Brett's Ramblings
The Internet is all fun and games until someone gets killed
Let me preface this post:
When I worked undercover, I was one of the most paranoid extremists in trying to be as unrecognizable as possible. I worked cases involving dangerous individuals, career criminals, street gangs, and organized crime groups that operated not only locally, but internationally. While undercover, I was searched, followed, interrogated, and threatened by those I was investigating both inside and outside the US. One night, I had a gun stuck in my belly and quickly learned that the brain is the most important security feature that we have.
Let’s get to the point of where the ethics and morals fit in
So, while on twitter the other day, I saw a “live event” that a plane passenger was tweeting. The passenger and her boyfriend were taking photos and videos of two unidentified passengers and creating a ‘love story’ between them, even to the point of following them to the baggage claim. The two unidentified passengers were unaware of the online event they were the focus of. Even their private comments were being tweeted. The spectator comments only encouraged more of the same, even with T-Mobile CEO John Legere stepping into the tweet stream to offer free WiFi to keep the story going .Voyeurism at its finest, security at its worst. The female victim (I say victim as she had no choice in being the target of online voyeurism) has since been doxed, stalked, insulted, and harassed, leaving her to delete her social media accounts and hire an attorney to speak for her.
The point is that we in the cyber/information security community should take stories like this as ethical and moral reminders. Although personal privacy has been eroded due to haphazard use of the Internet, let’s not be part of that problem. Just as important, educate others to not do this sort of thing either. Any person who touches the electronic data about any other person surely assumes the awesome responsibility of securing that data against inadvertent and intentional release into the public space. Also, creating data where other persons can be negatively affected should be treated no differently.
Some of this is easy. We sign NDAs with clients that legally bind us to protections of client data. We see things in the data that is sometimes embarrassing for clients, yet it never crosses our mind to publicly out the information. We are professionals, both at work and private lives.
Some of this may not be as easy. If you are hunting for, or inadvertently find, publicly accessible data (which should not be publicly accessible) on the Internet, and you have no legal obligation to safeguard the data you find, fall back on ethics and morals. For those who don’t care (ie; no morals or ethics, or just plain evil people) finding and publicly outing embarrassing data causes no dilemma to them; in effect, the hell if someone gets harmed (or even killed) because of it.
For those who do find this data and care about security, do what you ethically are obligated to do, based on what you found, how you found it, and what should legally be done about it. Different situations are different, and if you are ‘ethical’, then you know what you should do.
We live in an amazing technological age that is nothing related to the pre-Internet days as if we live on a completely different planet. Take bullying as an example. The difference between traditional bullying and cyber-bullying is so far apart, we should have a different word for bullying because of the dramatically more harmful effects ‘cyberbullying’ has compared to bullying of days before the Internet. Today, bullying lasts forever, because the Internet is forever.
When we can tweet a thought faster than we can actually think about what we are doing, we risk harming ourselves and others out of sheer carelessness. Consider Twitter like an arrow flown. Any person tweeting about another person, can directly impact that person's life either positively or negatively. The range of effect can also be a small embarrassment to suicide. Wielding the Internet is an awesome power that we treat as serious as putting on our socks.
Even taking photos in public, where bystanders are unknowingly included the photos (legal, as they are in public, right?), photos posted online can have harmful ramifications. Imagine a photo of someone in witness protection, or the victim of a domestic violence, or even an undercover officer who is off duty with family. They may not want images of them on the Internet for good reason. Be judicious in your photos in public places as the last thing you'd want is to hear about a murder victim who was identified by the suspect through your Facebook photo at Disneyland.
So, I propose that in addition to our moral, ethical, and legal obligations of personal security and client data security, we take into consideration the security of others who are doing nothing more than going about their business in public. You might never comprehend the damage done to another person with a photo, a tweet, or social media post that you made. But now that you know, you should be make others aware as well. Be the security pro that can also talk about security outside the CPU. And certainly don't be that person who harms someone else just because you can or because you have no idea that you are doing it in the first place.
**side note**
I'm not referring to being snarky, sarcastic, self-deprecating, or legitimately humorous online. I’m talking about being intentionally mean or ignorant as to the harm done to others through comments and memes. I know that 2019 is already approaching, but the Golden Rule still applies regardless of what year it is.
About the author
Comments
By accepting you will be accessing a service provided by a third-party external to https://www.brettshavers.com/
Posts List
Tag Cloud
Search Blog
Most popular posts
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
Even better, support DFIR Training at Patreon and get access to multiple online courses in digital forensics with included ebooks!
More posts
-
COVID-19’s Investigative Impacts on Digital Forensics/Incident Response (DFIR). AKA: All burners are now burned.
The meat and potatoesA bit is still a bit and a byte is still a byte. COVID-19 cannot change that, which means that the technical…
Saturday April 25
14506 hits / 0 comments
-
Mini-WinFE 10 and WinFE 10 Updated
The short story on the newest Mini-WinFE 10 (aka, the download link):Mini-WinFE has been updated and upgraded. I update WinFE developments (including the downloads for…
Sunday April 05
8974 hits / 2 comments
-
Eat your broccoli first
Something good and something not-so-good on learning DFIRThe good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn and…
Saturday January 18
30154 hits / 0 comments
-
The Second Decade of the 2000s is almost over!
We’ve come a long way in DFIR over the past 20 years, and even looking at just the past decade, the field has drastically grown!…
Thursday December 26
9816 hits / 0 comments
-
Public Records
I have an outstanding public records request. It is not "outstanding" in the manner that I wrote a great request, but "outstanding" in that I…
Thursday December 12
4689 hits / 0 comments
-
The Five Stages of the DFIR Career Grief Cycle
I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig,…
Tuesday September 10
34886 hits / 0 comments
-
Our World is Going to Turn Upside Down with DeepFakes
The short storyAny person and their voice, in practically any video (past, present, or future) can have their face and voice digitally replaced with any…
Sunday September 01
3037 hits / 0 comments
-
If you are comfortable in DFIR, you might be doing it wrong
I took a 3-day basic forensic course and embarrassingly enough, the instructor (in front of the class), said that I probably know everything in the…
Thursday August 29
3991 hits / 0 comments
-
Everything I Needed to Know about Working in DFIR, I Learned in Boot Camp
You don’t need to experience military life to learn the valuable lessons that are drilled into military recruits. In fact, you can probably enjoy the…
Saturday August 17
4932 hits / 0 comments
-
Personality of a computer
From a recent discussion that I had with Harlan Carvey about the registry, this topic is something that I touched on lightly in Placing the…
Wednesday July 31
3936 hits / 0 comments
-
Add a Dab of Balance in your DFIR World
Jessica Hyde’s post of Giving Back in DFIR from 2018 is a great write up on contributing to the DFIR community, and I see her…
Monday June 24
14606 hits / 0 comments
-
The Easy Way to Learn DFIR
SummaryThere is no easy way to learn DFIR. You can stop reading from here if you want.Longer versionOk. Since you are still reading, you probably…
Saturday June 08
13904 hits / 0 comments
-
Game of Thrones, DFIR Style
Short post and quick opinion. I came across some tweets today about how bad people are in the #infosec/#DFIR community and I dug a little…
Thursday April 25
31810 hits / 0 comments
-
Puking in DFIR
Admittedly, the title of this post is intentionally gross, because I am going to heave a few things at you, mainly about puking. As in,…
Wednesday April 17
5765 hits / 0 comments
-
The #1 Reason that DFIR practitioners don’t post opinions
Lesley Carhart tweeted today that a journalist used one of her tweets in an article that would have been rephrased in a less playful manner…
Tuesday April 09
5858 hits / 0 comments
-
If USB flash drives were shaped like spiders, we wouldn’t have these problems
I hate USB drives. My first experiences with the darn things was when I was a young patrol officer and the entire police department was…
Monday April 08
2305 hits / 0 comments
-
Working in DFIR is glamorous, but mostly only to those not working in DFIR...
Here is something about the DFIR career field: it is one of the most exciting, eventful, and jam-packed jobs that anyone can have. Running and…
Friday April 05
3844 hits / 0 comments
-
Overcommitted in DFIR
I have seen people be overcommitted, realize that they are overcommitted, yet continue forward in the most serious of situations. By overcommitted, I do not…
Friday March 22
19018 hits / 0 comments
-
'You're guilty unless you can prove it'
Swift on Security tweeted a great article. The article is not great as a well-written piece or containing earth shattering news piece, but more that…
Saturday March 09
21290 hits / 0 comments
-
“I've answered questions, responded to emails, and been on phone calls...when asked.” – Harlan Carvey
I feel obligated to respond to one of Harlan Carvey’s points in his recent blog post, Book Writing Misconceptions (https://windowsir.blogspot.com/2019/03/book-writing-misconceptions.html). I agree with everything he…
Tuesday March 05
3456 hits / 0 comments
© 2020 Brett Shavers