{"id":365,"date":"2010-06-21T03:25:17","date_gmt":"2010-06-21T03:25:17","guid":{"rendered":"http:\/\/rigf.asia\/?page_id=365"},"modified":"2024-01-25T06:49:59","modified_gmt":"2024-01-25T06:49:59","slug":"hong-kong-igf-june-17th-2010-session-3","status":"publish","type":"page","link":"https:\/\/event.rigf.asia\/2010\/hong-kong-igf-june-17th-2010-session-3\/","title":{"rendered":"Hong Kong IGF \u2013 June 17th, 2010: Session 3"},"content":{"rendered":"

Security, Openness and Privacy<\/span><\/p>\n

________________________________________________________________________<\/p>\n

REAL TIME TRANSCRIPT: Security, Openness and Privacy<\/p>\n

Hong Kong IGF
\n 14:30-17:00, Thursday 17 June 2010
\n Hong Kong<\/p>\n

DISCLAIMER: Due to the inherent difficulties in capturing a live
\n speaker’s words, it is possible this realtime transcript may
\n contain errors and mistranslations. An edited version of the
\n realtime transcript which amends the inherent errors, will
\n be posted later. LLOYD MICHAUX and APrIGF accept no
\n liability for any event or action resulting from the
\n contents of this transcript.<\/p>\n

________________________________________________________________________<\/p>\n

>> : Our session will soon begin.<\/p>\n

Please be seated.<\/p>\n

Welcome back, this session is about issues of
\non-line security, openness and privacy.<\/p>\n

May I now invite Mr Ken Ngai, Project Manager of be
\nnet wise internet education campaign and Mr Stephen Lau,
\nchairman of the organising committee, to start the
\nsession for us.<\/p>\n

Mr Lau and Mr Ngai, please.<\/p>\n

>> Stephen Lau: Thank you.<\/p>\n

Ken and I are co-moderating this, because we have
\na good panel and we just want to ensure that logistics
\nare well covered.<\/p>\n

If you recollect that this morning, Mr Markus Kummer
\ndid talk about in IGF, there are a number of major
\nissues which are usually covered in the annual IGF
\nforum, the global one.<\/p>\n

This is a Hong Kong IGF conference and I think it’s
\nonly relevant that we use the same categories, the same
\nissues, to look at these issues in the light of the
\nspecificity relating to Hong Kong.<\/p>\n

We have access and diversity and now this is about
\nsecurity, openness and privacy.<\/p>\n

I just want to mention that the issues of security,
\nopenness and privacy on-line context, are interwoven,
\nwith proposal to strike a balance between them.<\/p>\n

This session will examine in practical and policy
\nmaking level, how to balance access to knowledge,
\nfreedom of expression and also of equal importance, the
\nintellectual property rights in the virtual world, from
\nthe perspective of scholars, academics, practitioners,
\ntaking a 360 kind of perspective.<\/p>\n

We will cover the practical aspects of the
\ncoordination, to secure the network, for example, to
\nfight spam, relationship to issues relating to openness,
\nlike the open architecture of the internet and cyber
\nsecurity, cyber crime, identity theft, identity fraud
\nand information leakage.<\/p>\n

Other issues child protection on line — it’s a very
\nwide scope in terms of security, openness and its
\nlinkage and interaction with privacy, all interacting.<\/p>\n

We do actually have, as I said, an illlus introduce
\nco-moderator, we have to speakers and three panellists.<\/p>\n

May I just very briefly, for the sake of time,
\nbecause the CVs and bios are in our programme
\npublication in the booklet.<\/p>\n

Briefly, on my right-hand side, Mr Ken Ngai, who is
\nthe Website Director for Hong Kong Federation of Youth
\nGroups. He’s responsible for all technical aspects of
\nthe website development for the group and also in terms
\nof engaging youth on-line.<\/p>\n

He’s also the Project Manager for a well-known
\nproject in Hong Kong, which is the largest internet
\neducation campaign called Be Netwise in Hong Kong that
\nwas funded by the Hong Kong Government.<\/p>\n

On my left is Mr Micheal Jackson, name very easy to
\nremember, associate professor in the faculty of law of
\nthe Hong Kong University. He specialises in criminal
\nlaw and procedures, equity and trust and cyber crime.<\/p>\n

Very active in the local and the regional legal
\nscene, including as a membership of our law reform
\ncommission.<\/p>\n

On his left is Mr Nigel Mendonca, regional director
\nfor Symantec Host Services in Asia, responsible for
\nmanaging all sales across corporate and enterprise
\naccounts, as well as partnership accounts.<\/p>\n

He is in Hong Kong for many years, so can provide
\na very relevant perspective to the issues we are
\ndiscussing specific for Hong Kong.<\/p>\n

As for our three panellists in that order, Priscilla
\nLiu, director of Against Child Abuse in Hong Kong, since
\n1983.<\/p>\n

Responsible not only in managing the agency, but
\nalso supervising advocacy of children’s right and
\nprotection to ensure their rights are our community.<\/p>\n

She has numerous awards and recognitions in
\nHong Kong and internationally.<\/p>\n

Just to include one, for example, the Hong Kong
\nhumanity award for 2009.<\/p>\n

On her right is Charles Mok. Charles, I don’t think
\nhe needs much introduction, but everybody here doesn’t
\nneed much production. There’s a protocol. He’s
\nexecutive director of Computer Society Ltd and Media and
\nInternet Consulting Company.<\/p>\n

He’s chairman of Internet Society in Hong Kong, as
\nwell as honorary past president of the Hong Kong
\ninformation technology federation, a well recognised
\nprofessional in ICT in Hong Kong and in the region. He
\nhas many community roles, including member of the
\nHong Kong Government’s digital 21 strategy advisory
\ncommittee, as well as a member of the consumer council
\nand also you should all know that he’s an active
\nblogger.<\/p>\n

Finally and not the least, Mr Anthony Fung, from
\nMicrosoft. He’s the regional investigation manager,
\nparticular in the investigation of cyber crime and also
\nvery well experienced for the job for his current
\nposition as a former Hong Kong Police inspector.<\/p>\n

We have a very knowledgeable moderator, we have to
\neminent speakers and three notable panellists.<\/p>\n

Let me kick-start this.<\/p>\n

Earlier on, I mentioned about this session, which is
\nsecurity, openness and privacy.<\/p>\n

They are all interlinked, how are they interlinked
\nif what are the dependencies in what are the implication
\non each other? I think it will be really relevant to
\nhave our moderator expert in this to provide a short
\npresentation to set the scene, to understand what we are
\ngoing to talk about and then we go into depth with our
\nspeakers and our panellists.<\/p>\n

>> Ken Ngai: Thank you.<\/p>\n

As Stephen mentioned, we are going to cover this
\ntopic, actually three distinct words, security, openness
\nand privacy.<\/p>\n

This seems to be very distinct, but actually they
\nare interlinked and today I want to start off with some
\nvery short presentations about some phenomenons happens
\nin Hong Kong.<\/p>\n

So that we can start our discussions.<\/p>\n

Same as the other sections, that if anybody from the
\nfloor would like to express your idea, feel free, either
\nin Cantonese or English, whatever language that you feel
\ncomfortable.<\/p>\n

First, openness.<\/p>\n

I would like to show you some examples. This is one
\nof the screen captures that a got from a very common,
\npopular website in Hong Kong. You probably know this
\nwebsite already.<\/p>\n

It seems, I would say seems, it’s a girl of 18 years
\nold calling for a sex partner. This sort of message is
\nposted in the website without any barriers, anybody can
\nsee it, can view it, can participate, can respond.<\/p>\n

Another website screen is about a girl stating, she
\nsaid that she involved in compensated dating.<\/p>\n

She talk about her experience, her 10 experience
\nwith taking this kind of trade activities, shall we
\ndescribe it.<\/p>\n

The third case I would like to share with you is
\nsomething I think everybody knows about this case, cyber
\nbullying case, basically a lady is not happy with what
\nthe pricing of the shop and then she post some
\nvideolinks on the web and eventually, she got the
\nbullied by other people for her act.<\/p>\n

All her personal information were revealed on the
\nwebsite afterwards and she cannot stop the attempt.<\/p>\n

Another thing I would like to highlight here is in
\nthe website, in actually is what we call exhibition of
\nspiral of silence on the web.<\/p>\n

What I mean is because many people actually on the
\nweb think that they are minority or they don’t know
\neither they are minority or they are majority. So when
\nthey express their view, they’re not sure if they will
\nget attacked or they are the minority or majority.<\/p>\n

A fear is about this.<\/p>\n

Peel will be unwilling to publicly express their
\nopinion if they believe they’re in the minority.<\/p>\n

They will also be more vocal if they believe Tai are
\npart of the majority.<\/p>\n

Thus, more marginalised you become and less you
\nspeak and so spiral into a fully marginal position I did
\nsome sort of research and I show you some status I cans
\nlater on.<\/p>\n

Here is another within site called she.com.<\/p>\n

What I would like to show you is the number of views
\nthat you can see. The number of views is 2,200
\nsomething, by actually there are only over 600 replies.<\/p>\n

Over the 600 reply, actually only 35 people involved
\nin this.<\/p>\n

It generate a lot of response, it generate a lot of
\nopinions and if you count it, from these 2,000 views,
\nminus this 35 people, actually over 2,000 from other
\npeople, I suppose.<\/p>\n

Probably their views, their opinions are largely
\ndriven by these 35 people.<\/p>\n

I’ll show you another example here.<\/p>\n

This is another forum. Start from April 15
\nto April 21. We see total views is over 18,000 and
\ntotal number of replies 255.<\/p>\n

Only 200 something people reply, you United Kingdom
\nuser replies.<\/p>\n

Again, there are over 18,000 views, actually not
\ngenerated from these users, are others.<\/p>\n

When we express our opinion, it’s a large number of
\npeople getting affected, but not the original users, but
\nothers, just readers.<\/p>\n

Another one, same thing happens. About 6,000 views
\nwith only 28 unique users.<\/p>\n

If you are good eyesight, you probably can see the
\ntopic, what they describe.<\/p>\n

It’s in Chinese, but I state that it’s a question
\nasked if someone want to rape his sisters.<\/p>\n

So this is the thread topic to discuss. So you see
\na lot of people get involved in viewing of this content,
\nbut not actually involved in give out their opinions.<\/p>\n

Again, this is the same thing, same situation.<\/p>\n

Same thing happens.<\/p>\n

Again, here, another blog. This blog is from
\nI think it’s a girl. She actually post in her blog
\nabout her experience of abortions.<\/p>\n

I don’t have the statistic how many people actually
\nhas viewed this, but this is quite popular, because when
\nI search this, this rank quite high in the search
\nengine.<\/p>\n

This one recently happened. It’s a friends page in
\nFacebook. Having a group of people actually saying that
\nhow they want to harm themselveses and they cut their
\nhands with cutters and so on.<\/p>\n

I block some very bloody pictures. If you want to
\nsee, I will show you later.<\/p>\n

If we see that there are about 500 people join in as
\nfriends and I didn’t count how many people actually post
\nphotos there.<\/p>\n

From here, we can see I think in Hong Kong, nobody
\nwill deny that we are open to content. People can post
\nvery open content, any kind of content that we are able
\nto put it on the web.<\/p>\n

The second thing that we are going to discuss is
\nabout the privacy issues.<\/p>\n

I think most of you here, I suppose, over
\n90 per cent of you here, will have a Facebook account.<\/p>\n

But I doubt how many of you actually has viewed the
\nprivacy setting of Facebook.<\/p>\n

How many of you actually can understand what that
\nmeans to you?<\/p>\n

You know the privacy setting has been changing.
\nI think the last change happened in April.<\/p>\n

When we, most of us here, for example, don’t know
\nwhat that means to us, how do we configure to the way
\nthat we want?<\/p>\n

I show you one more statistic. This I grab from
\nFacebook. From the statistic, that have over
\n400 million active users already in the world.<\/p>\n

Over 50 per cent of active users log-on to Facebook
\non any given day.<\/p>\n

On average, every people has about 130 friends on
\nFacebook.<\/p>\n

Actually, we can see from esface book it is
\ncollecting a lot of policy information and we don’t know
\nhow we control it and Facebook has the legal
\nestablishment in Hong Kong.<\/p>\n

How do we control? How do we protect ourselves,
\nwhat information that we should disclose to other
\npeople?<\/p>\n

It’s a great question, that we probably need to
\naddress.<\/p>\n

Activity on Facebook, I’m going to cover later.<\/p>\n

Platform.<\/p>\n

Facebook as everybody knows, this is a great
\nplatform for people to interact and for marketers.
\nA lot of marketers nowadays target very much on Facebook
\nmarketing, more than traditional marketing.<\/p>\n

What marketers or Facebook developer actually can
\nretrieve from your Facebook account, we don’t know. I’m
\ngoing to show you a little bit about this.<\/p>\n

Facebook define their own social on-line privacy.<\/p>\n

But it is not according to our ordinance in
\nHong Kong or other ordinance in other part of the world.<\/p>\n

Do we need to redefine what privacy is about?
\nBecause this is actually a dynamic thing that changing
\nmaybe every year, every two years, privacy means
\ndifferent things.<\/p>\n

Do we need to redefine it?<\/p>\n

Lastly, the security risks. I like to do it
\na little different. I try to define it. It’s current
\nof occurrence of an event beyond our expectations, in
\nterms of the adverse consequences, especially adverse
\nconsequences, if it is not, we probably likely happen,
\nbut some sort of risk that we don’t want it to happen
\nand beyond our control.<\/p>\n

If it happens, actually beyond our capability to
\nmanage.<\/p>\n

There are human and technical risks on-line.<\/p>\n

Many of you probably can have involved before in
\nFacebook games, Facebook survey, for example.<\/p>\n

But are these just games?<\/p>\n

Actually, these games developed through this game to
\naccess to some of your information.<\/p>\n

I like to show a little bit more to you.<\/p>\n

For example, I think many of you will see this icon
\nbefore. This big thumb here: like.<\/p>\n

Everybody thinks I click it because I like this.<\/p>\n

But what’s behind the scene is our information is
\npassed on to this website particular and passed onto the
\ndeveloper and they know who actually has pressed this
\nbutton.<\/p>\n

Facebook through this can actually collect a lot of
\nintelligence, maybe product intelligence, know what you
\nlike, because Facebook also got all the other personal
\ninformation from you. So that they can better prepare
\nthemselves for any marketing campaign, targeted directly
\nto you or to your friends.<\/p>\n

Here is one discussion about Facebook leaked user
\nnames, user ID, personal details to advertisers.<\/p>\n

As for developer, probably to know, Facebook has
\nanother mark up language, of course Facebook query
\nlanguage, from which actually a developer can, through
\nFacebook interface, to access some of the user
\ninformation, such as, for example, when you get involved
\ninto Facebook game, they know you play the game and they
\ncan also access your friends list, for example.<\/p>\n

You cannot imagine, when I play the game, it’s
\njust — it’s not just you, your friends get involved
\ntoo.<\/p>\n

Social engineering is very getting popular in the
\nworld.<\/p>\n

This is one quiz happened on Facebook a while ago
\nbefore.<\/p>\n

I put this as an example here, to show you what’s
\nactually behind it that they can do about it.<\/p>\n

Apparently this quiz is actually just test your
\nknowledge, how secure your password is.<\/p>\n

But at the end of the day, if they get this
\ninformation, actually they can, through this, to do some
\nsort of social engineering by statistics, Sam data
\nmining techniques and then they can filter out those who
\nhave very weak password and then they can start off the
\nattempt.<\/p>\n

I actually have tried to cover a little bit about
\nthese three words in three sequence of slides and then
\nI think we can start our discussions.<\/p>\n

Let me pass the time to Mr Nigel.<\/p>\n

>> Stephen Lau: Ken, you have given us a short, but very
\ninformative look at these three issues of security,
\nprivacy and openness, through websites and web pages to
\ndemonstrate its effect and, both in positive, as well as
\nMostly so far, in terms of the negative impact, in those
\nthree areas.<\/p>\n

There is an opening statement to get give you a feel
\nof what you are talking about.<\/p>\n

Now let’s look deeper in some of the issues with our
\ntwo speakers.<\/p>\n

The first one is from Nigel Mendonca, who
\nI understand will speak on development in the on-line
\nthreat landscape and methods of protecting individuals
\nand organisations against them.<\/p>\n

>> Nigel Mendonca: Thank you.<\/p>\n

Good afternoon, ladies and gentlemen, thank you for
\nyour time this afternoon.<\/p>\n

Just very quickly, Symantek Hosts Services is the
\nsoftware as a service business unit of Symantec and the
\nreason that that’s important is because of the or
\nrelevant is because there’s a very rapidly changing
\nlandscape in on-line threats and the technology that we
\nuse and that a number of other companies similar to us
\nare starting to deploy more rapidly, is really all about
\ndeploying technology, information and technology from
\nthe internet to a machine dynamically in real time, as
\nopposed to having that information sit on the machine
\nitself.<\/p>\n

From a security point of view, for example, we run
\na global network of data centres that has access to
\nrealtime information. We have a huge amount of
\nlegitimate and illegitimate information, harmful
\ninformation, going through our data centre network on
\na global basis. We process around about between 6 and
\n9 billion emails every single day through our data
\ncentres.<\/p>\n

If you accept the fact that over 9 a per cent of all
\nemails around the world in the internet are spam these
\ndays, that means that there’s an awful lot of spam and
\nmalicious content that goes through our data centres on
\na daily basis.<\/p>\n

What that means for us & Cos like us that are
\nproviding internet based technology or you might have
\nheard the term cloud computing or hosted services. What
\nthat means is that we have the ability to dynamically
\ncapture those new and emerging threats in realtime and
\ndeliver the most up to date realtime protection to all
\nof the companies and individuals that are using our
\ntechnology.<\/p>\n

The differences that the traditional way of
\nproviding information, security, internet security is by
\nhaving what is called signature based technology
\nresiding on the machine itself.<\/p>\n

So if you’re an individual, it resides on your PC.
\nIf you’re an organisation, it resides on your servers
\nand then every single time a new type of internet
\nthreat, whether it’s a new spam technique or whether
\nit’s a new virus technique is detected, then the
\nsecurity company responsible for managing that has to
\nwrite a patch, specifically to protect against that new
\nthreat, has to do the testing and then deploys it to all
\nof their end users & Cos around the world and then
\neventually, you are protected against that new threat.<\/p>\n

That update timeframe can take anywhere from
\na couple of hours to a couple of days.<\/p>\n

The whole thing about the cyber crime industry is
\nthat it’s an incredibly rapidly moving industry, so
\nreally that window of vulnerable from the time a new
\nthreat is released into the marketplace, until the time
\nthat that consumer and businesses are protected against
\nthat, that is specifically targeted. That window is
\nspecifically targeted by all the cyber criminals
\nglobally and really they can do an awful lot of damage
\nin the space of just a few hours.<\/p>\n

Globally, we are seeing a significant trend towards
\ncloud computing or software as a service based
\ntechnology, because it offers companies and individuals
\nthe ability to be protected, a lot more comprehensively
\na lot quicker.<\/p>\n

From Symantec’s point of view, we have a huge data
\ncentre network, as I said, we process between 6 and
\n9 billion emails every single day and we scan around
\na billion websites every day.<\/p>\n

We protect around 9.2 billion end users across our
\n14 data centres globally.<\/p>\n

What that give us is a unique ability to see a huge
\namount of new and emerging threats and be able to
\nprotect organisations and individuals in real time, but
\nalso to provide a lot of insight into the new and
\nemerging threats.<\/p>\n

We work proactively with other organisations in our
\nindustry as well as industry bodies and government
\nbodies to help try and update and protect and educate
\nthe markets to try and stem the tide that seems to be
\nreally proliferating through the internet.<\/p>\n

If we go to the next slide.<\/p>\n

Really, what we are seeing, some of the key trends
\nthat we are seeing in the internet threat landscape are
\nmore sophisticated email threats, so if you look back
\nprobably even as little as three or four years ago, over
\n9 a per cent of emails, malicious emails or viruses,
\nI should say, were delivered as email attachments.<\/p>\n

So you receive an email, you open up the attachment
\nand all of a sudden your machine is infected.<\/p>\n

These days, over 90 per cent of malicious software
\nor malware as it’s called is delivered via an internet
\nlink within the email, the URL link. So that’s probably
\none of the biggest changes.<\/p>\n

Why that is significant is there is a convergence of
\nemail threats and web threats, because all of those URL
\nlinks take the user to a malicious website. It’s not
\njust a malicious email, it’s a malicious website as
\nwell.<\/p>\n

Again, a new an emerging trend over the last few
\nyears is that previously, malicious websites in the
\nmarket tended to be reasonably obvious. So they might
\nhave been questionable websites, whether it was gambling
\nwebsites or pornographic websites or different things
\nlike that.<\/p>\n

These days, there are more and more legitimate
\nwebsites being comp miced. So people browsing the web,
\ncompletely legitimately, going to their banking website
\nor going to a shopping website or might be an
\nentertainment website, a news website even, there’s more
\nand more businesses having their legitimate websites
\nbeing compromised and hosting malware on those websites.<\/p>\n

If you go back to the email scenario, it doesn’t
\nhave to be somebody deciding to buy some pharmaceuticals
\non line or a university degree on-line or something
\nquestionable like that. It can be something that looks
\ncompletely legitimate and they click on the link to go
\nto what they think is a legitimate website and all of
\na sudden, it’s taking them to a malicious website and
\nbefore they know it, they are infected.<\/p>\n

The other things that we are seeing are more and
\nmore instant messaging is certainly a growing trend in
\nthe consumer space, but it’s becoming more and more
\npopular for businesses and business use as well.<\/p>\n

The cyber criminals, because most businesses now
\nhave a reasonably good level of protection for stop
\nemail threats and web threats, the cyber criminals are
\nseeing instant messaging as I guess a gap in their
\ntechnology and protection armour and they are targeting
\ninstant messaging for the same sorts of things, viruses
\nand what they call spim.<\/p>\n

I have spoken about the websites as well.<\/p>\n

It really is a converging threat landscape.<\/p>\n

The bad guys out there, the cyber criminals are
\ntargeting multiprotocol technologies, so as a consumer
\nor as a business, we highly recommend that organisations
\nstart to think about multi-protocol protection as well,
\nbecause, really, it’s a bit of a game of cat and mouse,
\nthe cyber criminals versus the security companies and
\nthe cyber criminals are really trying to target the path
\nof least resistance and any vulnerable that they will
\nsee they will target it as best they can in the shortest
\npossible time and as soon as a defence comes up against
\nthat, they will target something else.<\/p>\n

If we go to the next slide, some of the things that
\nwe are seeing in our annual intelligence report, we saw
\nlast year over 73 million different types of malicious
\nsoftware and these are not just different downloads or
\ndifferent instances of malware, they are actually
\ndifferent types.<\/p>\n

For a security company to protect you against this,
\nthey need to issue 73 million different patches. That
\ngives you an understanding of the sizeable task that
\nwe’re up against.<\/p>\n

We stopped over 60 billion different types of spam
\nand again, it’s not different — that’s not 60 billion
\nemail, it’s 60 billion different types of spams. Again,
\nthat’s the magnitude a things that we’re up against.<\/p>\n

In Hong Kong specifically, Hong Kong has the dubious
\ndistinction of consistently being at the top of the
\ncharts when it comes to global spam rates. Every now
\nand then, somebody comes and knocks us off our perch,
\nbut we always tend to fight our way back up and be
\nresilient and head back to the top. The global spam
\nrates in April were 9.9 per cent. In Hong Kong, we were
\njust above that, 91 per cent.<\/p>\n

You can see the trend lines there. The rest of the
\nworld dipped down for a little bit, Hong Kong was still
\npretty consistent. The rest of the world is catching
\nup. I’m not sure whether that is a gad thing or a bad
\nthing,.<\/p>\n

The interesting thing is to ask ourselves the
\nreasons why that’s the case. There’s a couple of
\nthings.<\/p>\n

First of all, Hong Kong is a , let’s call it a ,
\nwell, probably a multilingual society, but from a spam
\npoint of view, definitely English language and Chinese
\nlanguage spam.<\/p>\n

A lot of other countries have one or the other.
\nHong Kong has a significant proportion of both English
\nlanguage and Chinese language spam.<\/p>\n

The second significant thing is that, obviously, we
\nall know Hong Kong has a significant banking and finance
\nindustry and any geographic area with a high proportion
\nof banking finance businesses and industry professionals
\nworking within that industry tends to be targeted,
\nbecause I guess the association is that there is money
\nto be made within that industry.<\/p>\n

The third thing which is probably driving having
\na really significant impact on this, is the proximity to
\nChina and the massive growth in broadband internet
\nadoption in China.<\/p>\n

Obviously, broadband internet adoption and the
\nability for individuals to access the net leaves more
\nand more people vulnerable and essentially delivers
\na larger target market for the cyber criminals.<\/p>\n

Because Hong Kong is in such close proximity and
\nbecause of the other factors that I mentioned, it tends
\nto be more of a target. So we definitely think that
\nthat’s going to continue to be the case.<\/p>\n

From a virus point of view, you can see there, just
\nin the last couple of months, Hong Kong has come under
\nthe global rates, but it tracks fairly significantly.<\/p>\n

As you can see, a few months back, it was above the
\nglobal rates and again, that’s synonymous with the
\nfactors that I mentioned earlier on.<\/p>\n

What does 2010 hold. Some of the things that we are
\nalready seeing is that from a spamming point of view,
\nspammers will continue to be nimble and adopt new and
\nmore sophisticated types of threats and the other thing
\nis that botnets, so botnets are essentially groups of
\nrecruited PCs, individual consumer PCs, that somebody,
\nfor example, downloads a malicious file and a all of
\na sudden, their home PC is compromised and recruited and
\ncan be remotely controlled to the a lot of things that
\nthe end user doesn’t even know that they are doing, but
\na centralised cyber criminal is controlling those and
\nrecruiting them into Burma we call a botnet, using them
\nto be either a file server or to send out spam or to do
\na number of different things. Essentially using their
\npower and their reach to recruit and perform these
\nillegitimate activities.<\/p>\n

The different governments around the world have been
\nsuccessful in intercepting different ISPs and bringing
\nthem down and stopping the facilitation of a lot of
\nspam.<\/p>\n

But whenever we see that, we literally within
\na matter of days, that the global spam rates, they come
\ndown pretty sharply, when these things happen, but
\nwithin a matter of days, they are back up at their peak
\nlevels.<\/p>\n

What it tells us is that global cyber crime is
\nincredibly difficult to control and it’s not a case of
\nnecessarily governments or individuals or businesses
\nbeing able to step up and do more, it’s a case of really
\nabout collaboration and education and trying to stay one
\nstep ahead of these guys.<\/p>\n

We saw last year that the spammers broke or decoded
\nthe capture technology, which is the automated, for
\nautomated personal emails account. I’m sure everyone
\nhas seen it. If you sign up for a new account, it
\ndelivers you a set of five or six different characters
\nand you have to key those characters in to prove that
\nyou are the person that’s opening the account and you’re
\ndoing it manually.<\/p>\n

Obviously, the cyber criminals are wanting to build
\nas many of these accounts as they possibly can in the
\nshortest period of time, so the capture technology has
\nnow been updated, so apparently the cyber criminals are
\ngoing to have a more difficult time for a while at least
\nin breaking this.<\/p>\n

The next thing that we have seen is that the cyber
\ncriminals or the spammers are trying to use real people.
\nBasically, like internet sweat shops, for people in
\nemerging technologies, to get a huge amount of low paid
\npeople, literally in front of computers, opening
\naccounts, whether it’s gmail accounts or hotmail
\naccounts or all different types of free internet
\naccounts, they’re opening them manually and then the
\ncyber criminals, the guys that are running these sweat
\nshops are selling all those accounts.<\/p>\n

They are going to a very manual means of opening
\nthese accounts and selling them off, but they’re really
\ncoming up with any type of new means of doing this that
\nthey can.<\/p>\n

The other thing that we think we’ll see an increased
\namount of in 20010 is non-English spam.<\/p>\n

Even in Hong Kong, that does receive a significant
\namount of English and Chinese language spam, by far the
\nmajority is English spam, over 80 per cent.<\/p>\n

We definitely see and we are seeing all around the
\nworld a larger amount of non-English spam.<\/p>\n

Globally, English spam accounts for about
\n95 per cent of all spam. But that is changing and
\nnon-English language spam is catching up.<\/p>\n

If you think about it, again, the security companies
\nout there protecting companies and individuals, their
\nexpertise and the thing that they’re best at is stopping
\nEnglish based spam, because that’s what they see the
\nmost of.<\/p>\n

Again, the cyber criminals are targeting something
\nthat they see as a gap in the marketplace and that is
\nthe ability to stop non-English language spam. So they
\nare really focusing on that.<\/p>\n

We heard a little bit more about earlier about
\nsocial engineering. With the proliferation of social
\nengineering websites like Facebook and linked in and my
\nspace and these types of things, there’s a huge amount
\nof personal information available on the internet. Just
\nabout everybody on the in this room has some personal
\ninformation on the internet.<\/p>\n

What we are seeing more and more of in relation to
\nthat is really highly targeted attacks.<\/p>\n

It’s almost like if you think of it like targeted
\nmarketing, not too many companies in the industry these
\ndays spend their marketing dollars just doing shotgun
\nmarketing, broad based marketing to anybody and
\neverybody.<\/p>\n

They have all got a target market and they are all
\nsending a specific message by a specific means to people
\nthat they think are going to be more interested or more
\nlikely to be interested in their message.<\/p>\n

The bad guys, the cyber criminals are starting to do
\nthe same thing by taking information from social
\nnetworking sites to find out what are my interests,
\nwhere do I live, what’s my geographic proximity, what
\nindustry do I work in, what are my demographic — what’s
\nmy demographic profile, what industry associations am
\nI associated with, all these types of things.<\/p>\n

So that what they can do is send people like me and
\neverybody else in this room, a message that’s highly
\ntargeted. So when you receive it, there’s a strong
\nchance that you will think that is a legitimate email,
\nfrom a legitimate body, that is simply sendsing you
\nsomething of personal interest.<\/p>\n

What they are doing is including malicious links in
\nthat email to take you to a website that probably looks
\nlike a legitimate website, but as soon as you click on
\nsomething, you will download a piece of malicious
\nsoftware.<\/p>\n

The days are gone when by downloading a peace of
\nmalicious software, your whole machine shuts down or
\nyour address book all of a sudden starts to send out an
\noffensive message to everybody in your address book.<\/p>\n

That doesn’t happen any more. That was kind of
\nnuisance attack.<\/p>\n

These days, it’s more about silently downloading
\na piece of malicious software that gives these guys
\naccess to your personal information.<\/p>\n

Their whole objective is to stay under the radar and
\nnot let you know that you have been compromised. So
\nthey take control of your machine, they can use it to do
\na lot of things and they can also siphon information
\nfrom you personally or from your company.<\/p>\n

In the way they do that is by sending senting out
\nthese targeted attacks, so that you don’t even know that
\nyou’re being compromised.<\/p>\n

The or thing is this they target a lot of high
\nprofile event, Valentines day is one that happens every
\nyear, but also different events like we saw it with the
\nOlympics, a couple of years ago, we’re already seeing it
\nwith the world suppose in Shanghai and with the World
\nCup.<\/p>\n

If you go to just a couple of quick examples. Here
\nis one, a piece of themed malware from the Olympics.
\nThe hyperlinks in this email take the user to legitimate
\nweb signs, but those websites are compromised, so that
\nwhen somebody goes there, follows that link, all of
\na sudden there’s some mall we’ll placed on the
\nrecipients computer and they would n even know it.<\/p>\n

Here is another example that we have just picked up
\nfrom the FIFA World Cup. This is a legitimate.<\/p>\n

People with certain types of day.<\/p>\n

When they open up this PDF, their PC will be
\ncompromised.<\/p>\n

Here is some examples of what can happen if your CP
\nis compromised.<\/p>\n

People typically used to any if I download
\na computer virus, it means that my computer is going to
\nbe shut down and I’ll have to go and buy a new computer.
\nThere is a lot worse things that can happen these days.
\nI won’t go into the details, but you can see that your
\ncomputer can be recruited and used as a web server, it
\ncan be used to siphon corporate information, it can be
\nused to deliver different email attacks, it can be
\nrecruited into a robot network, and it can be used to
\nsigh Foon different financial credentials from you.<\/p>\n

One of the things that can be downloaded is a key
\nstroke logger, so when you go to anything that resembles
\na banking website, it can basically log the key strokes
\nthat you’re typing on your computer when you’re putting
\nin your passwords.<\/p>\n

All of that information can be sold.<\/p>\n

That gives you hopefully an idea of the type of
\nthings that can happen, if you do download a piece of
\nmalicious software.<\/p>\n

The key thing here is that definitely, the vast
\nmajority of internet threats these days are driven by
\norganised criminals. It’s widely reported that internet
\ncrime generates more money now than the global drug
\ntrade. It is a hugely professional industry and so what
\nthat means is that the solutions in the marketplace need
\nto be able to keep up, both the consumer solutions and
\nthe corporate solutions need to be able to keep up with
\nthis sort of activity and the investment that goes into
\nit from the criminal side.<\/p>\n

One of the key things here is that all the cyber
\ncriminals, they go out and buy every single readily
\navailable, commercially available piece of security
\nsoftware that is available in the marketplace and they
\nset up their own test labs and they test all of this
\nstuff to try and find the vulnerables.<\/p>\n

It’s not difficult to do. Hay just set up a test
\nlab. They have plenty of money to spend on doing this
\nand it’s all about return on investment for them. They
\ntest these things for vulnerables. As soon as they find
\nsome vulnerables, they get to work and send out as many
\ntargeted attacks as they possibly can to exploit those
\nvulnerables while they still exist.<\/p>\n

Going back to cloud technology or software server
\nbased technology that’s delivered from 2 internet, it
\ncan’t be tested.<\/p>\n

To give you an example, our technology across our 14
\ndata centres globally, we have a technology statistic
\nconsisting of some of the best software level
\ntechnologies in the marketplace, so three different
\nlevels there, as well as our own technology, as well as
\npu ris ticks and perimeter based technologies.<\/p>\n

Basically, to use our technology, you have to
\nliteralically connect, subscribe to it from the
\ninternet. You can’t download it and test it.<\/p>\n

So companies like ours that are offering cloud based
\ntechnologies have the advantage of staying one step
\nahead of these cyber criminals.<\/p>\n

You can see on the slide there the number of new
\nmalicious signatures that are being identified every
\nyear and it’s increasing exponentially, year after year,
\nso what that means is that as I said, huge amounts of
\nmoney invested in this, highly specialised and highly
\nskilled participants.<\/p>\n

What it means is that basically, the old signature
\nbased technologies really aren’t equipped to capture
\nthese technologies any more.<\/p>\n

With a software as a service approach, logically
\nwhat it means is that if you stop the threats before
\nthey enter the corporate network, or the consumer PC,
\nthen you’re at a lower risk than waiting until the
\nattack or the threat actually comes into your network or
\nyour PC and then dealing with it reactively.<\/p>\n

I won’t go through that in detail. It’s hopefully
\npretty self-explanatory, but it is a growing and
\nemerging trend, both at a consumer level and a business
\nlevel on a global basis.<\/p>\n

The very last slide here shows you the global
\nemergence of software as a service technology. In the
\nUK, over 50 per cent of businesses and 70 per cent of
\nbusinesses at the surprise level deploy a hosted
\nsecurity solution these days.<\/p>\n

In Hong Kong, that rate is only about 10 to
\n12 per cent, but it’s growing significantly. We expect
\nto see more and more businesses move to a hosted or
\ncloud based technology solution to help businesses and
\nconsumers protect themselves as best they can against
\nall of those new and emerging threats.<\/p>\n

>> Stephen Lau: Thank you, Nigel. We just heard from
\nsecurity expert who is working for world renowned
\nsecurity company offering products and services to many,
\nmany clients on a global basis and he’s talking about
\nemerging threats and the sophistication, the
\nproliferation thereof. It’s really frightening.<\/p>\n

We have asked Nigel to come here, despite the fact
\nthat I know that he has another engagement coming up
\nvery shortly, but so he has to leave, but we thank him.<\/p>\n

Is there any — we can entertain a couple of
\nquestions from the floor.<\/p>\n

If not, let me ask one, because in my personal
\ninterest.<\/p>\n

He has been talking about corporate and Symantec as
\na global company offering service, whereby corporation
\nwell prepared and needs to have a lot of resources,
\nsecurities in the interests of the security protection
\nfor the corporation.<\/p>\n

You and I , simple individuals, sitting in front of
\nour laptop, I just want to ask Nigel, give us some
\nadvice. Given all this proliferation of these
\nsophisticated kind of attacks, what is the best way we
\nshould protect ourselves?<\/p>\n

>> Nigel Mendonca: The first thing I would say is whether
\nyou use Symantec or any other security solution, it is
\nreally important that you do have some sort of security
\nprotection at home on your home PC.<\/p>\n

You definitely shouldn’t assume that — you can’t
\nassume, for example, that if you don’t visit
\nquestionable websites, that you’re not going to be
\ninflicted. Because like I said earlier, you can go to
\nany legitimate website and you run the risk of having
\na piece of malware download.<\/p>\n

You definitely need some sort of protection.<\/p>\n

The other thing I would say is you get what you pay
\nfor. There’s a lot of cheap solutions in the
\nmarketplace and there’s even some free solutions in the
\nmarketplace and I’ll let you make up your own minds,
\nreally, but if you think that you can get something
\nincredibly high quality for free, I think you need to
\nthink again.<\/p>\n

That does n mean you need to go for the most
\nexpensive solution on the market, but reputation means
\na lot in the industry and there’s a lot of organisations
\nlike Symantec that have a very good reputation in the
\nmarketplace that really I would certainly advice that
\nyou do use.<\/p>\n

The other thing I would say is, just be sensible and
\nuse some commonsense when it comes to if you’re using
\na PC that’s not your own, that’s at — whether it’s at
\na library or a university or an internet cafe or
\nsomething like that, I would definitely recommend that
\nyou don’t go to your own internet banking website or
\nsomething like that. At one of those sites because you
\nnever know who has been on the machine, what they have
\ndone to it, what level of security they have on it. So
\nyou are running a high risk there.<\/p>\n

Lastly, we heard a little bit before about going to
\nwebsites like or social engineering about sights like
\nFacebook. I’m not saying that people shouldn’t use
\nFacebook because it’s a great tool and I think that it’s
\ngoing to get even better and better, but again, we heard
\nthat there are different privacy settings that you can
\ndeploy on Facebook, so you should use those.<\/p>\n

You should understand, for example, if you set up
\na social networking account, you should take the time to
\nunderstand who can see your information, because there
\nare ways of controlling it and there are ways of
\nlimiting the information, because the cyber criminal,
\neven though they do spend a lot of time and money to try
\nand acquire personal and valuable information, they also
\ngo for a lot of low hanging fruit. So there is a lot of
\npeople that display all sortses of information without
\nbothering to tick the most set up the most basic privacy
\nlevels on something like Facebook and that information
\nis just there hanging and ready to be harvested and sold
\nand used for those targeted marketing purposes.<\/p>\n

They are probably the main things I would say, but
\nit’s tough. There’s not any one thing that people can
\ndo. Stay educated and for those of you who have kids
\nthat are at school and starting to use PCs as well,
\nI think definitely it’s an education process to make
\nsure that they understand some of the potential threats
\nand traps that are out there as well.<\/p>\n

>> Stephen Lau: Thank you, Nigel.<\/p>\n

We do not present supernears now. What we do, as we
\nsaid this morning, we have donated the cost of your
\nsouvenir, the money, to the Digital Solidarity Fund.<\/p>\n

Take your time and if you have to leave, please do
\nso.<\/p>\n

Now we move onto another paradigm, to another
\nlandscape to do with, from a legal perspective, we have
\nProf Jackson here, who is going to talk about cyber
\ncrime and intellectual property protection in Hong Kong.
\nI think that will give a different dimension and we look
\ntowards your even light ned words.<\/p>\n

>> Michael Jackson: Thank you, Stephen. Thank you to the
\ninvitation to speak today.<\/p>\n

I am an academic. I don’t practice in the field, so
\nmy presentation will have a more academic orientation to
\nit. It’s entitled cyber crime and intellectual property
\nprotection.<\/p>\n

Nigel has just graphically illustrated what cyber
\ncrime in actual practice or how it is largely dealt with
\nnowadays and that is by way of security issues.<\/p>\n

It presents itself as security risk, it’s dealt with
\nby way of security technology in that seasons.<\/p>\n

My contention is that the cyber crime legislative
\nagenda, as far as it continues to exist in Hong Kong,
\nhas been effectively taken over by the copyright
\ncommunity and used to push into the legislation in
\nHong Kong provisions which seek to protect copyright at
\nmy submission, the expense of one of the qualities that
\nwe discussing today, the openness of the internet
\nitself.<\/p>\n

I wanted to take folks in particular on the proposal
\nthat’s currently been made for the enactment of a new
\noffence dealing with the initiation of unauthorised
\ncommunication of copyright works to the public.<\/p>\n

I ask whether that can be justified. It cannot be
\nreadily justified, but it seems likely that the
\ngovernment will probably push ahead with it this the
\nform that they have proposed it.<\/p>\n

My central thesis is that the notion of cyber crime,
\nwhich is a very evocative term, one which Nigel has
\nspoken of and illustrated and calls to mind ideas of
\norganised crime, sophisticated crime, possibly even
\nfills our imagination of images of armies that act
\nagainst us has been used largely nowadays to fulfil
\na copyright support regime by the government. That
\nI submit is an unacceptable intrusion into aspects of
\nthe internet that we seek to preserve.<\/p>\n

Cyber crime existed before it was called more simply
\ncomputer crime or computer related crime and those of
\nyou that were around in the late 1980s, early 90 to deal
\nwith what was then perceived to be the principle cyber
\ncrime threat as they were known them, namely hacking was
\nnothing more than that, by way of legislation.<\/p>\n

That remains pretty much the bulk of the legislation
\nthat exists today in Hong Kong, save for enactment of
\nprovisions to deal with copyright protection.<\/p>\n

The lack of cyber crime provides a very
\nininstrumental means of encouraging honesty development.
\nThat was evident most particularly, I think, with the
\ndrafting signature and coming into effect of the
\nconvention on cyber crime, an international treaty
\nproposed by the council of Europe, in the late 1990s,
\nearly 2000.<\/p>\n

That now has some 46 signatories and some 30
\ncountries have ratified it. Placing upon themselves
\na drawing down on themselves an obligation to enact
\na raft of substantive offences dealing with the most
\nobvious forms of cyber crime that exist, access,
\ninauthorised access, child pornography, certain
\ncopyright offences, computer fraud, computer forgery.<\/p>\n

It also obliges them to put in place law enforcement
\nto deal with 24\/7 cooperation and to do with search and
\nseizure.<\/p>\n

In large part, many have seen the convention on
\ncyber crime as a law enforcement convention which
\nobtains attraction by being wrapped up with a set of
\nsubstantive crimes which everyone felt could or should
\nbe enacted.<\/p>\n

The attempt to encourage the enactment of such
\noffences and national legislation led to the enhancement
\nof law even form across jurisdictions.<\/p>\n

Hong Kong was not a party to the convention,
\nnaturally enough, but it took those, dictated the
\nconvention on board and thus in its own review of its
\ncomputer based legislation in the early gavist a rather
\nhearty slap on the back and said we have done most of
\nwhat is required, we have fraud offences, the one thing
\nwe don’t have a a child important agofy offence so the
\ngovernment used the convention on cyber crime the
\nvehicle to drive forward child pornography legislation
\nin Hong Kong, which is not limited to the on-line
\ncommunity, it applies more generally to that.<\/p>\n

Cyber crime was used to invoke threats and to drive
\nforward certain legislative agenda, but since then
\npretty much it has gone by the buy in terms of dealing
\nwith real cyber crime threats as I foresee them and has
\nbeen turned into a vehicle for pushing forward copyright
\nprotection agendas.<\/p>\n

The process of criminalisation involved in cyber
\ncrime issues, be they in the proper sense, as
\nI suggested, they could be formulated or in the
\ncopyright agenda sense, involves a host of issues.<\/p>\n

It requires compliance with a number of rule of law
\nrequirements, suchs certainty of legislation, such as
\nfair labeling, fair warning in terms of enacting
\nlegislation and drafting it. It requires in the context
\nof on-line world, that there be technology neutral
\ndrafting and that there be as far as possible, off line
\non line consistency legislation. Don’t make things
\ncriminal which would be lawful in the real world, simply
\nbecause they have taken traction in the on-line world.<\/p>\n

More significantly, we also enacted legislation
\ncriminalising offences nowadays, have to comply with the
\nfundamental rights and freedoms that we have now been
\ngranted under the Bill of Rights and the Basic Law. On
\non the of that, it is acknowledged as criminal sanctions
\nhave always been and should continue to be extraordinary
\nmeasures that are invoked only when recurring conduct
\ninflicts type of harm that is egregious enough to
\nwarrant the creation of a new offence and cannot be
\nadequately addressed by the civil liability.<\/p>\n

It goes without saying, of course, that when the
\nquestion of enacting offences dealing with child
\npornography were an issue, all of those necessary
\ncriteria were readily satisfied in abundance. Fair
\nlabeling, fair warning, precision, all came into play,
\ncompliance with human right were satisfied, so also was
\nthe idea that it was an extraordinary mesh to deal with,
\nan extraordinary problem that was terminating itself
\naround the world and gaining a greater problem because
\nof the intrusion and explosion of the internet and
\npornography.<\/p>\n

Having entered public consciousness, the concept of
\ncyber crime dropped away this terms of the legislative
\nagenda. As I have said, it became the base case of
\nmomentum in terms of the early development of cyber
\ncrime legislation being focused on security issues,
\ndevelopment of security regimes, the Hong Kong document
\nof security technology and so on and also momentum
\npassed in some forms to the privacy issues, protection
\nof privacy.<\/p>\n

One doesn’t really need to remind you of the number
\nof privacy concerns that have arisen in Hong Kong over
\nrecent years, data look average, Edson Chen’s case,
\nsurveillance in the placement of CCTV in public places,
\nrecent government attempts to introduce drug testing at
\nschools. All have given cause for pause about the
\nintrusion, the erosion of privacy concerns.<\/p>\n

That erosion is very much fostered not only by
\nexternal events, but also by what has already been
\nspoken of by a number of the speakers so far, blogs, web
\n2 influence, social networks, Facebook in doing so, they
\nhave taken to public discouraging personal information
\nat a rate never seen before.<\/p>\n

One of the speakers at the third IGF conference in
\nIndia in 2008 graphically described what he saw
\nhappening in the social network sites as people vomiting
\non the internet.<\/p>\n

I think a very graphic and illustrative idea of what
\nis actually been happening.<\/p>\n

Quite apart from the personal dam nation involved in
\nthat, what it does, as Nigel and Ken has spoken of, is
\nthat it offers those who would engage in cyber bully
\nactivities, cyber stalking activities, greater
\nopportunities to do so, victims available to them.<\/p>\n

Yet, sadly, the Hong Kong Government has done little
\nto seriously consider criminalisation in respect of
\nthose activities, even though they are of concern.<\/p>\n

Instead, criminalisation, the identification and
\ncriminalisation of so-called cyber crimes has bubbled
\nalong largely coming on the radar by way of protection
\nof intellectual property rights. Most usually in the
\nrelation to copyright, where one of the original areas
\nthat were contemplated required legislation in the
\nconvention of use of the language of cyber crime has
\nbeen copyright holders a degree of leverage when they
\nargue for often inappropriately, in my view, legislation
\nto criminal legislation to protect their interests in
\nthis day and age.<\/p>\n

The Hong Kong Government has been largely complicit,
\nit seems to me, in the adoption or the enactment of this
\nlegislation. It’s not shy about offering law
\nenforcement to the cause of copyright protection. It’s
\ndone so and readily accepts because it is interested in
\nand has a commitment towards upholding a robust
\ncopyright protection regime in Hong Kong, because of the
\nimportance of the further sustainable development of the
\ncreative industries in Hong Kong’s economy.<\/p>\n

In doing so, it runs the risk of tipping a balance
\nthat must be struck between right holders and consumers,
\nparticularly in the free fall that the internet has
\nbecome. Leading to the overly quick characterisation of
\ncopyright infringement as cyber crime and thus
\nwarranting the extension of law enforcement to further
\ncopyright protection interests.<\/p>\n

What has happened in terms of criminalising
\ncopyright protection has happened not simply in the
\nlegislative sphere. It’s also happened through the
\njudicial process. We are all familiar with the case of
\nChan nigh Ming, in which the distribution offence and
\nthe copyright ordinance was extended to cover
\ndistribution via P to P network, the bit torrent case.<\/p>\n

There effectively the cause enabled copyright
\nholders to push forward their criminalisation agenda
\nwithout even needing to go to the legislature to do so.<\/p>\n

It left open a number of issues in the case to do
\nwith the liability of download errs and so on, but that
\nis something that they continue to press the government
\nto take action to remedy, although the government seems
\nto have taken the view that there is presently a means
\nto enforce those rights, based on the Chan nigh Ming and
\nsimilar cases.<\/p>\n

Criminalisation has Edson Chen case, that is to do
\nwith privacy protection rather than cyber crime per se.<\/p>\n

With the proposal by the security bureau for the
\nenactment of new statutory provisions which would
\ncriminalise malicious use of or misuse of data that has
\nbeen leaked.<\/p>\n

Even there I can’t help cynically perhaps in my
\nmind, notice that Edson Chen, when he returned to
\nHong Kong, to respond to the concerns about the images
\nthat had appeared early in 2008, in the face of
\napparently the ability of the Hong Kong criminal law
\nregime to do very much to help him, asserted his
\ncopyright over the images that he finally conceded he
\nhad taken.<\/p>\n

A sort of copyright comes back into the or na,
\nwhereupon the security bureau suddenly say we need to
\nprotect Mr Chen and others privacy in the future,
\ncynically is this just another means of essentially
\nensuring his copyright of his images is protected.
\nProbably not, but that’s just a slightly cynical view on
\nmy part.<\/p>\n

Of course, coming back to where I started, what the
\ngovernment is now proposed, beginning with the
\nconsultation in 2008, carrying forward after public
\nconsultation with a proposal coming forward
\nin November 2009, is a new offence regime to deal with
\nwhat it calls copyright protection in the digital
\nenvironment, with the principle offence being one to do
\nwith the initiating the unauthorised communication of
\ncopyright works to the public.<\/p>\n

I’m sure most of you are familiar with that, may
\nhave engaged in debates about it, may have written
\nsubmissions to it, to the government about it, all
\nI want to go through and indicate why I’m of the view
\nthat it is arguably an improper attempt by the
\ngovernment to take forward an overly large open-ended
\ncopyright agenda, which has serious implications for
\nI believe openness and communication and free flow of
\ninformation on the internet.<\/p>\n

Most of you will probably know that in its original
\nform, the proposal was limited to stringing, as
\na particular form of communication, that the government
\nsaw and was necessary to deal with, but it was pointed
\nout, rightly, I think, that criminalisation should be
\ntechnology neutral and that the limitation to stringing
\nwas therefore inappropriate and as a result deleted in
\nthe final proposal.<\/p>\n

The government says this is a more forward looking
\napproach, which allows new technologies and enabling
\ncommunications in public to be caught as and when they
\nare developed.<\/p>\n

This the paper said will best serve the government’s
\naim of affording timely and adequate protection to
\ncopyright works being communicated on digital platforms.<\/p>\n

So an open ended basis on which copyright holders in
\nthe future can, as they identify and seek to take
\nadvantage digital platforms for delivery of their
\ncopyright works to the public, through the internet and
\nother digital platform, a new means of argue for
\nprotection of their rights, without asking the
\ngovernment to seriously consider the appropriateness of
\nlegislating by way of criminalisation at that time.<\/p>\n

The government, of course, has said that there need
\nto be appropriate exceptions, taking account of the
\nviews of stakeholders over sees experience, although
\nwhen I read many of the submissions of stakeholders,
\nparticularly the copyright community to the governments
\nproposal, many of the review should be very limited
\nexceptions made available to the protections that are
\nbeing offered to them.<\/p>\n

The proposal is controversial in many ways.<\/p>\n

Many of them touching on the third of the topics
\ncovered by this panel today namely openness. In
\nsecurity issue we have dealt with through Nigel.
\nPrivacy a separate issue. I think it’s openness where
\nthe proposal real conflicts if the proposal goes forward
\nin this present form. For it has the potential to
\nresult in a substantial interference with the relative
\nfreedom of on-line Hong Kong citizens.<\/p>\n

It’s hard as presently formulated to see how the the
\nmany and varied criteria I have already outlined, rule
\nof law, issues fundamental rights issues, off line on
\nline consistency issues, exemption all circumstance
\nissues. It is hard to see how the proposal can is the
\nfew those many and varied criteria in order to justify
\ncriminalisation.<\/p>\n

Just why civil liability will not suffice remains to
\nme unanswered and unclear.<\/p>\n

The government in its original proposal acknowledge
\nthat a proposal of the width and now proposing simply
\nunauthorise communication whatever digital platform one
\nmight have in mind, was unacceptable.<\/p>\n

It admitted that in the interests of clarity and
\ncertainly, a blanket criminalisation of all unauthorised
\ncommunication might cast the net too wide and entail
\nfar-reaching unwarned implications.<\/p>\n

The government understood that what a blanket
\nauthorisation entitling criminalisation of all new forms
\nof digital delivery, communication to the public, was
\nsimply unwarranted and a step too far.<\/p>\n

Having been informed and recognising that the
\nrestriction it proposed stringing was objectionable,
\nbecause of the technology criteria, the natural thing
\nthe government should have done was said we don’t see
\na way to offer a blanket authorisation. We therefore
\nwithdraw the proposal in the form that it’s been
\noffered.<\/p>\n

We, for the time being, can only offer you
\na protection regime, which will result in civil
\nliability without enhancing it by way of bringing the
\ngovernment’s law enforcement agencies or co-opting them
\nto assist you in your copyright regime.<\/p>\n

Instead of that, that their proposal is rethey
\nsimply decided to offer such a blanket authorisation.<\/p>\n

Instead of the properly nuanced reservation it has
\nit through everything out the window and said you have
\na full, open field in which you can enforce your
\ncopyright protection, hence forward if the proposal is
\nadopted, without even having to come back and ask the
\ngovernment policy develop and decide whether this is the
\nappropriate threshold, the appropriate balance to be
\nset.<\/p>\n

The government has expressly indicated that the
\nproposed criminal sanction they have in mind will only
\napply to the act of taking activity steps to make an
\nunauthorised communication to the public and is not
\nintended to sap ply to the simple act of downloading or
\nbrowsing infringing materials, via electronic
\nsubmission, but just how this formulation can be drafted
\neffectively is unclear. Many of the submissions from
\nthe copyright community don’t accept the exclusion of
\nsimple act of downloading or browsing.<\/p>\n

The worry I have, therefore, is if my daughter, who
\nis only 11, who has a Facebook page, which I of course
\nadminister, because she’s got to be 13 under US law to
\nhave such a site, I facilitated her by putting in
\na misleading age. If she up loads copyright to her
\nFacebook page, is that ever possibly going to fall
\nwithin the rubric of the proposal that is in mind? Is
\nit an unauthorised communication of copyright works to
\nthe public? Is it a communication? Is it to the
\npublic? Those terms are unexplained, open ended and
\nprone if given full weight leverage and you can
\nguarantee the copyright community will seek that full
\nleverage, prone free flow of communication and
\nmeaningful across the internet.<\/p>\n

Obviously, the offence that is if mind is one where
\nthe liability only arises when the communication was to
\nsuch an extent as to affect preconditioning copyright
\nowners outside of the business environment, but I have
\nconfidence this is an effective restraint or restriction
\nfor reasons I mentioned below in a moment.<\/p>\n

Another powerful objection quite apart from the
\nopen-endedness of the terms, that the proposal entail,
\nthe uncertainty, the lack of clarity, the blanket
\nauthorisation, is the offences potential infringement of
\nour fundamental rights of freedom of expression and
\ncommunication.<\/p>\n

Charles Mok here has I think already spoken of this
\nin the past, it’s been reported and expressed his
\nconcerns about the nature of the offence, suggesting
\nthat it’s too vague, citizens may find themselves
\ncommitting n of fence without knowing the boundaries for
\ntheir activity and as a result, over time, will come to
\nhave chilling effect on communication via the internet,
\nas people become unsure whether whether they can do what
\nthey currently do, whether they will be prosecuted,
\nwhether those notices that some people get currently
\nreminding them that what they are doing is unlawful,
\nwhich seems to be effective in the eyes of many, without
\na consequential criminal prosecution, a simple receipt
\nof notice is often I am being monitored, I shall now
\ntherefore, stop what I’m doing.<\/p>\n

Whether this will have a chill effect suppressing
\nthe expression of opinion, by persons and thus the
\ninhibition of democratic society.<\/p>\n

I also have a technical objection to the offences
\npropose, one which arises out of Chan Ni Ming. He was
\nnot distributed to distribute, which means all the
\nrequirements of proof of actual prejudice, of actual
\ndistribution go out the window, as long as you have done
\nmerely preparatory steps, that’s a sufficient basis for
\nproposing liability. That could there are other
\nobjections at a technical level to do with aiding and
\nabetting and procuring. Who may be liable for assisting
\nor helping or encouraging the person who what initiated
\nthe patrons in a bar where streaming World Cup being
\nwatched, are the patron in the bar assisting,
\nencouraging the streaming who knows? Nothing is clear
\nfrom the proposal at heart.<\/p>\n

As I have said, a key criteria is to even harrass
\nthe civil protections that are available to copyright
\nholders, in it has not made up a case for enhancing
\ncriminal sanction extending it in this case and I would
\nargue that the use of or characterisation of copyright
\ninfringement in the digital backdrop, in 2 form that
\nit’s been proposed here, as some sort of cyber crime,
\nthus meriting the legislative general da is a step too
\nfar and that’s where I’ll leave my presentation.<\/p>\n

>> Ken Ngai: So much about copyright.<\/p>\n

I would like to know if anyone from the floor with
\nany questions to any of us.<\/p>\n

>> : This is.<\/p>\n

>> Edmon Chung: I have a question, since we were just on
\nthis topic copyright, I actually with like to ask the
\npanel, but I was wondering whether Mike gur from this
\nmorning is still here, because I read an article
\nabout — development in the copyright laws in Canada
\naddressing these type of issues and creating, while sort
\nof a stepping up in terms of a on-line copyright
\nprotection, but also carving out a bigger portion for
\nthings like match ups, so that there is a lot more
\nexceptions placed on things, so that general users, when
\nthey do mash ups, they are able to utilise certain
\nlicence copyright material, with sort of an easier
\ndefence, sort of like news which does have that
\nexception at this point.<\/p>\n

Just wonder what Michael — the two Michaels might
\nthink.<\/p>\n

>> Michael Jackson: I think it’s obviously this is an issue
\nwhich has been addressed in a number of jurisdiction.
\nMy concern is in Hong Kong, it’s a rather open ended,
\nunlimited development and one which has been driven by
\nthe copyright community, without it seems much regard
\nfor many of the interests that would counter balance
\ncriminalisation and without perhaps ultimately a proper
\nconsideration of the sorts of defences that you have in
\nmind.<\/p>\n

Recently, last year, I attended a presentation in
\nHong Kong by Lawrence, of course written on a lot of
\nthis problem. His key point is what are we trying to do
\nto our children with the legislation we are enacting
\nalong these lines and making them all potentially
\ncriminals for doing what is essentially creative work by
\nthem, mash ups and so on.<\/p>\n

Because they are technology proficient and they know
\nhow to do things and enjoy it and suddenly they find
\npotential that there could be criminal liability.<\/p>\n

That’s the sort of thing that worries me.
\nI mentioned my daughter, perhaps a bit cynically, but
\nthat’s the sort of worry I have about where Hong Kong is
\nheaded in terms of this.<\/p>\n

More considered, more balanced regime which does of
\nford proper regard for creativity, for exploitation is
\nperhaps better approach than what is currently
\nformulated in Hong Kong.<\/p>\n

>> Michael Gurstein: I’m not a lawyer and my understanding
\nis that even the draft new law hasn’t immersed. There’s
\nbeen some discussion on it, but not, it hasn’t come
\nforward. It’s a very politically contentious issue and
\nit’s not a partisan political issue, but there’s
\na number of organised forces on either side.<\/p>\n

The result I think is still very much unclear,
\nbecause the only interesting thing that I can suggest is
\nthat it was probably the first time that something quite
\nso abstract became the basis of demonstrations in front
\nof parliament. There is actually an organised movement
\nacross Canada with chapters in about a dozen cities
\nwhich organised demonstrations against a tightened
\ncopyright regime.<\/p>\n

>> Ken Ngai: Any others from the floor would like to comment
\non this?<\/p>\n

I have a question for Mr Priscilla Liu. At the
\nI beginning of this section, I show some of the
\nphenomenon in Hong Kong. To me, the web environment in
\nHong Kong is very open. To you, Ms Liu, how do we
\nbalance between openness of information and protection
\nof China that can be made?<\/p>\n

>> Priscilla Lui: Actually, it’s very exciting discussion we
\njust had and it’s very interesting that Michael just
\nmentioned that we have to be cautious, otherwise we’ll
\nbe making children criminals.<\/p>\n

Michael said he’s not a practitioner. I’m
\na practitioner in the field and I work for an agency
\ncalled the against child abuse.<\/p>\n

Every day, we receive hotline calls, drop ins from
\nyoung people. I think the world is working together and
\nhoping that we’ll be building a safe city, a stay
\ncommunity for our children.<\/p>\n

The topic ware talking about today is even more
\nimportant or as important. What about the virtual world
\nthat our children is facing every day.<\/p>\n

I think from Nigel’s and also Michael’s
\nenlightenment, we appreciate the magnitude, the
\ncomplexity of the problems, the concerns, raised through
\nthese issues and discussions.<\/p>\n

How do we ensure a balance between the freedom of
\nspeech that we all treasure, as compared with children’s
\nsafety and protection.<\/p>\n

I think it’s excellent that on this particular
\nplatform, that I’ll have this opportunity to raise and
\nto urge for child perspective in this particular area.<\/p>\n

It is very important, particularly with the magnitude,
\nthe complexity we can all see that we cannot leave this
\nto the hands of parents, nor to the hands of children
\nthemselves.<\/p>\n

Parents and young people, they do have important
\nroles to perform, because they are the ones in the very
\nforefront to decide, to make important decisions and to
\ntake charge of their life.<\/p>\n

But if we think that it stops at that, I think it’s
\nvery unwise.<\/p>\n

Because young people, in many way, they are
\ninadequate. They are not capable of doing so.<\/p>\n

There is too little discussion and too little
\neffort, particularly in Hong Kong, in the aspect of the
\nrole of government, the commercial sector, internet
\nproviders and so on and so forth.<\/p>\n

I see that in some other countries, they are trying
\nvery hard, for example, in the states, they have been
\nusing the law to ensure children being adequately
\nprotected, adults have their own choice and decisions,
\nbut young people need, in many different ways, to be
\nprotected.<\/p>\n

In terms of their network and in terms of the adult
\nnetwork, data information and so on and so forth.<\/p>\n

I also see a resource implication in the
\ngovernment’s policy, because I found that in the states,
\nin Australia, and perhaps in many other down thinks,
\nthey do spare budgets, finance in covering this
\nparticular area, particularly devoted to the police, the
\nInterpol, the local police and so on and so forth,
\nbecause of the enormous number of cases come to the
\nforefront, because of this internet concerns,
\nparticularly relating to children.<\/p>\n

Unless and until we actually allocate resources,
\nmanpower, training and so on and so forth, to different
\nprotection alls, it’s a cross sector multi-disciplinary
\nconcern, otherwise I think all the discussion will be
\nreally lip service.<\/p>\n

Of course, more systemic and strategic kind of
\nprogramme as for parents and for children needs to be
\nput in.<\/p>\n

I see that Hong Kong is working towards that
\ndirection.<\/p>\n

>> Ken Ngai: I know Charles Mok may have something to
\nrespond to other presenters.<\/p>\n

>> Ram Mohan: Yes, before I start, I wasn’t to say.<\/p>\n

>> Charles Mok: Before I start, I want to say I will like to
\ndo the following in Chinese, for a number of reasons,
\nbecause I think I can do it faster that way and second,
\nbecause I want to make the load of work for the
\ntranslators to be a little bit more balanced.<\/p>\n

Third, maybe that will bake you, some of you up
\na little bit, to spice it up a little bit, as you can
\nlisten to this in your native language.<\/p>\n

The rest of you, maybe you can try to put your
\nheadset on.<\/p>\n

I’m talking about security, openness and privacy.<\/p>\n

I’m talking about security and openness are very
\ntroublesome topics. Openness are easy.<\/p>\n

Most of us think that it is a good idea, the
\nopenness of it.<\/p>\n

They seem contradictory issues.<\/p>\n

In the IGF organisation, under our topics, in our
\nregion, in our Hong Kong IGF, I want to tell you about
\nIGF, the story.<\/p>\n

I met John Fung three years ago and we went tory yes
\nin Brazil and we didn’t go to see a soccer match, but we
\nwent to attend IGF there.<\/p>\n

It’s a big conference and there are many streams of
\ntopic going on.<\/p>\n

A lot of them are dedicated to protection of
\nchildren and different organisations for all the world
\nare presented.<\/p>\n

A few workshops promoting the freedom of
\ninformation.<\/p>\n

There are censorship issues in a few countries.<\/p>\n

We find that a lot of them, what we talk about are
\nvery opposing, like contradictory.<\/p>\n

Me and John are very interested to go to this
\nopenness and John, on the other hand, he would like to
\ngo to the children protection.<\/p>\n

How come they are not talking, these two schools of
\nthought are not talking to each other?<\/p>\n

I think this talk communicate between these two
\nschool of thoughts are very important.<\/p>\n

I think it’s most important to protect our openness
\non the internet. On the one hand, they do want to
\nprotect the children. On the other hand, the school of
\nthought on protection of children, on the one hand, they
\nwant to protect the children, but on the other hand,
\nthey do not want to see cyber crime to increase.<\/p>\n

What I’m just talking about, we are looking at
\nsecurity, openness and privacy issues. These three
\nissues.<\/p>\n

With the fast growing, very growing of internet
\npenetration, we have changing attitude towards these
\nthree issues.<\/p>\n

The environment has to be ongoing changing.<\/p>\n

Whatever standpoint you are coming from, it is
\nconsistently ing chaing.<\/p>\n

We talk about privacy.<\/p>\n

We have very increase our awareness of privacies and
\nprivacy law.<\/p>\n

Stephen Lau, me and him are involved in the hospital
\nauthority, the cases on the privacy issues.<\/p>\n

We have been working on these cases.<\/p>\n

Hong Kong people and maybe perhaps for the rest of
\nthe world, they find that they are very nervous about
\nprivacy being stolen, their private information being
\nstolen. But then on the one hand, they are not very
\ncareful with their own data, with their own information.<\/p>\n

For example, the hospital authority, the staff who
\nleft their information behind, he would be very angry if
\nhis banking information was revealed.<\/p>\n

What I’m thinking, the legal enforcement is not
\nenough in Hong Kong. Just now, Prof Jackson mentioned
\nprivacy law. There was a consultation on it last year.<\/p>\n

But I agree. We need to step up. We need to
\nenforce and do more consultation on privacy, on the
\nprivacy area.<\/p>\n

It’s not like every 10 years.<\/p>\n

Also, on the security issues, we have our awareness
\nhas been increased and raised.<\/p>\n

How many SME, how many individuals? We have done
\nenough on our security front for ourselves.<\/p>\n

Let me take an example.<\/p>\n

Mr Hi is presented. Google, there is a card they
\nparade around the city and they collected a lot of
\ninformation.<\/p>\n

We have a lot of survey and also government agency
\nhas people around doing survey, whether they have
\nencryption, WEA.<\/p>\n

A lot of them hasn’t done it. Or they just do it
\nwithout using the most secure technology.<\/p>\n

With this case, a lot of people, they were saying
\nGoogle is not doing a good job. It’s nasty.<\/p>\n

From our point of view, as an SME, as an individual,
\nwe have our own responsibility to protect our own
\ninformation.<\/p>\n

The next point I want to say, when you look at these
\nissues, there are ways to handle it.<\/p>\n

Just now, the two speakers, they were talking about
\nit. Nigel did on the technical side.<\/p>\n

Would there be a programme somehow, somewhere, that
\nis going to be so high security that it solve the
\nproblem, that’s no more security problem. Or in the
\nnear future, there will be some legal enforcement, so
\nthat the cyber crime will be stopped, they will be
\ncriminal sized before it ever happened.<\/p>\n

I think down to one point, I don’t depend on others
\nto solve the problem. The one thing is I think it’s
\nwhat you need to do for yourself.<\/p>\n

Let’s talk about Nigel’s company or Mr Fung’s
\ncompany. They do a lot of security work. These are
\nfirefighting. You are chasing up the problem or say
\nlegislation or the software security, they are not
\ncatching up with the latest crime. What I look at,
\nthere are the legal aspect, I would like to say, there
\nare some of the area that it’s not addressed. It cannot
\naddress.<\/p>\n

For example, the slump just happened. We are
\ntalking about legislation on it.<\/p>\n

When we come to think about it, it might not be the
\nbest idea, just to create some law against it for the
\nproblem. It’s just simply passing the job, passing the
\nwork to the government.<\/p>\n

Also, this is like you passing the ball to the
\ngovernment, so giving the authority, the government, too
\nmuch authority might not be a good thing.<\/p>\n

There was just yesterday a participant from
\nMalaysia. They have this worry in their country.<\/p>\n

This Malaysia, they see this, they abuse and misuse
\nthe legislation.<\/p>\n

He suggested there are three criteria. It’s totally
\nnecessary and the law does not have too much power.<\/p>\n

Secondly, the law has democratic oversight.<\/p>\n

Thirdly, it is based on the human rights globally,
\nbased on their human rights globally, the idea is based
\non the human rights.<\/p>\n

I think he made very good point. Lastly, I want to
\nsay, I want to promote this. We are Internet
\nProfessional Association of Hong Kong.<\/p>\n

It is very simple, what you can do for the internet,
\nnot what the internet can do for you.<\/p>\n

It’s not like we are looking forward to legislation
\nor better software.<\/p>\n

It’s not the best way.<\/p>\n

Education for the next generation, we have
\na thorough understanding or what it is all about. We
\nhave a good concept, good grasp of it.<\/p>\n

It is after all, the same mission. We have the same
\nmission as IGF.<\/p>\n

It’s not we are jumping to conclusion how we can
\nsolve this problem.<\/p>\n

Thank you.<\/p>\n

>> Ken Ngai: I would like to ask is around the table,
\nAnthony and Stephen, it is about the privacy on-line
\nservice provider, is your point of view what is privacy?
\nBecause it is something, ongoing changes, so today is
\nprivacy, tomorrow maybe not. As I’m studying law,
\nprivacy is a very narrow explanation, but a lot of
\nthings that has had another interpretation, so how can
\nwe provide a platform for the user to upload their
\nmaterials? How is that person going to handle his own
\nprivacy or how is for him to interpret this privacy?<\/p>\n

>> Priscilla Lui: As a point of view as on OSP, is quite
\nembarrassing, because the service provided — should
\nI say in Chinese or English. OK, I will speak in
\nEnglish then.<\/p>\n

>> Anthony Fung: At the OSP level, it is quite embarrassing,
\nbecause for one thing, is that you have to provide
\na service attractive to your consumers, for example,
\nsocial networking.<\/p>\n

But however, from a ditch angle, how attractive or
\nhow flexible that you can provide to your consumers,
\nthat does not draw negative action, such as a few things
\nis that, you know, a lot of websites, social networking
\nwebsites researchable. Should your names be searchable
\non social networking websites. For example, when I was
\nstill with the police force, I quite enjoy a lot of
\nsearch spiders. Why? The search speeders help us to
\nfind criminals on the social networking website. If
\nthese social networking websites the in the allow
\nsearching spiders, for example, easily, they put
\na comment line in one of their script that say no
\nsearching spider allowed, then it breaks down the social
\nnetworking bond, a social norm. Secondly, how does
\ngovernment or law enforcement do a back-end searching of
\na criminal or try to understand the dynamic of this
\nsocial networking scenario.<\/p>\n

What about photos?<\/p>\n

It works both Western Australia.<\/p>\n

For us OSPs, we encourage a lot of photo sharing,
\nbecause that introduce a lot of clicks, a lot of clicks
\ninto your portals introduce income to your portal,
\nbecause the marketing rate.<\/p>\n

The more you share out, then it becomes attractive
\nvenue for criminals also, for various child pornography,
\nrecruitment or even for job market company to recruit
\nyou to some jobs.<\/p>\n

What about posting? As you have rightly mentioned,
\nposting of personal comments.<\/p>\n

If I post my personal comment on my own blog, which
\nis all right, but some of the blogs allow other of your
\nfriends to post on your blog.<\/p>\n

How responsible is the OSP at this level, when the
\noutsider post onto a potential client’s blog. Is that
\na OSP’s responsible, the site owners or the consumers
\nresponsible or the actual personal who post it? There’s
\na lot of legal ramifications.<\/p>\n

Then you come to another issue, as Prof Jackson has
\nrightly mentioned.<\/p>\n

Can you regulate this or you have mentioned can you
\nregulate or Mr Mok has come up with, can you recollect
\nthis? Actually, according to outside experience, it’s
\ndifficult to regulate. Why? Because not even in
\nHong Kong, even between country to country, for example,
\nlet me take an example N retention of record. I don’t
\nknow, I think Hong Kong is still three months or six
\nmonths, I forgot.<\/p>\n

But in Europe, under Brussels, European convention,
\nthey don’t want the OSPs to retain records because they
\nsay records are personal tangible item, so should you
\nyou shot retain those records for more than necessary,
\nfor more than your job. I think it is very similar to
\nprivacy ordinance, privacy commissioner in Hong Kong,
\nnot more than your job.<\/p>\n

However, in United States, the Patriot act or the
\nanti terrorist act, the government wants to control your
\nrecord. You better retain it up to 12 months or up to X
\namount of time, as long as law enforcement want this
\nrecord for pay not act for the protection of national
\nsecurity. You have to retain it.<\/p>\n

There is another contentious issue, different
\nregions have different liking of law, so what is the OSP
\nstanding in the middle? This problem will expire. Now
\nyou talking about cloud. Cloud computing. There is no
\njurisdiction in cloud computing, so which jurisdiction
\nlaw are you going to obey? There is another question.<\/p>\n

What about the transmission of communication? Some
\njurisdictions says communication start the data start at
\nthe person’s computer, but if it’s an email, if I send
\nit toy, where does the communication end? Which
\njurisdiction does it have the right over to examine
\na case?<\/p>\n

The guideline for the OSP is still, I guess,
\naccording to the guideline of the office that you set up
\nin. If you set up in Brussels or Europe, it is probably
\ndifferent than you set in Asia, in Japan or Hong Kong,
\nbut then I think we are all merging into a cloud
\ncomputing, where there is no definite jurisdiction of
\nwhere the data is.<\/p>\n

I don’t think I can outline my feedback to your
\nanswer, but I just want to highlight some of the inner
\nproblem that have in my mind for right now and for
\nanybody have absolutely right solution out there, please
\nsuggest back to us what is feasible solution.<\/p>\n

>> Ken Ngai: If anyone have any questions, please feel free
\nto raise your hand, because Stephen is one in privacy
\nbureau in Hong Kong there is a lot of people using<\/p>\n

Facebook. Facebook actually has, the usage is very
\nhigh. No matter in collecting your use Ang or personal
\ninformation may not be able to comply to the regulation
\nor to our data principle guidelines.<\/p>\n

Does Hong Kong need to take a deeper look at this
\nissue?<\/p>\n

>> Stephen Lau: What about privacy. First and former
\nprivacy commission in Hong Kong, I can go for days
\ntalking about it.<\/p>\n

But I’m not going to do that. I’m going to do
\nquickly.<\/p>\n

Actually, raise two issues early on. You are asking
\nwhat is the definition of privacy? Does it involve
\ntime?<\/p>\n

Particularly here we talk about privacy and personal
\ndata.<\/p>\n

I’m sorry to say that the definition does not
\nchange.<\/p>\n

Technology might change, but definition does not.<\/p>\n

It’s very — privacy, very simple definition, that’s
\nwhy I’m speaking in English, because it’s much better
\nexpressed in this abstract kind of issues.<\/p>\n

The right to be left alone.<\/p>\n

That’s it. Privacy is the right to be left alone.<\/p>\n

With respect to personal data is concerned, that
\nmeans that I should have control in terms of the
\ncollection, drik, accuracy, retention of my own data.<\/p>\n

Sometimes we provide data for purposes which you
\nagree to, like you want to open a bank account, then you
\nhave provide personal data, ID card numbers, whatever,
\nsuch that the bank could operate your account and
\nmaintain your account.<\/p>\n

Banks do not own my data. The word is very simple.
\nAny data you contribute with your own permission to any
\norganisation, that organisation is a custodian of your
\ndata.<\/p>\n

It does not own your data.<\/p>\n

I can go on — one point is when I was privacy
\ncommissioner, for three years into my tenure, I did
\nalready suggest to the government a fairly serious
\nreview of the law, based on the experience and feedback
\nand understanding and the fact that it took more than 10
\nyears, I just want to tell Charles, it’s something
\nbeyond my tenure.<\/p>\n

Facebook. I’m sure Priscilla would be very
\ninterested in this. You might be aware of a recent
\nsurvey. Just announced this week or last week,
\nHong Kong University survey with regard the attitude and
\nhabit of our young people going on to internet and in
\nparticular Facebook, social media.<\/p>\n

Very interesting. This young guy, 80 per cent of
\nthem realise, maybe word of mouth, actually experience
\nor otherwise, that there is danger on the internet, in
\nterms of giving to the website or getting your data
\nvisible, providing personal data to in particular social
\nmedia.<\/p>\n

But 70 per cent say they are quite willing to do it.<\/p>\n

They did not actually think through, it’s one of
\nsay, yeah, I think there’s danger, but what the hell,
\nI still give it. Because they reckon that there is some
\nadvantages in it, because they see that there’s a need
\nrelative to provide that in return for whatever return
\nthey are looking for, whether it with friendship,
\ninformation, whatever.<\/p>\n

That is dangerous.<\/p>\n

Therefore, in terms of there is a lot of education
\nthat’s required.<\/p>\n

When you talk about Facebook and whether in fact
\ntheir privacy notice, whether their privacy, we call
\nthem sort of privacy, I can’t remember what you call
\nthose, choices and all this.<\/p>\n

It’s the same as the law? The law allows it?<\/p>\n

Under the data protection principles, it’s up to
\nyou. If you provide the data, if you consent to provide
\nit, then the law said, yes, why not?<\/p>\n

But the point about why Facebook has been under
\na lot of criticism with respect to the way they would
\nlike to deal with personal data, submitted and
\ndistributed within Facebook, is because if any
\norganisation has a clientele of 400 million, which are
\nsavvy, they are on the net, which is a very good target
\nfor marketing all kinds of merchandise, products and
\nservices, and they are still struggling to find
\na business model upon which they can make money or maybe
\nmaking more money, and the only asset they could have is
\nactually the information that you have submitted or you
\nhave given to and therefore, you suddenly find in their
\nprivacy statements and all that, they would like to use
\nyour data for purposes upon which you might not feel —
\nin fact, a lot of them do not feel comfortable.<\/p>\n

That’s why there was this huge outcry, twice now, in
\nthe last 12 months, with regard privacy consideration as
\nposed by Facebook.<\/p>\n

My advice has always been to particular youngsters,
\nin fact to everybody here, if you submit any data onto
\ninternet, be prepared that it’s visible to everybody.<\/p>\n

That’s the bottom line.<\/p>\n

You can do a lot of protection, but whenever you do
\nthat, think first. Think about the value and the cost.<\/p>\n

If you feel that is worthwhile, do it.<\/p>\n

>> Michael Gurstein: I just want to make an apology. I made
\na statement this morning that I think was — that
\nI misinterpreted some data. It’s actually, it’s not
\nrelevant to this particular discussion, but it’s rather
\nrelevant.<\/p>\n

I said that the internet usage in Canada had
\ndeclined. In fact, it has increased, but what some data
\nhas just come out, I’m just checking the internet, but
\nsearching around, I think what I was referring to is
\nthat month to month usage in the US web usage has
\ndeclined for the last two months and fairly
\nsignificantly, it declined February to June, it’s
\nactually bin in decline.<\/p>\n

It might be interested what people think about that,
\nif there’s any linkage to Burma people said.<\/p>\n

>> : This is Ben from IET Hong Kong.<\/p>\n

Mr Fung’s experience on this stage with the police.
\nMr Fung is very good in searching the of fen errs over
\nthe web and on the other hand, I see that if I commit
\nthe same crime in the real world, it’s much less severe
\nthan I do the same in the web.<\/p>\n

Yesterday, I saw a quarrel and there’s two persons
\nmaking a lot of sort of foul language exchange and then
\none said I do believe I am going to beat you up. Then
\nsay the police went by and then the police saw that,
\nthey were just crazy and no action was taken. On the
\nother hand, if I put this and leave this in a cyber
\nfootprint on the web there, for sure, under Mr Fung they
\nwill search me, because I make such a statement over the
\nweb. Are we seeing that there are two levels of law
\nenforcement standard in maybe Prof Jackson, you can
\ncomment on this unwith. Thank you.<\/p>\n

>> Michael Jackson: I suppose the only obvious comment you
\ncan make is the one that when you go on-line, you create
\na permanency to what’s happened. Who happens is
\nrecorded in some form or other and therefore, it is
\nevidentially available. Maybe that in the real world,
\nif there was a witness who do at test to what has been
\nsaid to some person, the police would likewise deal with
\nit.<\/p>\n

But often there isn’t or often they are not willing
\nto speak, because of all sorts of other social
\nrelationships and so on that arise.<\/p>\n

There is a permanency to what is done and said in
\nthe cyber world, yes, which means that it is easier to
\npursue persons in that vehicle, in that form or as
\na result of that.<\/p>\n

I don’t know that that means that you are worse off
\nor that means that you are going to get produce accused,
\nor you wouldn’t be prosecuted in the real world.<\/p>\n

I don’t think that follows.<\/p>\n

But it is the case where there are discerned to be
\nreal threat, then they can have a better basis for
\nproduce kuling you.<\/p>\n

Taking that point and one thing that Stephen said,
\nabout Facebook and the loading up of information into
\nthe personal information into the web.<\/p>\n

The problem is, although you said that it’s your
\ninformation that custodians of it, but you have lost
\ncontrol over it. That is the fundamental problem that
\narises. In the real world, if you have information, you
\ncan disclose it or not and you can determine to some
\nextent how that is disclosed and you can deny it if
\nsomeone said you said this and you say I didn’t say
\nthat.<\/p>\n

I think budge of the things that has become very
\nimportant in recent discussions about the internet is
\nthis question of delete.<\/p>\n

The finding a mechanism so that what you do and say
\non the internet, can, at some point, deleted from it
\npermanently. These incidents we have of people who have
\nwithin, things that they have said and done 30, 40 years
\nago have come back to haunt them in some way. Your
\nyouth I think that’s one thing that clearly has to be
\nexplored more fully, is ways in which what you put onto
\nthe web can be deleted, either by you or by a process in
\nsome time, rather than remaining permanently cached
\nthere for someone 30 years later when you are seeking
\na position of high importance, to remind you that you
\nspent six hours a day for two years searching
\ninappropriate websiteses, whatever they may be. That
\nrecords still remains.<\/p>\n

>> Stephen Lau: When I talk about — you are right. When
\nI talk about being custodian, this is what the law says
\nof your right. You are the owner, however, yes, because
\nof internet, because of its interlinkage, because of
\ncloud computing and technology, you do lose sight or
\nlose control.<\/p>\n

Therefore, this right I use the word, the right to
\nbe deleted or the right to on security.<\/p>\n

It’s something nowadays individuals or consumer
\nwould like to have a control over.<\/p>\n

Whether in fact something could be deleted
\npermanently, completely, you will not be sure.<\/p>\n

You will not be sure. Because it’s quite simple.
\nYou could Google something, if you use a different
\nexpression for the same thing, and you get different
\ninformation coming back at you.<\/p>\n

This is where complexity is, that’s why we are here
\ndiscussing technology advances, legal, laws, how they
\ncould cope or chase up with technology advances, we
\nalways falling mind and all this.<\/p>\n

I just want to make that comment.<\/p>\n

>> Ken Ngai: I think we are running out of time. Maybe
\nI let the other panellists to wrap up for one minute.<\/p>\n

>> Anthony Fung: From the industrial point of view, is that
\nwe try to work in partnership from various level,
\nforming our own coalitions with advisers from different
\nindustries like antivirus and the NGOs, et cetera, that
\nwe try to work closely with the government regulations
\nand also one thing is that we try to educate our users
\nas much as possible along with simple guidelines,
\nhopefully the customers, consumers can be protected and
\nbe more educated if industry can offer simple
\nguidelines.<\/p>\n

For example, one very quick example is the child
\nexploitation and on-line protection unit in the UK.
\nThey recommend Facebook to put a red alert button on
\nFacebook if the child or the parent deem that content is
\noffensive, then there’s no other simpler way than
\nputting, than click on that one red button which sends
\nthat particular content to the police or 24\/7 basis.<\/p>\n

Simple work with the government and work with all
\ndifferent parties in industry.<\/p>\n

I was told that I spoke too fast in Chinese last
\ntime, so they couldn’t describe my speaking, so I do it
\nin English this time.<\/p>\n

>> Charles Mok: I want to respond to this January’s question
\nabout the differences between enforcement if the real
\nworm and in the cyber world. I think that is a lot of
\ntimes the real problem. What you said made me think of
\nnew stories that I just read this morning from the
\ninternet and it was saying that someone who is an
\nnational guard in Mary land in the US, he was speeding,
\nhe was a motorbike irand he was speeding and he got
\npulled over by the state police and the policeman was
\nvery rude and was wilding a weapon, his gun and it just
\nso happened that the biker had a helmet on with a camera
\nand he filmed the whole thing and put it on Youtube.<\/p>\n

Who happened after that was a week later, he was
\narrested from home, woken from his bed, and taken away,
\nbecause he apparently violated some statute in Mary land
\nthat has to do with illegally filming or taking a record
\nof police action.<\/p>\n

So the case I’m reading the case has ing nighted the
\ndebate over whether police are twisting a decade old
\nstatute intended to protect people from government
\nintrusion on privacy to instead keep residents didn’ts
\nfrom recording police activity.<\/p>\n

I think that is a lot of times also the issue that
\nwe face, laws were made for another world and they are
\ntrying to enforce it in today’s situation and that
\ncauses a lot of problems.<\/p>\n

Finally, on a lot of the privacy issue that we talk
\nabout with Facebook, I just also want to report that,
\nactually, there are actually a lot of companies that,
\ntechnology companies that are very proactive in trying
\nto get together like Anthony was talking about, to try
\nto do something about protecting various privacy and
\nother issues on the internet. One example is a global
\norganisation called global network initiative.<\/p>\n

You can go to Google and find out more about it.<\/p>\n

Actually, there are three corporate members,
\nMicrosoft, Yahoo and Google, among other NGO founding
\nmembers.<\/p>\n

One of the things that they have been working on and
\nI’m a participant of, is a working group on account
\ndeactivation.<\/p>\n

There is a growing problem of people’s account,
\nemail account, Facebook accounts and so on, being
\ndeactivated for a number of unknown reasons, maybe
\nsomeone reported about you, I think that happened to
\nmany of us in Hong Kong with Facebook accounts, once you
\nhave become outspoken about certain issues, the groups
\nthat you created or your personal account would get
\nsomeone would report you for abuse and Facebook for
\na company like that, they probably don’t care to read
\nthe Chinese content in the postings and they just simply
\nwe got 50 complaints within a day, this must be pretty
\nbad, so let’s just cancel his account or suspend. They
\ndo that a lot of time and there’s no appeal mechanism at
\nall.<\/p>\n

That is also an issue. It’s not just an
\ninconvenience, it is an issue that has to do with
\nfreedom of expression.<\/p>\n

That is actually, for example, one of the working
\ngroups in GNI, that we are working on to try to set up
\nsome sort of standards and appeal mechanisms and so on,
\nso the users can try to work with these social media or
\nemail providers and so on, these companies to try to
\nhave a more established and transparent way of making
\nappeals and their policy of removal of account,
\ndeactivation of account.<\/p>\n

The problem is Facebook, unfortunately, is really,
\nthey just don’t do anything. They just don’t still
\nhasn’t responded to any of our demands or requests for
\ntalking to them.<\/p>\n

>> Stephen Lau: I just want Priscilla, you have hard word
\nfor the panel and particularly related internet and
\nchild abuse or protection thereof. Maybe you like to
\ngive us advice or some consideration.<\/p>\n

>> Priscilla Lui: Like Charles, we have a lot to say, but
\ntime is limited and yet, I would like to use this as
\na summary.<\/p>\n

Because while Charles mentioned about collaboration,
\ncommunication, working together, I think it’s a very
\nimportant area.<\/p>\n

I hope that more and more, the industry, the field
\nand so on and so forth, would allow children to join in
\nand would allow parents, citizens to join in more and
\nmore time would be allowed to listen to them.<\/p>\n

So that we’ll know the difficulty, we’ll know some
\nof the recommendations and the way that they solve their
\nown problems.<\/p>\n

Let me use this to end my sharing.<\/p>\n

I remember during the cope even Hague even
\nconference on the environmental protection and Al Gore
\nwas being interviewed, because of time limit, he was
\nasked to give one answer to the solution and of course
\nthere is no one answer and he said of course it would be
\nimportant for the government to take the lead, it would
\nbe important to have a visionary leading government in
\nthe community, but more important, it’s every it is zeb,
\nit’s not only the government, but everyone, who has the
\nresponsibility and it’s a collective responsibility,
\nalso in this particular area of concern, but please
\ndon’t leave out the basic concern, which is the law and
\nrules and administration which is very important,
\nparticularly for children and young children, the under
\n18.<\/p>\n

Because if you leave it to their own hands, they’re
\nnot in a position to protect themselveses, to that
\nextent.<\/p>\n

>> Stephen Lau: Thank you, Priscilla.<\/p>\n

On behalf of myself and Ken, and on your behalf, let
\nme thank our speakers and our panellists for such
\nenlightened discussion on security, privacy and
\nopenness.<\/p>\n

We can provide the coupons upon which we have
\ndonated a certain amount of money in lieu of a souvenir.<\/p>\n

We have another for about 40 minutes to go.<\/p>\n

So please stand up, stretch your legs and go to what
\nAmericans call comfort station if you wish to and while
\nwe switching name plates and resetting.<\/p>\n

>> : Now the volunteers will distribute feedback form to
\nyou, so please kindly fill it in and return to the
\nregistration counter, if you finish it.<\/p>\n

Now we will have some time for the set-up, so you
\nmay use the time to fill the form.<\/p>\n

(Short break)<\/p>\n","protected":false},"excerpt":{"rendered":"

Security, Openness and Privacy ________________________________________________________________________ REAL TIME TRANSCRIPT: Security, Openness and Privacy Hong Kong IGF 14:30-17:00, Thursday 17 June 2010 Hong Kong DISCLAIMER: Due to the inherent difficulties in capturing a live speaker’s words, it is possible this realtime transcript may contain errors and mistranslations. An edited version of the realtime transcript which amends the … <\/p>\n

Continue reading “Hong Kong IGF \u2013 June 17th, 2010: Session 3”<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":"","_links_to":"","_links_to_target":""},"class_list":["post-365","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/pages\/365","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/comments?post=365"}],"version-history":[{"count":1,"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/pages\/365\/revisions"}],"predecessor-version":[{"id":560,"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/pages\/365\/revisions\/560"}],"wp:attachment":[{"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/media?parent=365"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}