Sunday, June 17, 2001		Lead Article

How private are your bytes?

If you look at computer security, you will see that most of it is common sense-related. A password-protected screen saver is one of the easiest ways to make it difficult for anyone to access your computer when you are not working on it, says Roopinder Singh.

YOU wouldn’t really leave a load of sensitive documents lying around for others to see, would you? But what about leaving your computer unsecured?

Most of us do not give any thought to the security of the ubiquitous computer that adorns practically every modern desktop.

We start by using the computer for doing innocuous tasks, and as we get comfortable with the idea of using the machine, we realise that one of the best things about it is that we can do all our type writing on our own, thereby not letting the typist see confidential matter. Also, we use the computer for storing such data.

All we have to do is to input the material, take a print out and use it. That’s all quite true, but the trouble is that often we are a bit too clever in that we store it on the hard disk. Most of the data that is stored can be accessed by people who know how to, and even some casual users! This is something that we need to keep in mind at all times, since we would want to secure our privacy.

Let’s say that you typed a letter to your boss telling him how much better you are than a colleague sitting on the desk next to you and how you wish that your services were better appreciated by the company.

After you have run a spelling check and formatted the letter, you take a print out and toddle off to your boss. In the meanwhile, your colleague, much intrigued by the furtive glances you have been shooting off in his direction for the last one-hour, casually comes to your computer and sees the document. In your hurry to get the missive to the boss quickly, you had forgotten to close the file!

This would fall in the category of stupid mistakes, though its one that is often encountered in office situations. A simple way out of this is to close the file. You could also have a password-protected screen saver that you automatically start in case your computer is not used for a specific period of time.

In fact, if you look at computer security, you will see that most of it is common sense-related. A password-protected screen saver is one of the easiest ways to make it difficult for anyone to access the computer when you are not working on it.

But it is not foolproof. Such security can be bypassed. In fact, experienced computer professionals with the right kind of software can even read from hard drives on which data has been erased.

It would, thus, make sense for us not to store any sensitive documents on the hard drive of the computer. We would simply work on the floppy. At the same time, we have to remember that when we are using Microsoft Word, it will often save a so-called "unsaved" document as a temporary file. In order to make sure that the hard drive does not have such a file, what we would have to do is save the file the minute we open it on to the floppy in the ‘A’ drive. This way, the information would be stored on the floppy and would not get to the hard drive at all. Of course, given the unreliability of floppies, we would need to make a back up of the file on another floppy and we have to make sure that the floppies are kept safely!

While some might find this kind of security a bit too much and even question the need of such privacy that makes it necessary, most would agree that almost all the work done on job needs to be protected. Every computer has private information that is worth protecting, like personal letters, which may contain details about your personal life that you don’t want others to know. It could also contain documents you sent to your lawyer, some personal e-mails, etc.

Such information is always deemed private and everybody has a right to privacy. What we have to be clear about is that computer technology and cyberspace must not be viewed as something separate from the real world. Thus, if we have laws protecting mail as private, the same principle applies to electronic mail. Like physical mail, e-mail should be protected by the same privacy rights.

Often you will notice a disclaimer that appears at the end of various electronic mails, especially those emanating from big corporations, saying that the mail is only for the intended recipient, etc. This is done to reinforce the parallels between the two kinds of mail.

Now that we have established that you are entitled to your privacy, you have to make sure that you get it by keeping the information on your computer secure. Unfortunately, it isn’t as secure as you think, more so when you are connected to the Internet. You might be able to defend your isolated computer in that castle that you call home, but this only works as long as you are not connected with any other computer. Once you use your computer to connect it with the Internet, the physical position of the computer becomes meaningless, you are reaching out and are vulnerable through the link with which you seek to connect to the world.

The Internet is a wonderful storehouse of information, but often as you surf the Net, information about you is also getting stored somewhere. Thus, for example, the moment you log on to a Web site, your browser keeps a record of it, various images and other information from the site get stored in a temporary memory part of your computer called cache.

In technical terms, cache is a small, fast memory that holds recently accessed data. It is designed to speed up subsequent access to the same data. This is great, though in the hands of even a moderately good computer user cache is something that can be accessed and gives a more than fair idea of the kind of sites you have been accessing.

Of course, your browser too stores the names of the sites that you have visited and the time, etc., in its history feature. So if you do not want anyone to know what sites you have visited while you were surfing, you have to clear the cache as well as the history. Of course, this is not going to stop someone who can really pry on the computer, but it will keep most of the nosey-parkers at bay.

In most offices, you are connected to the Internet through networks using what are called proxy servers and this gives the network administrators access to the sites you are visiting. In many offices, administrators would also be able to block access to sites deemed offensive.

How will someone know that it’s you when you are pretending to be someone else? Actually, they know it’s your computer because an Internet Protocol (IP) number identifies every computer that accesses the Internet, which is unique. This IP number makes its way into almost all activities that you take part in while using the computer.

Of course, there is a way out, in fact, many. One of the most popular ways is to go through www.anomizer.com, which literally make you anonymous by stripping you of your identification tags while you are surfing. This is a paid service, though a free one is also available with built-in delays to encourage you to buy the software and thus increase speed.

This brings us to another issue. What exactly is your right to privacy in an office? While no one would deny you the right to privacy at home, in an office you are doing a job even when you are using a computer and, thus, you have very truncated rights as far as privacy in concerned.

It is a well-known fact that not only can most offices monitor the work, or the lack of it, done by their employees, but also can and do monitor their online activities, including e-mail. In fact, the rule of the thumb is that as long as the employers have a clear-cut policy of "monitoring" the employees, they can do so, provided they have spelt it out to the employees.

Some time ago workers in a prominent Indian software firm received warnings after they applied for positions elsewhere. They were caught by scanning software that checked all the outgoing message for particular words or phrases.

Once you have got past your server, you go to another server, which also keeps a record of your IP number. Often, this would be the server of the Internet service provider (ISP). It is said that the police and intelligence agencies have asked such service providers to keep the access logs of all users available for inspection. Also, according to various reports, there is also a lot of scanning of e-mail going on.

In any case, even when you visit a Web site, it collects a fair amount of information about you. Your IP number tells them things like what part of the world you’re coming from or what service provider you are using.

Another infamous feature about Internet browsing is called cookies. Your browser offers so-called "cookies" which — if you allow their use —store small amounts of data on your computer about your visit to any Web sites. Cookies have a legitimate purpose in assisting the Web site administrators in tracking which of their features you like best. And when you re-visit the site, cookies can enable it to customise content according to your preferences. At the same time there are widespread fears about cookies being used as information gathering blocks about your life.

One of the main reasons why online shopping has not caught on is a sense of disquiet that users have in giving their credit card numbers over the Net. Ironically, precisely for this reason, online transactions of this kind are among the safest on the Internet, provided you are careful enough to only log on through a secure server. Whenever you see a padlock on the lower left hand corner of your browser, you know that you are on a secure server site.

As long as you remember your worldly concerns even as you cruise through the cyber world, as long as you keep your common sense approach to privacy and security, you are all set to enjoy a fabulous and new experience—productively.