someone in his twenties who smoked Benson and Hedges cigarettes and broke into military computers, searching for classified information.”

Chapter 27: Thanksgiving and the Hacker is back after a 30-day hiatus

Cliff had Thanksgiving at his home with roommates and friends who were mostly musicians or professors. The hacker had been gone for a month, and he wondered why. While he was presenting his graphics display program to the astronomers, his pager alerted him that the hacker was back. He could not publicly say that he was still working to find the hacker, since the 3-week period had passed. So he wrapped up the presentation and went from there. He is unable to trace the hacker, but he is glad the hacker is back.

Chapter 28: Why does the hacker always work around noon?

Cliff asks the key question: why does the hacker work during the day, since he almost always works around noon Pacific Time? The telephone connection would cost more, and generally, hackers work at night. Is he so brazen? Even Martha says that it is unusual. Professional burglars always keep odd hours. Then Cliff realizes that the hacker might be dialing in from abroad. His distance analysis in the past comes back to his mind.

Chapter 29: The Satellite Trace

One Saturday, Cliff searches Usenet and other forums for clues but finds nothing. While looking out over the bay from his roof, his pager goes off. He calls Ron Vivier to trace the call and learns that the hacker is dialing in through an ITT IRC satellite downlink. He also discovers that the hacker tried to access 42 military computers. Ron then connects him with Steve White, an international specialist at Tymnet.

Chapter 30: The German Connection

Steve traces the call and finds that the hacker has the calling address DNIC-2624-542104214, which corresponds to the Datex network in West Germany. Datex is the Tymnet equivalent in Germany. They need to call Bundepost since the post office handles the telephone lines in most countries. Cliff realizes that Mitre was being used to foot the bill for expensive transatlantic calls and to mask the hacker’s identity. He concludes that he isn’t chasing a “mouse” (a curious student), but a rat, a spy systematically searching for military secrets.

Thoughts

Most computer breaches occur because accounts with default passwords are left unchanged. This was true in the 1980s, where the hacker uses default credentials like SYSTEM/MANAGER and gained super-user privileges, and it remains true today. I was reminded of a passage from a book chapter that I wrote in 2018 -

“The moment someone places a device on the internet without changing the default password, it gets added to the army of vulnerable machines used for DDoS attacks. A report from ‘welivesecurity.com’ [27] mentions that ESET tested more than 12,000 home routers to find 15% of them being unsecured. In the article ‘10 things to know about Oct 21 IoT DDOS attack’ [28], Stephen Cobb lists default password as the leading cause. A mashable.com report in 2014 [29] mentions that 73,000 webcams were discovered on the internet because people did not change default passwords.”

Moh, M., & Raju, R. (2019). Using machine learning for protecting the security and privacy of Internet of Things (IoT) systems. Fog and Edge Computing: Principles and Paradigms, 223-257.

While the early days of the Internet opened access to many networked computers, the IoT era opened it even further (same issue, different types of devices). And now, AI agents are exposing it even more. As of now, tens of thousands of people are installing agents like OpenClaw (Clawdbot/Moltbook) on their machines, and there have been so many reports of privacy issues and security threats from these devices. Convenience and the promise of access to a personal AI assistant trump security, I guess.

“Researcher Jamieson O’Reilly went one further, managing to gain access to Anthropic API keys, Telegram bot tokens, Slack accounts, and months of complete chat histories. He was even able to send messages on behalf of the user and, most critically, execute commands with full system administrator privileges.”

Kaspersky. (2024, June 5). OpenClaw vulnerabilities exposed: How attackers can take over smart locks. Kaspersky Daily. https://www.kaspersky.com/blog/openclaw-vulnerabilities-exposed/55263/

Most people probably still think “Why would anyone want to hack me? I’m not that interesting”.

I’m restarting this newsletter and hoping to commit to posting something every week. For a moment, I was wondering if chronological reading of the Cybersecurity Canon made sense or not. I guess I’ll stick to this for a few more weeks and see how it works. Since it has been a while, there is a quick recap at the end of this post.

Summary

Chapter 17: Physics and Echoes

The 3-week period to catch the hacker is over. Cliff wonders if he should just plug the hole in his systems and focus on other things, especially because he didn’t hear back from the agencies that he spoke with. That would mean protecting Berkeley’s systems, but the hacker could be infiltrating other high-value targets. Also, what if there is another security hole that he is not aware of, but the hacker is? When he monitors the hacker using the Kermit file transfer program, he wonders why there is a delay in back-and-forth communications. Then it hits him that he could calculate the distance between the hacker and himself using the time taken for round-trip data transfers, like measuring distance using echo. He finds that there is over 3 seconds of round-trip delay in the hacker’s communications. This could mean that the hacker is really far away because even if the hacker were to use a satellite to communicate, you’d need twelve satellite hops to account for a three-second delay. He deduces that the hacker is using networks that move his data inside of packets, and since the packets are constantly being rerouted, assembled, and disassembled, it might account for the time delay. In the end, Cliff is still uncertain whether the hacker is 6000 miles away or somewhere nearby.

Chapter 18: Pseudonyms and Patience

The hacker’s activity becomes more frequent. Cliff connects with Dan Kolkowitz at Stanford, who is dealing with a hacker using the pseudonym “Pfloyd.” A newspaper article in the San Francisco Examiner conflates the Stanford and Berkeley hackers, leading Cliff to fear the intruder will disappear. However, the hacker returns, proving to be methodical and disciplined. Cliff notes that the hacker remembers exactly where he “laid an egg” (a back-door file) in a system three months prior, suggesting this is a professional rather than a “college joker.”

Chapter 19: The Scrabble Connection

Cliff notices the hacker changed all his passwords to “lblhack.” Through a conversation with Maggie Morley, the lab’s document specialist and a Scrabble enthusiast, Cliff learns that the hacker’s previous passwords “Jaeger,” “Hunter,” “Benson,” and “Hedges”, are linked. “Jaeger” is German for “Hunter,” and “Benson & Hedges” is a brand of cigarettes. This insight gives Cliff a humanizing detail: his target is a methodical smoker with a grasp of German!

Chapter 20: The Halloween Trap

On Halloween, when Cliff is just about to go to the party in the evening, the hacker breaks into a new, mismanaged “super-minicomputer” at the lab called the Elxsi. The hacker exploits a wide-open UUCP (Unix-to-Unix Copy) account to gain system privileges. Cliff finally makes it to the party late and dresses up as a Cardinal. Cliff realizes the hacker isn’t a “wizard” but is simply persistent and knows which “unlocked doors” to poke. To keep up with the intruder without living at the lab, Cliff buys a pocket pager and programs his monitors to alert him the moment the hacker logs in.

Chapter 21: The Bureaucratic “Bailiwick”

Cliff begins reaching out to higher-level government agencies, including the Department of Energy (DOE) and the National Security Agency (NSA/NCSC). Every agency expresses interest but claims they lack the jurisdiction or “charter” to actually help or issue a search warrant. Dejected, he walks around the LBL hallways looking up at the exposed pipes in the ceiling and realizes that he has become personally responsible for the security of the network community.

Chapter 22: The Virginia Trace

Cliff discovers via a law library computer that he doesn’t actually need a search warrant to trace a call made to his own phone, but the phone companies remain uncooperative. Cliff tells his friends Terry and Jerry over lunch about this - that the phone operators trace the call but don’t tell him the number. They look at his notes and see that Cliff had written 703 and C & P and deduce that 703 is the area code for Virginia and C & P could be Chesapeake and Potomac. Jerry asks him to try different permutations. Cliff calls the operator and gives him 6 numbers and says that he got billed for calls from them. The operator is helpful and says 5 of the 6 are not valid numbers. So he is able to narrow down to one number and finds out that it belongs to Mitre Corporation, a defense contractor located just miles from CIA headquarters.

Chapter 23: Reaching Out to Mitre and the CIA

Cliff confirms the Mitre connection by “trading” astronomical posters to a phone technician for a verbal confirmation of the trace. He contacts Mitre’s security officer, Bill Chandler, who is skeptical that a secure site could be the source of a breach. Cliff also calls “Teejay” at the CIA, who is shocked by the Mitre lead but maintains that the CIA cannot involve itself in domestic affairs. Finally, the Air Force Office of Special Investigations (OSI) takes an interest, realizing that the path is leading toward high-level defense and intelligence targets in Virginia.

Thoughts

“It’s not in my bailiwick” is a phrase that is mentioned multiple times in the book. It manifests even today in many ways. Though the bureaucracy is probably less now than in the past, the tendency of ‘it is not my responsibility’ is there everywhere. Say a data breach occurs where a massive corporation loses your data (I’m reminded of Equifax, which was fined over $ 500 million), they might offer a year of credit monitoring and an apology. But who is truly responsible for the “digital pollution” created by that leaked data? Is it the user for trusting the service? Is it the company for failing to secure it? Is it the regulator for not enforcing stricter standards? If the answer is ‘all of the above’, then the actual answer is ‘none of the above’. “Shared Responsibility” has become a buzzword, but what about the knowledge asymmetry? Is everyone involved really knowledgeable about the responsibility they need to take?

Quick Recap (Thanks to NotebookLM)

(this section)

Chapter 13: The three-week time that Roy had given was almost up. At the start, it seemed like a lot of time to identify the hacker, but it turned out to be tougher. The hacker connects again, and Cliff coordinates with a bunch of people - Ron Vivier at Tymnet, Lee Cheng at Pac Bell, AT&T technicians in New Jersey and C & P in Virginia. They successfully traced the call to a specific line in Virginia, but the operator there would not give the number to individuals but only to the police. Also, the California search warrant was not valid in Virginia. Roy is out for a couple of weeks, and Cliff contacts the lab’s lawyer, Aletha, who offers to help.

Chapter 14: The next time the hacker logs in, he uses the Goran account. He reads through some emails and then uses NIC to look for CIA contacts. Cliff wonders if he should warn the CIA or not. He is in a dilemma since he has a bad perception of the CIA as spies and hitmen. He decides to call one of the people about whom the hacker pulled information - Ed Manning. Surprisingly, Ed picks up, shows a lot of interest in what Cliff said and tells him that he’d send people over to Berkeley to find out more info. That spooks Cliff and leaves him thinking what his friends would think of him that he is now working with the CIA!

Chapter 15: Four people from CIA arrive at LBL - a driver, Greg Fennel, Teejay and Mr. Big. Dennis Hall, backup for Roy while he is out, tells Cliff to state the facts to the team and not his assumptions. Cliff explains everything to them. Greg, who is the computer expert, asks him many questions. They get interested when Cliff mentions Anniston. Greg clarifies that Dockmaster is not a Navy shipyard but is run by the NSA. Cliff wonders how the CIA knows so much about computers and networking, and Greg tells him that contrary to what people think, the CIA’s main job is information gathering and analysis. Teejay talks about how they caught someone who was involved in a security breach. Cliff asks if he was ‘bumped off’, and Teejay says - “In God we trust, all others we polygraph”. They had wired the hacker to a lie detector, and the FBI had indicted him. Cliff learns that criminal activities within the nation are not under the CIA’s jurisdiction but the FBI’s. Cliff also gets to know that Ed Manning, whom he spoke to, was the director of IT. He hopes Ed could do something to get the FBI to help.

Dennis’s quote - “We’ll always find a few dodos poking around our data. I’m worried about how hackers poison the trust that’s built our networks. After years of trying to hook together a bunch of computers, a few morons can spoil everything.” reminded me that this is true for all emerging technologies. Even the recent advancements around LLM can be misused by a small group of people and potentially ‘spoil everything’.

Chapter 16: The next day, the hacker logs in to the system in the morning around 9. He accesses computers at Anniston Army Depot and prints out a file about the combat readiness of Army missiles. He then tries Ballistic Research Lab’s computers in Maryland but is not able to get through. Later, Cliff finds that he accessed Livermore Laboratory’s MFE network through the ethernet network. During lunch, Cliff meets Luis Alvarez, a Nobel Laureate who advises him to treat the investigation as research where you don’t know what it will cost or how much time it will take, and the only way forward is to keep exploring and continuously going into uncharted territory. After he sees the hacker accessing a computer from MIT’s AI lab, Cliff decides to disconnect the network over the weekend but gets a lot of complaints from users. Also gets a call from Roy Kerth since some folks had escalated to him. He calls someone at MIT to warn them and finds that the hacker had used the login of a plasma scientist and that the machine that was accessed was going to be thrown away.

Chapter 9 - Cliff talks a bit about Berkeley life and about Martha (his girlfriend) and Claudia (their roommate). On Wed, Sep 17, Cliff notices that the previous night, someone was unsuccessfully trying username/password combinations and wonders if there is another hacker. Later, the hacker uses Sventek login and uses Kermit to upload a Trojan horse program (or a mockingbird program as Cliff called it) to steal passwords. It fails because it is designed for AT&T Unix, not Berkeley Unix. The hacker returns to check the file where passwords should have been copied to and finds it empty. He tries the program a few times, gives up, deletes the file and goes away.

Cliff calls the file transfer program Kermit, as the Esperanto of computers. Back in the day (2000s), Java had the reputation of being able to run across platforms. It was marketed as though it would magically work across platforms, but one had to compile the program into bytecode, and the specific machine had to have the OS-specific JVM installed.

Chapter 10 - The Tymnet traces led them to Oakland’s Bell telephone exchange, but to have a phone trace, they needed a search warrant. Cliff asks Lee Change the trace specialist at Pac Bell but he says he would not help without a warrant. Sandy Merola, who worked for Roy Kerth, discovers that if you log in from Berkeley library’s public PCs, it would dial Tymnet. They decide to check the library computers when the hacker next logs in. The hacker logs in at noon and Sandy goes to the campus library but finds no one there. So that becomes a dead-end.

The mention that phone lines can be traced only when they are connected, reminded me of many spy-thrillers where this was an essential plot element.

Chapter 11 - They finally get the search warrant. They start the trace when the hacker logs in and finds that he logs off immediately. Cliff finds that it is probably because the system operator was seen online and the hacker knows their names/logins by now. So he calls them and asks them to use different pseudonyms. They trace the call to somewhere on the East Coast, possibly Virginia. Cliff says his sister lives there, but this could not be from her. Later, Cliff finds out that though the hacker appeared with Sventek’s login only for 15 mins, he was on the system for over two hours. He was using other dormant accounts - Mark, Goran & Whitberg. He had tried to access three Air Force systems through Milnet using Whitberg’s account and read a few scientific papers.

Two weeks already passed. Cliff had only one more week. I wonder if this would even be possible in modern times. One thing is, when an intruder is detected, usually they are shut down. But there could be hackers exploiting zero-day vulnerabilities and investigators following their trail.

Chapter 12 - Cliff gives a short history of the Internet and its evolution from ARPANET. He compares the Internet to the highway traffic system - which works most of the time but has traffic jams, areas with short-term planning, etc. He finds the hacker attempting to access White Sands Missile Range (WSMR) and tells Roy who says that they should alert the authorities immediately. They call the FBI, who turn their backs again since millions of dollars or classified information is not involved. After a few tries, Cliff finally gets on a conference call with Special Agent Jim Christy of the AFOSI (Air Force Office of Special Investigations) and Major Steve Rudd of the Defense Communications Agency. Cliff calls White Sands also and finds out that they are connected to Anniston base that the hacker had logged in to earlier.

Loved this quote - “Like Einstein’s universe, most networks are finite but unbounded. There’s only a certain number of computers attached, yet you never quite reach the edge of the network. There’s always another computer down the line. Eventually, you’ll make a complete circuit and wind up back where you started.”

Also liked this quote that Cliff had attributed to Nancy Fischer - “To her , the Internet wasn’t just a collection of cables and software. It was a living creature, a brain with neurons extending around the world, into which ten thousand computer users breathed life every hour.” Wow!

—

Afterthoughts

Cliff’s quote “Just like genetic diversity, which prevents an epidemic from wiping out a whole species at once, diversity in software is a good thing” reminded me of the recent Crowdstrike issue1 where a bug in software update caused chaos with many airports, healthcare systems, financial companies not being able to operate due to windows terminals having a blue-screen-of-death. Is there software diversity now? Or has the industry consolidated in the decades past the Cuckoo’s Egg period? There are so many more companies and software fields now but for major things, there seems to have been consolidation - major mobile OSs are iOS and Android, major desktop OSs are Windows and macOS, major web browsers are Chrome and Edge, and so forth. So I’m not so sure. It seems like there are millions of different software tools but it also seems like there is a lot of consolidation. Something to think about.

Chapter 5 - It is Cliff’s second week at the job. He writes notes about the weekend activity of the hacker. The division chief, Roy, comes around asking for details to know if the hacker caused any damage. Cliff says that the hacker is a super user and can potentially delete everything they have or infect the computers with viruses or other malware. They consider patching the vulnerability and locking the hacker out. But, though that might protect them in the short term, without knowing who the hacker is, they might be at risk of the hacker finding another way to break in. Cliff thinks it might be a college student, but Roy dismisses that since they could connect directly. In the end, Roy says this is ‘electronic terrorism’ and asks Cliff to use all the resources they have to catch the hacker and gives him three weeks.

Cliff’s quote - “The astronomer’s rule of thumb: if you don’t write it down, it didn’t happen.”, made me wonder if taking notes is more natural to people in the sciences. Do researchers and academics take more notes than people in other fields - say sports, politics, etc? Not quite, I guess. Note taking is valuable in any field, and famous people like Ben Franklin did have a regular habit of taking notes.

Chapter 6 - Cliff reflects on his relationship with Martha, on how she is the only person with whom he has had a relationship for more than two years. He likes the freedom of live-in rather than the tie-up of marriage. He wonders if this investigation would impact the relationship since he is spending all the time there, including sleeping. At the office, they decide to set up a new Unix-8 computer where data can come in but not go out. This helps them monitor the traffic from all the users. When the hacker logs in, he tries to get into the new computer but is not able to. They notice that he runs `ps -eafg` command which sets off a flag in Dave’s mind (joke - the flags in the ps command set off a flag in Dave’s mind). Ron from Tymnet gets back, saying that he traced the connection from LBL’s Tymnet port into an Oakland Tymnet office, where someone had dialed in from a telephone. Now, to do a telephone trace, they might need legal orders.

Chapter 7 - If they had to ask the phone company to trace the call, they needed an FBI warrant. When they ask the FBI though, they hit a wall since the FBI wants proof that millions of dollars were stolen, and they were wondering why they were bothered by the 75c discrepancy. But they do get the warrant from the Oakland DA’s office. Dave figures out why the flags in the ps command had bothered him. He says the hacker may not be from Berkeley since he was using the old AT&T Unix syntax. The ‘f’ flag is not needed in Berkeley Unix. They find out that the hacker had stolen the password file. Cliff is not worried because the passwords are encrypted using DES algorithm, and breaking that would need enormous computing power.

We now know that DES is not secure. Though AES-128 is mostly used, many sites increasingly use AES-256 to be more secure. I liked this quote - “record observations, apply principles, speculate but trust only proven conclusions”.

Chapter 8 - On Wednesday, Cliff finds out that the hacker had connected to the system for around 6 minutes and had connected to Milnet. Milnet was a network that belonged to DoD. By looking up the IP address, Cliff figures out that the computer was in the US Army Depot in Anniston, Alabama. He contacts the admin there to find out that they already knew about an intruder named Hunter. Cliff explains about the security hole and how the hacker might have been using super-user privileges.

—

FBI in Alabama had also dismissed the case by citing lack of proof and since millions of dollars were not involved. I guess by the late 80s, the Wiretapping Act was in full force, and govt organizations didn’t want to be involved in wiretapping unless there was an absolute need. Set me thinking about the history of the Wiretapping Act and similar regulations. Here is a rough timeline till the ECPA:

1. 1791: Fourth Amendment to the Constitution (“Right to Privacy”)1: Established the right to freedom from unreasonable searches and seizures. Brandeis’ “Right to Privacy” article came in 1890, which many people credit as the beginning of privacy rights, though 4th Amendment existed for 100 years (?).

2. 1934: Communications Act of 19342: Ensured “appropriate authorization to activate interception of communications or access to call-identifying information”; covered telephone, telegraph, TV and radio communication; established FCC.

3. 1968: Omnibus Crime Control and Safe Streets Act of 1968 (Wiretap Act)3: This act required law enforcement to obtain a warrant for wiretaps. The other way to look at it is, it gave authority to do wiretaps for security purposes in the country.

4. 1974: Privacy Act of 19744: This established fair information practice principles (FIPPs), a set of principles for data collection and processing by govt agencies. This gave rise to OECD guidelines which in turn, influenced GDPR, I think.

5. 1978: Foreign Intelligence Surveillance Act (FISA)5: This was the Wiretap Act equivalent for tapping into communications of foreign criminals/terrorists.

6. 1980: Privacy Protection Act of 19806: Protected journalists and newsrooms from government searches and seizures in most cases.

7. 1986: Electronic Communications Privacy Act (ECPA)7 & Stored Communications Act (SCA): Extended the Wiretap Act to include electronic communications like email. ECPA was already passed during the time “The Cuckoo’s Egg” was taking place.

Other Acts after this - 1994: Communications Assistance for Law Enforcement Act (CALEA), 1996: Health Insurance Portability and Accountability Act (HIPAA), 2001: USA PATRIOT Act, 2006: Pen Register Act, 2018: CLOUD Act.

Chapter 3 & 4

The computer center where Cliff is working at, was nestled between three particle accelerators - the cyclotron, the Bevatron, and the Hilac, each of which had some historical significance for scientific discoveries. Even though they were obsolete due to advanced ones in other places, physicists and grad students still used them. Cliff says that their network was open in comparison to the Livermore lab, which was closed to the outside world since they did classified research. Cliff could dial in from home if an issue happened.

I was surprised to read that he could dial into the network from his home, even in the late 80s. I think the ability to work remotely did contribute a lot to the accelerated advancement of software systems in the past couple of decades.

The next morning, Cliff talks about the hacker to Dave who thinks about his philosophy of running an open system and trusting the users so that he could devote his time to building software instead of ‘building locks’. They mention this to Marv, Cliff’s new boss and Roy, the division head. Roy asks them for proof. They were initially thinking of just disabling the hacker’s account and sending him an email, but decide to not do it to get proof.

Dave’s comment about using his time to build software rather than build locks reminded me of SWE sentiments (especially junior folks) on using their time to build software rather than writing tests. Dave’s approach resulted in a security breach. Lack of proper testing almost always leads to tech debt, unstable/unmaintainable systems, and major production outages.

Cliff sets out to monitor all the users logging into their network. He writes a program to beep his terminal when someone connected to the Unix computer, and he could see their names. He could recognize some of them, but many were strangers, and he was wondering how he could identify who the hacker was. Luckily, the next day afternoon, he sees Sventek logging in. He figures out that it was from port tt23 and goes to the hardware lab to find out the physical port where the connection came from. He looks at the logs and finds out that the connection could have come from a dial-up modem using telephone lines running at 1,200 baud.

1200 baud = 120 characters per second ≈ 1.2 kbps (kilobits per second). In comparison, today’s ordinary home computers with cable internet could have 1 Gbps (1,000,000 kbps) speed. That is so incredibly remarkable when you think of it. It is mindboggling to think of the amount of data that is crisscrossing across the world due to this increase in data transfer speed.

While Cliff is trying to find out how to monitor the activity of the hacker, he wonders if it is ethical or not. He asks his girlfriend Martha, who is a law student. She says since the person is breaking in, it should be ok. He initially thinks of modifying the Unix daemon, but Dave says it could be risky, and the hacker might also notice the change. He decides to hook up a printer to each of the connections coming in by taking in monitors and printers from different people in the room. By morning, he notices 80 feet of printout of someone’s activity in the night. Stoll finds that the hacker had used the system for three hours through a Tymnet connection. He figures out how the hacker could have done it.

Every five minutes, the Unix system executes its own program named atrun. In turn, atrun schedules other jobs and does routine housecleaning tasks. It runs in a privileged mode, with the full power and trust of the operating system behind it. Were a bogus atrun program substituted, it would be executed within five minutes, with full system privileges.

Stoll, Clifford. The Cuckoo’s Egg.

Stoll says the hacker had exploited a vulnerability in the Gnu-Emacs editor, which enabled him to move a file to protected systems area and execute atrun program. He likens this to a cuckoo laying its egg in another bird's nest. Once inside, the hacker was reading emails, exploring the lab’s network, and accessing other connected computers, all the while constantly checking for system changes to look for signs of whether he was being monitored. Stoll realizes that he needs to be more subtle in his monitoring.

—

The other thought that crossed my mind was about Livermore Laboratory’s need to create their own operating systems and tools. Even today, many large tech companies do this; they build proprietary software instead of relying on open-source or widely used solutions. Luckily, many tech companies open-source their tools, thereby benefiting the industry. I think in the long run, building bespoke solutions for custom needs, either for oneself or to cater to a major customer, mostly results in tech debt, onboarding challenges for new people, a lack of marketable skills for existing people and an overall cost increase. Custom tools could be ahead of time during that time but eventually could lag behind open-source versions.

Cliff, an astronomer, is transferred from the Keck Observatory at LBL to the computer center at the same place. He is grateful that he has a job instead of being at the unemployment line. He takes an office instead of a cubicle. Near his office were the offices of a couple of experienced people - Dave & Wayne, who have differing opinions of their preferred systems. Dave supports DEC’s Vax computers, and Wayne is the Unix guru. Side note: I guess this was typical of the time. Twenty years ago, I had colleagues who were either Windows supporters or Java supporters, with Java supporters being seen as liberators and supporters of the “free” movement.

On the second day at his job, Dave asks Cliff to look at an issue with the accounting system which failed to account for 75 cents. Cliff takes it up, thinking that the 75-cent discrepancy might be due to a rounding error or some software flaw. There were two systems - one which was the ordinary Unix accounting software and another, built by Dave, that kept detailed records of who was using the computer. He tested both and found no issues with any of the programs. He finally figures out that the error was due to an unauthorized user named “Hunter” who used 75 cents of computer time without being billed. He asks around and finds that no one had added this user and that adding a user was automated and not manual. He deletes the user, thinking that someone set it up wrongly.

The next day, they get an email from a computer named Dockmaster, and the manager tells them that someone from the lab has tried to break into their system in Maryland. While investigating this, Cliff discovers inconsistencies in the accounting records for a user named Joe Sventek, an ex-Unix guru at the lab who was in England. He thinks maybe Joe is back, and the machines are showing different times because of time drift (clocks can go out of sync).

The next day, Cliff is still thinking about this problem even while he is attending a lecture about the structure of galaxies. He thinks about hackers and super-users and realizes that a super-user hacker might have infiltrated their system.

—

There are a lot of things to unpack in the first two chapters. It sets the stage for what is to come. It also gives a glimpse of life from a few decades ago. Even after all these decades, software professionals still do a lot of debugging. In fact, one could argue that most software development is about debugging issues and navigating through a codebase that is already built. In the past, it used to be mainly about debugging production issues, but in the past decade or so, especially after the DevOps practice took off, there has been a lot of debugging around the pipeline itself - debugging test failures during presubmit, integration and e2e test failures, canary failures, partial deployment failures, and so on. A lot of things that were supposed to make work easier, in fact, ended up adding a lot of work. For e.g., integration with static analysis tools showed issues in code, lack of coverage, etc. But it added a lot more work for people who were maintaining codebases already written. Some suggestions were useful, but most were ‘clean up’ stuff to make things look good. Some teams added all the issues into a task-tracking tool like Jira, making the backlog of things to be done huge. In the end, many teams decide to just use the tools to check newly written code. I think AI might help reduce this burden. It could help generate code and write tests that pass all the static analysis tools with flying grades. It could help create tests that are less flaky. So, in a way, people could go back to spending more time on debugging production issues, which is arguably more rewarding than pipeline issues. AI could help with parsing large log files and finding some information, but I think to really debug issues like discrepancies between systems, issues due to race conditions, etc., you need human expertise.

Also, I feel that debugging an issue in production is something that can get you into the ‘flow’ state easily, more than writing code, writing a document or other activities. Once you are in, once you’re unpacking layers and layers of complexity, you could easily be oblivious to lunchtime/friends/family, etc. Even when you come out of it, your mind could still be thinking about the issue. In Cliff’s case, he was thinking about it even as he was attending a lecture on a different topic.

With AI potentially helping with writing clean and more secure code right out of the box and also helping with syntax and some of the nuances of the programming language, people could now focus on building great software. In fact, this might be the golden age for software development. In a recent post by Dario Amodei, the CEO of Anthropic, he says that if there were more intelligent people, there would be more inventions, and one AI is adding to human intelligence at this point. So, we might be entering the world of even more complex software systems that might need even more expertise to debug.

In today's data-driven world, where personal information is constantly in transit, safeguarding privacy has become a paramount concern. Privacy-Enabling Technologies (PETs) have emerged as vital tools to help organizations navigate the complex landscape of data protection laws and privacy policies. In this blog post, we'll delve into the world of PETs, exploring what they are, their significance, and why they're not a standalone solution for privacy.

What Are Privacy-Enabling Technologies?

Privacy-Enabling Technologies, often abbreviated as PETs, encompass a range of technological solutions employed to facilitate compliance with data protection legislation and privacy policies. These technologies not only serve to protect sensitive corporate information but also play a pivotal role in preserving data integrity, ultimately safeguarding an organization's revenues.

The Varied Landscape of PETs

PETs come in many forms, each tailored to specific technological and application needs. Let's take a closer look at some of the key PETs:

1. Encryption: Encryption involves the use of coding techniques to secure data within an information system. It can be implemented as a part of an information system or invoked by the privacy component, offering a robust defense against unauthorized access.

2. Digital Rights Management (DRM): DRM takes a systematic approach to safeguard an enterprise's content and intellectual property. Unlike reactive strategies, DRM focuses on preventing content theft from occurring in the first place.

3. Privacy Rules within Application Programs: Privacy rules should be developed alongside data stewards and implemented within application programs. The advantage of incorporating these rules into a privacy component is that they can be easily maintained and consistently applied throughout an enterprise.

4. Identity Management: Enterprises often assign identifiers to individuals interacting with their systems. Identity management involves creating security components for authenticating system users and determining their authorization to perform specific actions.

5. Privacy Information Services: These services can be plugged in wherever personal information functionality is needed, providing a versatile tool for managing privacy-related tasks.

The Role of PETs in Privacy Protection

While Privacy-Enabling Technologies are undoubtedly valuable, it's crucial to recognize that they are not a silver bullet for privacy protection. Using PETs alone, without a comprehensive privacy engineering approach, is insufficient to ensure full privacy compliance.

Privacy solutions should incorporate well-written policies, standards, procedures, guidelines, and clear notices presented in a user-friendly manner. PETs serve as enablers, integral components within a broader privacy framework, but they are not substitutes for the meticulous planning and design needed to protect privacy comprehensively.

In conclusion, Privacy-Enabling Technologies are indispensable tools in the quest to protect sensitive data and uphold privacy standards. However, they are most effective when integrated into a holistic privacy strategy that encompasses policies, procedures, and a strong commitment to respecting privacy rights. In the ever-evolving landscape of data privacy, a multi-faceted approach is the key to success.

In a recent development, a French Member of Parliament (MP) has stirred headlines [1] by contesting the latest transatlantic agreement that permits companies to freely move data between the European Union (EU) and the United States. This challenge comes as a surprise, especially after expectations that the new framework would resolve all the EU's concerns following the invalidation of Privacy Shield, putting an end to a two-year-long uncertainty. Or may be it was not a surprise since many experts had expressed reservations. Max Schrems had said he would likely challenge [2] the new deal in court after Biden’s Executive order [3] was published.

What is DPF?

Details of the DPF are in Biden’s Executive Order last year [3]. Following is a summary of the EO.

The European Union and the United States have agreed to a new data privacy framework that will allow for the free flow of data between the two regions. The framework, known as the EU-US Data Privacy Framework (EU-US DPF), replaces the previous Privacy Shield framework, which was invalidated by the European Court of Justice (CJEU) in 2020.

The EU-US DPF is a significant development for businesses and consumers on both sides of the Atlantic. It provides a clear and predictable path for businesses to transfer personal data from the EU to the US, and it gives EU citizens more control over their data.

The EU-US DPF is based on four key principles:

• Stronger safeguards for personal data: The framework includes new safeguards to protect personal data transferred from the EU to the US, including limits on US government access to data and a new redress mechanism for EU citizens.

• Transparency and accountability: Companies that participate in the framework will be subject to strict transparency and accountability requirements. They will be required to disclose how they collect, use, and share personal data, and they will be subject to audits by independent third parties.

• Individual control: EU citizens will have more control over their data under the framework. They will have the right to access, correct, and delete their data, and they will have the right to opt out of having their data used for targeted advertising.

• Enforcement: The framework includes a strong enforcement mechanism to ensure that companies comply with its requirements. The US Department of Commerce will be responsible for enforcing the framework, and the EU Commission will have the power to suspend or terminate the framework if it finds that the US is not complying with its terms.

References

[1] https://www.politico.eu/article/french-lawmaker-challenges-transatlantic-data-deal-before-eu-court/

[2] https://www.politico.eu/article/eu-signs-off-on-data-transfers-deal-with-us/

[3] https://www.whitehouse.gov/briefing-room/statements-releases/2022/10/07/fact-sheet-president-biden-signs-executive-order-to-implement-the-european-union-u-s-data-privacy-framework/

Online shoe retailer Hey Dude, Inc. (Hey Dude) will pay $1.95 million to the Federal Trade Commission to settle charges that the company misled consumers by suppressing negative reviews, including more than 80 percent of reviews that failed to provide four or more stars out of a possible five. The FTC also contends the company violated the Commission’s Mail, Internet, or Telephone Order Merchandise Rule in several ways between 2020 and 2022.

Source: https://www.ftc.gov/news-events/news/press-releases/2023/09/online-shoe-seller-hey-dude-inc-pay-195-million-violating-ftcs-mail-internet-telephone-order-rule

In the fast-paced world of e-commerce and remote shopping, consumer trust and protection are paramount. To safeguard consumers' interests and ensure fair business practices, regulatory agencies like the Federal Trade Commission (FTC) play a pivotal role. Among the many regulations enforced by the FTC, the "Mail, Internet, or Telephone Order Merchandise Rule" stands out as a key protection for consumers engaging in remote transactions.

FTC Act: A Brief Overview

Before diving into the specifics of the "Mail, Internet, or Telephone Order Merchandise Rule," let's first understand its parent legislation—the FTC Act. The Federal Trade Commission Act, enacted in 1914, established the FTC as an independent agency tasked with protecting consumers and promoting competition. It prohibits unfair methods of competition and deceptive or unfair practices affecting commerce, giving the FTC broad authority to take action against deceptive advertising, anticompetitive behavior, and other practices that harm consumers or competition.

Mail, Internet, or Telephone Order Merchandise Rule

The "Mail, Internet, or Telephone Order Merchandise Rule," often referred to as the Mail Order Rule, is a specific regulation derived from the broader authority of the FTC Act. This rule is designed to protect consumers who purchase goods through mail, online, or telephone orders. It sets clear guidelines and standards for businesses engaged in remote sales, ensuring that consumers receive their purchases as promised.

Key Provisions of the Mail Order Rule:

1. Shipping Timeframes: According to the rule, businesses must have a reasonable basis for stating that they can ship an order within a certain time. If no specific timeframe is promised, the rule mandates shipping within 30 days of receiving the order.

2. Notice of Delays: If a delay occurs and the business cannot meet the promised shipping timeframe, they must promptly notify the customer. At this point, the customer has the option to cancel the order and receive a full refund.

3. Refund Policies: The rule requires businesses to provide refunds or credit promptly, typically within seven working days after receiving a returned item.

4. Cancellation Rights: Customers have the right to cancel orders that cannot be shipped within the agreed-upon timeframe, and they must be informed of this right by the seller.

5. Notices and Disclosures: Sellers must clearly and conspicuously disclose shipping and refund policies, cancellation rights, and any other important terms before the customer places an order.

6. Toll-Free Contact: For businesses that accept orders via telephone, a toll-free telephone number must be provided for customer inquiries and complaints.

7. Recordkeeping: Sellers must maintain records of customer orders and shipping notices for at least two years.

The Mail Order Rule is crucial because it ensures that consumers are informed and protected when making purchases from remote sellers. It sets standards for honesty and transparency in the shipping and refund processes, reducing the risk of deceptive practices.

In summary, the FTC's Mail, Internet, or Telephone Order Merchandise Rule is a vital component of consumer protection in the digital age. It works in conjunction with the broader authority granted by the FTC Act to safeguard consumers' interests, promote trust in remote transactions, and maintain fairness in the marketplace. By adhering to these rules, businesses can build and maintain consumer trust, which is essential for success in today's highly competitive e-commerce landscape.

The G20 Summit, held recently in New Delhi, India, brought together leaders from around the world to address crucial global issues. Data privacy, digital infrastructure and AI were among the various topics discussed. In their leaders' declaration, G20 leaders renewed their commitment to collaboration on privacy matters, emphasizing the importance of free data flow with trust and cross-border data flows while respecting applicable legal frameworks.

Technological Transformation and Digital Public Infrastructure

In the era of rapid technological advancement, leaders acknowledged the transformative power of technology in bridging digital divides and driving inclusive and sustainable development. They highlighted the concept of Digital Public Infrastructure (DPI) as a means to facilitate societal-scale service delivery. DPI represents a set of shared digital systems collaboratively developed and utilized by both the public and private sectors. It is based on secure and resilient infrastructure, open standards, specifications, and open-source software. Within this context, data privacy plays a pivotal role.

The Role of Data Privacy in DPI

G20 leaders recognize that a safe, secure, trusted, accountable, and inclusive digital public infrastructure must be built while respecting human rights, personal data, privacy, and intellectual property rights. To this end, they endorsed several initiatives:

1. G20 Framework for Systems of Digital Public Infrastructure: This voluntary framework provides guidance for the development, deployment, and governance of DPI, emphasizing the importance of data privacy and protection.

2. Global Digital Public Infrastructure Repository (GDPIR): India's plan to establish and maintain GDPIR, a virtual repository of DPI shared voluntarily by G20 members and beyond, aligns with the commitment to open and transparent data sharing.

3. One Future Alliance (OFA): This voluntary initiative, proposed by the Indian Presidency, aims to build capacity, offer technical assistance, and provide funding support for implementing DPI in Low and Middle-Income Countries (LMICs). It recognizes that data privacy and protection are essential elements of DPI implementation.

Safety, Security, Resilience, and Trust in the Digital Economy

In today's interconnected world, a secure and resilient digital economy is crucial. Leaders emphasized the need for inclusivity, openness, fairness, non-discrimination, and security while respecting legal frameworks. They committed to sharing their approaches and best practices in building a safe and trusted digital economy. Two notable initiatives in this regard are:

1. G20 High-level Principles: Leaders welcomed the non-binding G20 High-level Principles that support businesses in enhancing safety, security, resilience, and trust in the digital economy. These principles emphasize the importance of data protection and privacy as fundamental components of trust.

2. G20 Toolkit on Cyber Education: Acknowledging the significance of cyber education and awareness, leaders appreciated the G20 Toolkit on Cyber Education and Cyber Awareness of Children and Youth. Educating the younger generation about online safety and privacy is crucial for building a secure digital future.

In conclusion, the G20 leaders' commitment to data privacy and digital infrastructure reflects the growing recognition of the pivotal role that privacy plays in the digital age. Their dedication to building secure and inclusive digital public infrastructure, fostering a resilient digital economy, and safeguarding personal data sets a positive direction for global data protection efforts. This reaffirms the importance of collaboration and cooperation on privacy matters in our increasingly interconnected world.

Source: https://www.g20.org/content/dam/gtwenty/gtwenty_new/document/G20-New-Delhi-Leaders-Declaration.pdf

Verbatim Text

E. Technological Transformation and Digital Public Infrastructure

55. Technology can enable rapid transformations for bridging the existing digital divides and accelerate progress for inclusive and sustainable development. Digital public infrastructure (DPI), as an evolving concept and as a set of shared digital systems, built and leveraged by both the public and private sectors, based on secure and resilient infrastructure, and can be built on open standards and specifications, as well as opensource software can enable delivery of services at societal-scale. In our voluntary efforts to make digital public infrastructure interoperable, we recognize the importance of data free flow with trust and cross-border data flows while respecting applicable legal frameworks. We also reaffirm the role of Data for Development.

Building Digital Public Infrastructure

56. We recognize that safe, secure, trusted, accountable and inclusive digital public infrastructure, respectful of human rights, personal data, privacy and intellectual property rights can foster resilience, and enable service delivery and innovation. To this end, we:

• i. Welcome the G20 Framework for Systems of Digital Public Infrastructure, a voluntary and suggested framework for the development, deployment and governance of DPI.

• ii. Welcome India’s plan to build and maintain a Global Digital Public Infrastructure Repository (GDPIR), a virtual repository of DPI, voluntarily shared by G20 members and beyond.

• iii. Take note of the Indian Presidency’s proposal of the One Future Alliance (OFA), a voluntary initiative aimed to build capacity, and provide technical assistance and adequate funding support for implementing DPI in LMICs.

Building Safety, Security, Resilience and Trust in the Digital Economy

57. An enabling, inclusive, open, fair, non-discriminatory and secure digital economy is increasingly important for all countries and stakeholders while respecting applicable legal frameworks. We will share our approaches and good practices to build a safe, secure and resilient digital economy. To this extent, we:

• i. Welcome the non-binding G20 High-level Principles to Support Businesses in Building Safety, Security, Resilience, and Trust in the Digital Economy.

• ii. Welcome the G20 Toolkit on Cyber Education and Cyber Awareness of Children and Youth.

In today's interconnected digital world, where data flows like a lifeblood through the veins of organizations, a well-structured privacy policy is not just a legal requirement but a crucial element in building trust and safeguarding sensitive information. Crafting an effective privacy policy, however, is no simple task; it requires addressing a complex set of competing needs and considerations. In this blog post, we'll delve into the essential components that should be included in a privacy policy.

What Should Be Included in a Privacy Policy?

1. Legal and Regulatory Compliance

One of the primary functions of a privacy policy is to ensure compliance with a labyrinth of local and international legal, jurisdictional, and regulatory requirements. Depending on the global scope of your enterprise, you may need to adhere to a multitude of data protection laws, such as GDPR in Europe or CCPA in California. Your privacy policy should serve as a roadmap for navigating these legal obligations.

2. Business Requirements

Your organization's specific business needs should be reflected in your privacy policy. This includes how you collect, store, and process data in alignment with your industry, services, and products. Your policy should act as a guideline for employees and stakeholders to understand how data fits into your business model.

3. Marketing and Customer Relationships

Permission for marketing and maintaining customer relationships is a critical aspect of your privacy policy. It should define how you collect customer data, what it will be used for, and how customers can opt in or out of marketing communications. Balancing business objectives with respecting customer privacy is key here.

4. Brand Identity

Your privacy policy should align with your brand identity. It should communicate your commitment to data protection and ethical practices. This alignment fosters trust among your customers and partners.

5. Industry Standards

Adhering to industry-specific standards is essential. Whether you're in healthcare, finance, or e-commerce, your privacy policy should conform to sector-specific regulations and best practices.

6. Usability and Accessibility

Consider the usability, access, and availability of your privacy policy for end-users of your information systems. Make it easily understandable and accessible. An informed user is more likely to trust your organization with their data.

7. Economic Pressures and Efficiency

Economic pressures may drive the need for efficient data sharing or relationship building. Your policy should strike a balance between protecting privacy and creating value through data utilization.

8. Enforceability and Ethics

Ethical considerations play a vital role in data privacy. Your policy should reflect your commitment to using personal information and confidential data safely and ethically.

9. Technology Capabilities and Limitations

Consider the technological aspects of your policy. Ensure that it aligns with your organization's realistic technology capabilities and limitations.

10. Multiple Privacy Policies

In complex organizations, multiple privacy policies may be necessary to address the varying needs of different stakeholders, including customers, employees, third parties, intellectual property owners, and data types.

11. External Standards and Guidelines

External standards and guidelines, such as GDPR, GAPP, and PbD, provide a framework for ensuring your privacy policy's compliance within relevant jurisdictional areas.

A privacy policy should be reviewed and updated regularly to reflect changes in the organization's privacy practices and the law. By following these guidelines, organizations can create privacy policies that protect the privacy of individuals and build trust.

Additional Tips

Here are some additional tips for writing a privacy policy:

• Be clear and concise. The privacy policy should be easy to understand and should not be too long.

• Use plain language. Avoid using legal jargon or technical terms.

• Be specific. The privacy policy should be specific about how the organization collects, uses, and shares personal information.

• Be transparent. The privacy policy should be transparent about the organization's privacy practices.

• Be up-to-date. The privacy policy should be reviewed and updated regularly to reflect changes in the organization's privacy practices and the law.

Conclusion

In conclusion, a well-crafted privacy policy is a cornerstone of responsible data handling and a symbol of trust between your organization and its stakeholders. It should be a dynamic document, evolving alongside changing regulations, technology, and ethical standards. As the digital landscape continues to evolve, a robust privacy policy remains your organization's shield against the ever-present challenges to data privacy and security.

Introduction

In the digital age, where personal data flows freely across borders, protecting individuals' privacy has become a critical concern. One pivotal moment in the ongoing struggle for global data privacy occurred with the Safe Harbor Agreement and the subsequent Schrems I case. These events significantly shaped the landscape of data protection, highlighting the tensions between the European Union's stringent privacy standards and the United States' national security interests.

The Safe Harbor Agreement: A Fragile Truce (2000-2015)

The Safe Harbor Agreement, forged in 2000, emerged from extensive negotiations between the United States and the European Commission. It established a framework to facilitate the transfer of personal data from the EU to the US. Under this arrangement, US-based companies could self-certify compliance with seven data protection principles: Notice, Choice, Onward Transfer, Security, Data Integrity, Access, and Enforcement.

While the Safe Harbor Agreement did not require legislative changes in the US, it did grant certified US companies the privilege of an adequacy decision, effectively permitting the flow of European citizens' data across the Atlantic. This move was seen as a potential catalyst for the adoption of EU privacy principles within US companies, but the results were mixed.

Over time, Safe Harbor faced mounting criticism from European Data Protection Authorities (DPAs) and privacy advocates. Allegations of widespread non-compliance with European privacy regulations by US companies eroded trust in the framework. Nevertheless, due to the sheer volume of certified businesses, no immediate action was taken to disrupt operations, but discussions on reforming the agreement began between the European Commission and the US Department of Commerce.

The turning point came with the revelations of Edward Snowden in 2013, exposing extensive US government surveillance of EU citizens and their personal data through the National Security Agency (NSA). These disclosures intensified the debate surrounding Safe Harbor and data privacy.

Schrems I: Challenging the Status Quo (2013-2015)

In 2013, Austrian lawyer Maximillian Schrems initiated a case with the Irish Data Protection Commission (DPC) that would send shockwaves through the data privacy world. Schrems questioned Facebook's practice of transferring personal data from the EU to the US under the Safe Harbor framework.

Schrems argued that US laws did not adequately protect his personal data on Facebook, given the NSA's access to Facebook data once it arrived in the US. He contended that this arrangement violated the EU Data Protection Directive (DPD). However, the Irish DPC initially dismissed his appeal, citing Facebook's Safe Harbor certification as proof of compliance.

Undeterred, Schrems escalated the case to the Irish High Court, which, in turn, referred it to the Court of Justice of the European Union (CJEU). In a landmark decision in 2015, the CJEU ruled in favor of Schrems, effectively invalidating the Safe Harbor Framework.

The CJEU's decision was grounded in four key issues:

1. Lack of Verification: The adequacy decision on Safe Harbor was implemented without validating the US's mechanisms to ensure an adequate level of data protection. Without proper verification, Safe Harbor certifications were rendered invalid.

2. US Law Supremacy: The CJEU found that US law often superseded Safe Harbor principles, necessitating periodic evaluations of adequacy by the European Commission.

3. Inadequate Review: The CJEU determined that the US's data protection practices had not been rigorously reviewed, and the adequacy requirements lacked documentation.

4. Fundamental Rights Violation: The CJEU objected to US national security and law enforcement requirements overriding Safe Harbor rules, leading to violations of fundamental rights guaranteed by the EU Charter.

Conclusion: The Shifting Sands of Data Privacy

The Safe Harbor Agreement and the Schrems I case fundamentally altered the data privacy landscape. They exposed the inherent tensions between national security imperatives and individual privacy rights, leading to a rethink of data transfer mechanisms between the EU and the US.

In the wake of Schrems I, the Privacy Shield Agreement attempted to fill the void left by Safe Harbor, but it too faced legal challenges. In an earlier blog post, we had spoken about Privacy Shield and Schrems II. In later blog posts, we’ll talk about the current proposed DPF and the legal challenges it is facing.

In an age where personal data is the new currency, safeguarding privacy has become a fundamental concern. Enter "Privacy by Design" (PbD), a concept championed by Ann Cavoukian, the commissioner for information and privacy for the province of Ontario, Canada. PbD was conceived to ensure that privacy isn't an afterthought but rather a core element in the design and development of technology and systems. Let's dive into this visionary approach and explore the seven foundational principles it teaches.

The Genesis of Privacy by Design

The concept of Privacy by Design was introduced to counter the prevailing notion that privacy could be bolted on after a technology or system was built. It aimed to give individuals greater control over their personal information and empower enterprises to protect data effectively. Its significance was underscored in 2011 when the International Data Protection and Privacy Commissioners recognized PbD as an "essential component of fundamental privacy protection" at their 32nd annual conference.

The Seven Foundational Principles of Privacy by Design

1. Proactive not Reactive; Preventative not Remedial

Privacy should be a proactive endeavor, not something addressed reactively once issues arise. Preventing privacy breaches is more effective and less costly than trying to remedy the situation afterward.

2. Privacy as the Default Setting

PbD asserts that privacy should be the default setting for any system or technology. Individuals shouldn't have to take action to protect their privacy; it should be inherent in the design.

3. Privacy Embedded into Design

Privacy should be seamlessly integrated into the design and architecture of systems, processes, and practices from the outset. It should not be a feature tacked on as an afterthought.

4. Full functionality—Positive-sum, not Zero-sum

Privacy and functionality should coexist harmoniously. The design should aim for a "positive-sum" relationship, where both privacy and functionality are maximized, rather than a "zero-sum" trade-off.

5. End-to-End Security—Full Lifecycle Protection

Privacy should be protected throughout the entire lifecycle of data, from collection to storage, processing, and disposal. It's not enough to protect data at one stage while neglecting others.

6. Visibility and Transparency—Keep it Open

Users should have visibility into how their data is being collected and used. Transparency breeds trust and empowers individuals to make informed choices about their data.

7. Respect for User Privacy—Keep it User-Centric

Finally, PbD emphasizes a user-centric approach. It respects individual privacy preferences and empowers users to have control over their data, including the ability to consent or withdraw consent.

The Impact of Privacy by Design

Privacy by Design isn't just a theoretical framework; it has practical implications:

• Data Protection: By embedding privacy into the design, organizations can minimize the risk of data breaches and regulatory non-compliance.

• Trust Building: PbD fosters trust between businesses and individuals. When people know their privacy is prioritized, they are more likely to engage with technology and services.

• Legal Compliance: PbD aligns with many privacy regulations, such as GDPR's "Privacy by Design and Default" requirement, making it an invaluable tool for compliance.

• Ethical Data Use: It encourages organizations to use data ethically and responsibly, addressing concerns about the misuse of personal information.

Embracing Privacy by Design

In a data-driven world, where privacy breaches make headlines regularly, Privacy by Design is a beacon of hope. It shifts the paradigm from privacy as an afterthought to privacy as a fundamental building block of technology. As individuals and organizations alike become more privacy-conscious, embracing PbD is not just a choice but a necessity to navigate the complex landscape of data privacy, gain trust, and ensure the ethical use of personal information. It's time to make privacy not just a feature but a foundation.

In today's digital age, the protection of personal information has become a paramount concern for individuals and organizations alike. Regulations like the GDPR and CCPA have set stringent standards for data privacy, forcing companies to adopt comprehensive approaches to safeguard sensitive data. One such framework that aids in this endeavor is the Generally Accepted Privacy Principles (GAPP), developed by the American Institute of Certified Public Accountants (AICPA). In this blog post, we'll explore what GAPP is, its significance, and how it helps organizations maintain robust data privacy practices.

Understanding GAPP

GAPP, developed from a business perspective, serves as a guideline for organizations to effectively manage privacy risk and compliance. It references various local, national, and international privacy regulations but consolidates these complex requirements into a single privacy objective supported by ten privacy principles. These principles are the foundation upon which organizations can build their data privacy frameworks.

The 10 GAPP Principles

1. Management: This principle emphasizes that the entity should clearly define, document, communicate, and assign accountability for its privacy policies and procedures. In essence, it sets the tone from the top.

2. Notice: Transparency is key. The entity must provide clear notice about its privacy policies and procedures while identifying the purposes for which personal information is collected, used, retained, and disclosed.

3. Choice and Consent: Individuals should have a say in how their data is handled. The entity should describe the available choices and obtain explicit consent regarding the collection, use, and disclosure of personal information.

4. Collection: Personal information should only be collected for the purposes specified in the notice. This principle ensures that data isn't gathered arbitrarily.

5. Use, Retention, and Disposal: The entity should limit the use of personal information to the purposes outlined in the notice and retain it only for as long as necessary, as per legal requirements. Once its purpose is fulfilled, appropriate disposal methods should be employed.

6. Access: Individuals have the right to access their personal information for review and updates. This principle underscores the importance of data accuracy.

7. Disclosure to Third Parties: Personal information should only be disclosed to third parties for the purposes stated in the notice and with the consent of the individual.

8. Security for Privacy: Protecting personal information against unauthorized access, both physical and logical, is crucial. This principle ensures data security remains a top priority.

9. Quality: Maintaining accurate, complete, and relevant personal information is vital for upholding privacy standards.

10. Monitoring and Enforcement: The entity must continually monitor compliance with its privacy policies and procedures. Additionally, it should establish mechanisms to address privacy-related complaints and disputes promptly.

Implementing GAPP

Frameworks like GAPP provide a solid foundation for developing comprehensive data privacy policies, processes, procedures, standards, guidelines, and mechanisms within an organization. By aligning with GAPP, companies can:

• Enhance Trust: Building trust with customers and partners by demonstrating a commitment to safeguarding personal information.

• Mitigate Risks: By adhering to the principles, organizations can significantly reduce the risk of data breaches and non-compliance with privacy regulations.

• Streamline Operations: GAPP offers a structured approach, making it easier for businesses to streamline their data privacy efforts and ensure that everyone in the organization is on the same page.

• Enable Global Operations: As GAPP references international privacy regulations, organizations can apply its principles when conducting cross-border data transfers, thereby simplifying compliance with varying privacy laws.

• Customer-Centric Approach: GAPP promotes a customer-centric approach to data privacy, ensuring that individuals' rights and choices regarding their data are respected.

Conclusion

In an era where data privacy is non-negotiable, Generally Accepted Privacy Principles (GAPP) provide a comprehensive framework for organizations to navigate the complex landscape of privacy regulations. By adhering to these principles, businesses can not only protect personal information but also build trust with their stakeholders, reduce risks, and demonstrate a commitment to ethical data handling practices. As privacy concerns continue to evolve, GAPP serves as a valuable resource for organizations striving to uphold the highest standards of data privacy and security.