Data Security in Computer Networks and Legal Problems

Transcription

1 Data Security in Computer Networks and Legal Problems Wolfgang Kilian/Andreas Wiebe (eds.) stmv S. Toeche-Mittler Verlag

2 Table of Contents DATA SECURITY IN COMPUTER NETWORKS AND LEGAL PROBLEMS (Kilian) Computer Networks Types of Data Transactions Financial Information Trade Accompanying Information Technical and Research Information Person-related Information Assumed Threats concerning Computer Networks Deficiencies Misuse Complex Required Basic Security Functions Technical Standards and the Law Technical and Legal Model of a Secure Computer Network Levels of Regulations International Conventions and International Administrative Agreements Private International Contracts Law of the European Community National Law Private national contracts Final Remark 20 TECHNICAL ASPECTS OF DATA SECURITY (Jandach) ntroduction 2. Theoretical Concepts of Data Security Data Protection Law "Orange Book" "Red Book" "Green Book" Discussion of the quality requirements "White Book" Criteria of special user groups Practical problems in the context of data security Security Problems in Connection with Stand Alone Computers Identification and authentication Single User Systems Multi User Systems Access rights Object reuse Practical Problems in Networks Network Security Problems in Relation to the ISO-OSI-Model Network-Commands Network security in general Cryptosystems and electronic signature Closing remarks 32

3 OPEN SOCIETIES - CLOSED NETWORKS? (Burkert) Once A Perspective Different Perspectives Observations of Change The loss of tacit restrictions of information technology The Ethical Void Multiplication of risk factors Impossibility to contain the security debate The dialectics of security The Railway Traveller Syndrome The Broken Windows Syndrome The Role of Law The functions of technology law The role of Criminal Law Re-Trusting Technology to Overcome Distrust From Security to Control? 42 INTERNATIONAL AND NATIONAL LEGISLATION ON EDI (Martino/Palmerini) The Electronic Document The Levels of Legislation The International Legal Order National Legal Orders International Instruments Model Interchange Agreements National Legislation: The Situation in Europe National Legislation: The Situation in Italy Positive Law The Law and Civil Procedure Evidence The Signature Electronic Data Interchange Case Law The Facsimile The EDIFORUM (Italy) Standard Agreement Conclusion 56 EEC LAW AND POLICY IN TELECOMMUNICATIONS (Wiebe) Introduction Telematics - technical and economic developments New Regulatory Problems in national telecommunications Demand for European action EEC telecommunications policy and law Network infrastructure Services Competition directive ONP Directive Terminal equipment Standardisation Organisation EEC policies in adjacent fields Data Security Complementary regulation on a case-by-case basis Competition law (Art. 85,86) 74

4 3.2. Freedom to provide services (Art. 59) Free Movement of Goods (Art. 30, 37) Conclusion 78 Table of Community Documents in the Telecommunications Field 80 HOW TO ADVANCE COMPUTER SECURITY BY LEGAL INSTRUMENTS? (Kaspersen) Introduction Information Security Policies The levels of an Information Security Policy Legal obligations Examples in Present legislation ITSEC, a case study Who made it and what for? How docs ITSEC work? Limitations of ITSEC INFOSEC Conclusions as to how Information Security can be advanced 91 LEGAL ASPECTS OF STANDARDIZATION AND CERTIFICATION OF INFORMATION TECHNOLOGY AND TELECOMMUNICATIONS AN OVERVIEW (Stuurman) Introduction The process of standardization and certification Standardization Europe Coordination Other international organizations Further players Certification Legal status of IT&T standards Protection of standards documents and certification marks Standards documents Certification marks Impact on liability Damages Standards and contractual liability Product liability General Standardization and competition law Effects on competition The European Communities: unharmonized standards as a barrier to the internal market De facto standards: the boundaries of cooperation and monopolies Concluding remarks 114 EDI AND NATIONAL LEGISLATION (Riisnaes) Introduction What is security all about More than just technical aspects What kind of networks and data exchange are we talking about 118

5 3.1. EDI: definition Internal networks like PC networks EDI Closed Networks EDI Open Networks The duty to implement security measures General security measures Transmission errors Data log Certification Other rights dependant on certain security measures Transmission and Storage of Accounting Information Acknowledgement of receipt The duty to comply with a request for acknowledgement of receipt What should be the consequences of failing to send such an acknowledgement? Evidential questions Ensuring the admissibility of proof Judgement of strength of proof Regarding the burden of proof 126 DATA SECURITY AND FORMATION OF CONTRACTS (Elias) Introduction The risks and security procedures Solutions adopted by law To anew solution in an EDI-environment? 131 THIRD PARTY SERVICES AND THE CONCEPT OF NEGOTIABILITY (Torvund) Basic third party services Negotiability Liability Conflict of law Conclusions M38 ELECTRONIC DOCUMENTS RELATED TO THE SWEDISH EDI-SYSTEM FOR CUSTOMS AUTHORITIES (Seipel) Documents and related concepts General viewpoints. Lexical definitions Documents and legal language. An illustration - Swedish statutes Characteristics of paper documents from a legal viewpoint New kinds of documents: electronic media and messages Characteristies of electronic data media and messages Documents and the Swedish constitution. The right of access Brief remarks on the development Documents and recordings under valid law. Chapter 2 of the Two doctrines: fixed documents and potential documents Co-ordination with surrounding legislation: decision support, archives, data protection, criminal laws, etc A uniform document concept? The Customs Data System (TDS) Background. The development of the TDS Legal issues: an overview Legal requirements, functional requirements and technical The electronic seal 155

6 3.5. Electronic documents Practical consequences and acceptance Coordinated strategies and legal system management Decisive factors for the development of concepts Private solutions versus regulated and general solutions A co-ordinated system of concepts and standards The notion of legal system management Concluding remarks. Research tasks A legal theory of automated information handling Law and informatics as the suitable framework 160 EDI MODEL AGREEMENTS (Seiler) Present Extent of the Use of EDI A Legal Framework for EDI National EDI Model Agreements The Necessity for EDI Agreements in Germany The Relationship Between the EDI Agreement and the Commercial Contracts Liability for EDI-Risks The Electronic Message as Legal Evidence 170 INSURANCE COVERAGE AND EDI (Rettig/Otto) Engineering and fidelity insurance Insurable risks Property damage Financial loss Summary Third party liablity insurance Bodily injury and property damage Finacial loss Exclusions Legal defense Coverage for pure financial losses 178 ABOUT THE AUTHORS 181