confidential info on old harddrives. - test-drb@ccmp.vtda.org

2 Jun 1999

...
 > As far as publication is concerned, if you publish
sensitive information about a
...
 > person, there may be an action for defamation or
some similar offence even if it
...
   is true.

 Unless that person is in the 'public's eye', like the president? Please
correct me
...
  if i'm wrong. 

I have no idea what the legal situation is for a public figure, but I had always
assumed that in such cases things are published simply because the (financial)
benefits of doing so outweigh the (also financial) punishments imposed by the
law.  I didn't think that the law actually made an exception.

...
 > > I wasn't talking about morals.  I'd
probably find the previous owner and give
...
 > it to
> > them, if they wanted it.  otherwise I'd trash it. I have no use for old
> letters and
> > bank statements....
>
> So you weren't talking about morals.  Maybe you should have been thinking
about
...
 > them, though.  If someone makes a mistake and you
discover it, what should you
...
   (morally) do? 
Exploit it for financial gain?  Or help them put it right?

                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 
 If you read past my first sentence you would have seen my answer. 

I read several of your sentences.  You said something about what you would
probably do and something about what you considered you had a right to do, but
little about what you _ought_ to do.

That said, this is a mailing list, not a private letter.  Such questions are
often inserted for rhetorical reasons, not merely to extract a particular
correspondent's answers.  Should I have written "IAMTA" against it or
something?
IAMTA.

...
 > There have indeed.  Generally after copyright has
expired, which in most
> countries now happens 50 or 70 years after the death of the writer.  In the
case
...
 > of war diaries and the like, these are usually
published with the permission, if
...
   not the active
co-operation, of the author.  This is a useful guide for when
 personal data ceases to be sensitive - 50 to 70 years after the death of the
 person concerned. 
 How long is the copyright for software? 

If the law doesn't specifically fix a different period, and I would be surprised
if it did, it will be just as long as for anything else.

A legal grey area looms here.  What is software?  The text of a personal letter
as typed in a word processor isn't; the source of a program is; but things in
between like spreadsheets, databases, even text formatter source code could have
problems in defining software.  (In this context.  In the context of the
Hardware vs Software debate, for example, all the above are soft)

...
  Regardless, I still _believe_ that it is the seller
who is responsible for the data,
...
  if not morally or legally, than just for personal
safety and/or fear of
 embarrassment, or just paranoia.    This of course is my opinion.  I've never
sold a
...
  computer without first wiping everything off of it,
and i don't have any info i
...
  would consider sensitive or very private stored on
there. 

I agree that the seller has a duty to keep sensitive data safe, and off the
machine if he can.  But I claim that the buyer also has such a duty.  This may
be a cultural difference - in the UK it is still exceedingly impolite to read
someone else's mail without first being offered it by the person concerned, no
matter how close your relationship (genetic or social) with them (I think
husbands and wives may be an exception - still impolite but not exceedingly so)

...
  On the hypothetical about the drug dealer and his
buyers, sellers and account info:
...
  As a (insert your country) citizen, isn't it your
duty to inform the authorities of
...
  such crimes?  Obstruction of justice comes to mind,
for one (U.S.A). 

That is a very nasty moral grey area.  A similar question has been asked by
people repairing video cassette machines: if I find evidence that someone has
gone to great, even destructive, trouble to remove a jammed cassette from a
machine, should I report a suspicion about (e.g.) obscene videos?

I don't have a solution to this moral problem.  I don't know whether I have a
stronger duty to my country (or the laws thereof) or to the person I'm dealing
with.  But I don't think I have a duty to pry where I'm not wanted in order to
incriminate people.  Police detectives are employed for that purpose.

...
  And that situation about the 'shrink' failing
to wipe his drive of very private and
...
  sensitive info before selling it was just plain
irresponsible.  Would he throw out
...
  letters or whole files without first shredding them? 
It is _*HIS*_ responsibility
...
  for those papers, as is it his ethical duty to guard
those papers and files he
 stores in his office.  Heck, the police needs a search order to gain access to
those
...
  files, why should one have access to those files,
paper and other types, simply
...
  because he/she failed to delete or shred them before a
sell? <( or he/she moves to
...
  another office and leaves her filing cabinet at old
office?)   If my information
...
  were in that drive and i found out about it, I would
demand he lost his license for
...
  incompetence. 

You seem to be pointing to a view almost opposite to that you expressed earlier,
here.  If the police need a warrant to examine these files, someone who
accidentally stumbles on them (say on the hard disk of an old machine) surely
cannot have a right to do very much with them...

There is certainly a lot of incompetence there.  And for some of it the cure is
education.  People should know if there is sensitive stuff on the drive.  But
they should be able to trust us to delete it if they can't do so.  I wouldn't
expect the psychiatrist to know how to wipe the drive in a computer that no
longer boots, for example.  But they should know enough to ask us to delete it
when they give us the machine.

...
  I would think that computer files are considered the
same as paper files under the
...
  law, again US law.  Correct me if I'm wrong.

Under UK law, specifically the Data Protection Act, controls on computer files
are stricter than those on paper files.  I don't know all the details of the act
- I suppose now is the time to find out...

...
  Anyways, if we really wanted to find the legal thing
to do, one of us should contact
...
  a lawyer friend that specializes in this.  What
category does this fall under anyway
...
  (the personal information bit, not the software
licenses)? 

The American approach.  Whatever you do, ask a lawyer :-)

I'd err more on the side of Least said, soonest mended.  But I really don't
think this problem will go away.  People who use computers need to be educated
in such matters.  And - I claim - better not by frightening them too hard.

Philip.

**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been swept 
for the presence of computer viruses.

Power Technology Centre, Ratcliffe-on-Soar,
Nottingham, NG11 0EE, UK
Tel: +44 (0)115 936 2000
http://www.powertech.co.uk
**********************************************************************