3 ms·

I wasn't familiar with that document, but I read IV-C-2-b as authorizing this activity: "University employees who operate and support electronic communications

I wasn't familiar with that document, but I read IV-C-2-b as authorizing this activity: "University employees who operate and support electronic communications resources regularly monitor transmissions for the purpose of ensuring reliability and security of University electronic communications resources and services (see Section V.B, Security Practices), and in that process might observe certain transactional information or the contents of electronic communications." This is followed by standard restrictions (only for valid purposes, controls to protect information, etc). They provide a stronger assurance of privacy than I would expect, but still leave plenty of latitude for this activity. Edit: copied and pasted from a PDF. never again..... Further edit: V-B is really interesting and requires user permission "it is necessary to examine suspect electronic communications records beyond routine practices." This is kind of a strange rule, but particularly since they're using a third-party vendor, all of this would easily fall under routine. It's important to note that this policy primarily discusses "disclosure," which I can't see this being considered. It does go to a third party, but one contracted for internal purposes.

toufka 11y ago
Doesn't this: "they are not permitted to seek out transactional information or contents when not germane to system operations and support, or to disclose or otherwise use what they have observed." [4C2b] Conflict a bit with the product's advertised description: "The Deep Session Inspection engine sees every single packet that traverses the network, reassembles those packets into session buffers in RAM, and recursively decodes and analyzes the protocols, applications and content objects in those session buffers in real-time - while the sessions are occurring. This allows XPS to “see deeper” into applications and, in particular, the content that’s flowing over the network." [1] Boiled down: "University employees are not permitted to seek out... content when not germane to system operations and support", juxtaposed against, "XPS reassembles those packets... and content objects... to "see deeper" into applications and, in particular, the content that's flowing over the network." Or do we go all bureaucratic-NSA-legalese and say that, "all content is [could be] germane to some kind of ethereal 'persistent threat'". And that "'automated packet inspection' based on human-generated rulesets is different from a human 'seeking out' content." If so, then there shouldn't even be a privacy carve-out, as there's nothing from which to carve. And the first sentence in the policy is entirely meaningless. [1] https://www.fidelissecurity.com/sites/default/files/ds_fidelis_xps_1509.pdf https://www.fidelissecurity.com/sites/default/files/ds_fidel...
- jcrawfordor 11y ago
  I would argue that reviewing traffic is obviously germane to security monitoring, which is by definition monitoring traffic for security incidents. Edit: Content included. Content is where the bad things go, of course, and a lot of the features that come out of full packet data are the ability to do things like auto-detonation of executable files for malware detection. Extremely content-based detection heuristics.
  - toufka 11y ago
    But would you argue that reviewing content is germane to security monitoring? Content and traffic are very different things. And is that really the (required) 'least invasive' mechanism to achieve a properly functioning network?

toufka 11y ago

Doesn't this: "they are not permitted to seek out transactional information or contents when not germane to system operations and support, or to disclose or otherwise use what they have observed." [4C2b] Conflict a bit with the product's advertised description: "The Deep Session Inspection engine sees every single packet that traverses the network, reassembles those packets into session buffers in RAM, and recursively decodes and analyzes the protocols, applications and content objects in those session buffers in real-time - while the sessions are occurring. This allows XPS to “see deeper” into applications and, in particular, the content that’s flowing over the network." [1] Boiled down: "University employees are not permitted to seek out... content when not germane to system operations and support", juxtaposed against, "XPS reassembles those packets... and content objects... to "see deeper" into applications and, in particular, the content that's flowing over the network." Or do we go all bureaucratic-NSA-legalese and say that, "all content is [could be] germane to some kind of ethereal 'persistent threat'". And that "'automated packet inspection' based on human-generated rulesets is different from a human 'seeking out' content." If so, then there shouldn't even be a privacy carve-out, as there's nothing from which to carve. And the first sentence in the policy is entirely meaningless. [1] https://www.fidelissecurity.com/sites/default/files/ds_fidelis_xps_1509.pdf https://www.fidelissecurity.com/sites/default/files/ds_fidel...

jcrawfordor 11y ago
I would argue that reviewing traffic is obviously germane to security monitoring, which is by definition monitoring traffic for security incidents. Edit: Content included. Content is where the bad things go, of course, and a lot of the features that come out of full packet data are the ability to do things like auto-detonation of executable files for malware detection. Extremely content-based detection heuristics.
- toufka 11y ago
  But would you argue that reviewing content is germane to security monitoring? Content and traffic are very different things. And is that really the (required) 'least invasive' mechanism to achieve a properly functioning network?