CZ Talk:Moderator Group/Policy decisions

Email discussions section

Email forgery protections

Apologies if I'm inappropriately posting; please delete or move.

First, it is possible, although not necessarily easy, to make email highly resistant to forgery and other security attacks (e.g., replaying the same legitimate message to affect a poll). In general, these techniques are based on digital signatures.

Just as one example, one of the reasons that US medical practices have been reluctant to use email communications is the possibility of fraud. One workaround is to require patients to use the practice's own email client, accessed through their webpage, and with as strong authentication as possible. Invisible from the user is that it create a digital signature of the message.

A step more challenging is to accept mails from user email clients, which carry the appropriate digital signature. Signing plugins are available for most clients, although the free ones aren't necessarily easy to install.

So, it is possible to create a forgery-resistant email.

If it comes to it, there are also computer forensic methods that are less certain, but can strongly suggest the authenticity of email given a set containing multiple emails, possibly using other contemporaneous communications (e.g., Forum posts).

Dave MacQuigg and Sandy Harris are very knowledgable in these areas as well. Howard C. Berkowitz 15:01, 31 October 2010 (UTC)

Yes, you are allowed to post here.

For all practical purposes, this would only attempt to resolve the effects of "email forgery." It does not address the other issues of "private vs public discussions" and "informed consent". Even if we were to effectively eliminate the issue of potential forgery, we still would have issues related to reading private discussions. However, if everyone accepts that when using cz-resources their discussions are considered public, we can overcome those thresholds. Otherwise, every conversation that you have with anyone can be construed to being public and subject to professionalism guidelines. Then, you say, that we don't have to be as strict because it is not really public and to that I say we get to a point where there are diminishing returns for the constabulary to be wasting time reading and risking their real lives reading personal emails when they aren't going to do anything other than a slap on the wrist. The occasional stalker needs to be reported to the police, because we have no way of protecting anyone. D. Matt Innis 16:01, 31 October 2010 (UTC)

I wasn't trying to deal with the other problems in this post, but only to set aside the issue of dismissing emails because they were easy to forge. A cryptographically authenticated email is not.

In other words, I was supporting the idea of CZ-resources being a viable and secure approach, especially if digital signing was added.

What is your opinion about the ideas that Councils, the Constabulary, etc., must be required to use CZ-based email for communications that go to the entire group(s)? I can't really reconcile an act involving a restricted-access group, available only to the group members (elected or appointed) with any concept of personal privacy. It's much like a corporate or military network where there is substantial authority of the resource owner. At least in U.S. case law, the trend is that there cannot be an expectation of privacy from the resource owner. It gets very complex in situations where there are other expectations of privacy, such as when a hospital owns the resource but it's handling HIPAA-protected information. Military networks can be extremely private in one respect, such as TOP SECRET/SPECIAL ACCESS REQUIRED/POLO STEP over JWICS, but personal privacy isn't a major concern -- security officials routinely monitor, or, in the most sensitive cases, audit when properly requested.

The two cases, about which I am most concerned, dealt with the communications of one elected body member to all the other members. Had those been CZ mailing lists and hosted on CZ servers, the concerns I have raised would be quite within Constabulary oversight. Going forward, I really think our (MC?) policy should require email to be CZ-hosted. It would be nice, Matt, if we could agree on this principle and submit it to the MC.Howard C. Berkowitz 16:48, 31 October 2010 (UTC)

Sanctioning on the fora section

This is for Sanctioning of the fora section