Ethical and Legal Issues in Cybersecurity Encryption

This report provides a discussion of the ethical and legal issues associated with encryption in cybersecurity. It explores current encryption policies, ethical issues of encryption, and the impact on individual freedoms and access to information.

Running head: CYBERSECURITY
CYBERSECURITY
Name of student
Name of university
Author’s note:

1
CYBERSECURITY
Introduction
This report aims to provide a discussion of the ethical and the legal issues associated
with the encryption associated with the cybersecurity. The present policies of the encryption
are briefly discussed in this report. The ethical issues of the encryption have been provided
with a clear discussion in this report. A recommended strategy for improving the present
policies in the encryption has been discussed in this report. Lastly, this report concludes with
the appropriate conclusion for the report.
The encryption is commonly used in the organisation by the use of the cryptography.
The cryptography has been widely considered as the method of information security in the
present electronic world. Additionally, for the eCommerce, E-Mail and the other application
over the internet, this method has been extensively utilised for securing the various aspects of
the technology (Brakerski & Vaikuntanathan, 2014). This increased reliance onencryption
methods has increased the various kinds of ethical queries that are of global concerns, which
are loosely connected to the fundamental human rights. Several people for whom the
encryption has been developed, views it as the blessing that could help with implementing the
extensive security methods but there are significant people who believe that the encryption
methods using the cryptography could be harmful and disadvantageous as it makes the
situation of the denial of access to the information for people (Brakerski, Gentry &
Vaikuntanathan, 2014).
Discussion
In the present business scenarios, the application of the ethical could be done in
various aspects of the computers. The ethics could be applied to the technological choices
and the aspects thatinclude the ethics of the encryption and the decryption that could be
generalised as the cryptography (Garg et al., 2016).

2
CYBERSECURITY
Current policies of encryption
The policies have been implemented by the various companies for monitoring the use
of the encryption and the exploitation of the encryption policies. The encryption policies that
are commonly included while using the encryption are:
Policy 1: Based on the risk assessment of the data protection, the firms uses the
cryptography technology for the encryption of the confidential and the other sensitive data,
unless documented using the exception process (Gorbunov, Vaikuntanathan & Wee, 2015).
The symmetric cryptosystem key length must be almost 80 bits for the confidential data andat
least 64 bits for the other sensitive information that are identified by the firm or the
organisation. The asymmetric cryptosystem keys should be ofat least length that provides
equal strength (Li et al., 2014).
Policy 2: The hard drives that have not been completely encrypted like the encrypted
partitions, the virtual disks are unencrypted but connected to the encrypted USB devices
might be significantly vulnerable to the information leakage from that encrypted sector within
the unencrypted sector (Sahai & Waters, 2014). The confidential data that are stored on the
computer systems owned by as well as located into the controlled spaces and the networks
must be extensively protected by the encryption with the strict access controls that could help
in the proper authentication of the identity of the individuals who access the particular data or
the system (Goldwasser et al., 2014). The hard drives of the computers or any other storage
media, which are encrypted must be updated regularly for preventing the unauthorised
exposurein accordance with the Removal of the Data from the safe disposal policies for the
equipment of the Data Processing.
Policy 3: The portable devices represents the specific category of the devices that
contains the data. Several incidents thatinclude the unauthorised exposure of the confidential

3
CYBERSECURITY
data are sometimes the result of the stealing or the lost portable devices. The most appropriate
method of preventing the theft of portable devices is the avoiding of storing sensitive
information on the devices (Zhou, Bao & Chen, 2014). As a common practise, the
confidential data must not be copied or stored on any of the computing devices or any device
thatis supposed to be exchanged among the organisations. Moreover, in the situations when
there is the requirement of transferring the data within the organisation, the encryption
reduces the major risk of the unauthorised disclosure in any event of stolen or the loss of the
device. The users of the information must have the particular permission from security officer
prior storing the confidential data on any portable computing device or any of the computing
device that is owned by the organisation (Stefanov, Papamanthou & Shi, 2014). The use of
portable devices like the laptops, smartphones, tablets and PDAs are restricted for any of the
long term storage of any of the confidential information of the organisation. And if any
situation arises where the use of the portable devices is essential, the devices with the proper
encryption mechanisms must be used for securing the data on the portable devices (Cash et
al., 2014).
Ethical issues of encryption
The methods of the cryptography are commonly most popular among the
organisations for securing all the data of the organisation. The encryption could be referred as
the transformation of the data into the form, which is closely impossible to read deprived of
the proper knowledge or in this situation the key (Li et al., 2015). The main purpose of
implementing the encryption is ensuring privacy by preventing the information to fall in
possession of any unauthorised user who could exploit the data for their benefits. The
decryption could be denoted as the reverse of the encryption, which is the transformation of
the encrypted data into the original form, which could be easily read by the person or the
organisation where the data was intended to be sent. The encryption systems are in the

4
CYBERSECURITY
majority of situations considered as the essential component in the self-determination of the
humans, where the encryption is considered to offer the escape from any oppressive grips of
state. In some situations, the encryption methods are observed as the system of the denial of
the access to any particular information, which is significantly essential for the human
development. Even though the systems that are based on the encryption has grown to be a
good idea, this methods has also introduced several challenges into the present business
scenarios (Naveed, Prabhakaran & Gunter, 2014). With the methods of encryption, there
could be several situations where the data is not properly decrypted, and the business or the
organisation has resulted in the loss of significant revenue. The majority of the ethical issues
in the cryptography poses the equations commonly on the rights, on the individual freedoms,
on the individual access and the final question of the decision whether to track or not
implement the tracking (Hohenberger & Waters, 2014).
Encryption and individual freedoms
The main issue that rises in this situation is that is it that the key of any individual
protects complete privacy of the communication? It could be considered as the matter of the
government against the public interest. When the situation arises like the state has imposed
the strong cryptography on national infrastructure with all the citizens related to the weaker
versions and none of them was allowed the exporting the strong product, it might result in the
rise of the opposing groups where there are two voices, one for the state and the other one for
the citizens (Cash et al., 2015). It has been observed that a few years back the implementation
of the policy by the US government to restrict the utilisation and the exporting the powerful
encryption technology has introduced the serious debate among the various groups of the
country. There have been the emergence of the contending views between the initial group
regarding the key escrow or the encryption for the key recovery where the proper storing of
the encryption key is done along with the TTP or the Trusted Third Party. Therehas been the

5
CYBERSECURITY
argument among one group that this key escrow could be the most appropriate method of
regulating the access (Rajendran et al., 2015). Then the other group has considered the view
that all the critical infrastructure could be rendered increasingly and it would become
vulnerable to the attack, and it allows the third parties even though they are trusted
significantly to involve in the access to encoded communication. On other side, it is argued
that all the citizens must have the right of encrypting the message that is sent by them by the
utilisation of the strong encryption that could not be decrypted by anyone especially by the
government. It is majorly suggested by this group that the storing of the escrow key could not
be done with the government as it would provide the complete access to the data of the
organisations. Some of the questions that are raised are the if any government authority
gainsaccess to the encrypted data by using any warrant, then is there any motive behind
encrypting the data in the first place? Another question that has risen is that who would
efficiently monitor the government authority who are provided with the encryption keys?
These specific questions of the ethical concern where the right of the citizen for
allowing the encryption has been presented as the aspect of the individual morality. This
European commission could be of the view that the privacy consideration suggests not to
restrict utilisation of the cryptography as the methods of ensuring the data confidentiality and
the security (Subramanyan, Ray & Malik, 2015). Another issue that has been raised because
of the introduction of the encryption is that whether the key prevents access to the
information regarding the individuals? It relates to all the state restricting the freedom of
access of the private citizen to the information regarding themselves. There are some of the
ethical aspects of existence and the deployment of the encryption for the purpose of the state
secrecy.

6
CYBERSECURITY
Encryption and individual access
This specific question of the individual access includes the intellectual property,
issues of copyright andaccess to the important information. The major question that arises in
this aspect is the issue where does the key of any individual protects the intellectual property?
The materials that are created by any individual using the electronic media platform are their
respective intellectual property, and by the use of effective encryption, that individual is
protecting their property from the theft and the tampering. That individual is protecting the
moral rights of the integrity and the paternity while providing the required help to the users
by guaranteeing the authenticity of the content and offering the warranty for the authorship.
The individuals who argue to this access to the intellectual property must be free from the
regulations and the cost by the legal instruments like the copyright law, which intends to
characterise the adversaries as the wealthy rights holders. The producers, publishers and the
broadcasters who manage the argument are increasingly demanding the high margins of
profit and therefore helping in the creation of the undemocratic separations of the people into
the information-rich as well as the information poor.
But it has been considered as the fact that the authentic creators of all content are not
the publishers or the producers but the individual artists and the authors. When the situation
rises and the content being made free of cost and the enforcing of the copyright law is not
done, the major impulse for the majority of creation would be eliminated. However, the
majority of the creators have been discovered to be not increasingly wealthy, and they are
hardly sufficiently compensated for all the time as well as the efforts that are implemented by
them for the creations. The obvious problem with the encryption as the global solution has
been discovered that as soon as something has been decrypted by any authorised user, it
might also be significantly vulnerable to the transgressive tampering and the copying. It
requires that the decryption must be done in any secure environment anda transient manner.

7
CYBERSECURITY
Therefore, in environments such as the internet, the encryption could be viewed as the ideal
manner for protecting some kinds of content.
Moreover, the ethical aspect lies in the utilisation of the encryption to withhold the
information in the situations where the information is significantly critical to human
development. Various ethical question surrounds this issue of the free access and the freedom
of the access to the information. The other question that is commonly originated from the
encryption is that does the key prevents the access of the individual to the important
information of the respective individual? This question of the access to develop the ideas of
the information poor and the information rich, which is the bye product of the global
revolution in the information technology. The essential information could be considered as
the information connected to the common minimum requirements of humanity. It could be
considered as the information important for the development of the backbone industries, the
common science, as well as the survival of the health, welfare, education andlabour. The
issue of the important information comprises of several ethical questions. With gradual
encryption of the valuable information, the individuals who are considered as the information
poor have been denied any access to the information.
Another ethical issue that has risen with the encryption is that does it seem fair to
track or is it unethical? This is the common point of the ethical concern is does the authentic
pursuit of the rights infringes right to privacy of the individual who is being pursued. The
tracking by any individual tells the various activities that are being done. The digital
watermarking, where the watermark has been encrypted and where the placing of the rights
management information has been done in that watermark, the holder of the rights must be
able to track the works all across the internet. The foremost concern could be discovered that
the right of tracking location of any particular content must be abused by the authoritarian
forces. This could be considered as the severe invasion of the privacy to the seeking and then

8
CYBERSECURITY
gaining the accurate and the constant information regarding the activities of any individual
such as reading, hearing, viewing or feeling. The tracking could provide the information
regarding the piracy, regarding the attacks that could severely damage the integrity or the
authenticity of work andregarding the infringement of the moral rights. Any creator would
want to have this information just as any users desire the assurance of theoriginal integral
text. This specific dilemma is of concern, and the solution for this dilemma is likely to lie in
the systems that solely tracks the unauthorised uses.
There are several aspects of the ethical concern that are residing in digital libraries.
These ethical concerns of the encryption evolved round the copyright issues and the
intellectual property and therefore, the matter of the information access. Factually, the
encryption intends to be the basis for the implementation of the copyright and the access of
the authorisation in the digital environments. It could offer new methods of protecting the
intellectual propertyi in the digital world.
Revised policy
The suggested policy that has been providedis:
 Effective management of the accessible copy of data on the servers that are managed by
the firm, by the utilisation of the procedures specified by the security officer of the firm.
 Utilise the technologies of the whole disk encryption that offers the authorised system
administrator with access to data in any event of the forgotten key.
 Users are required to follow the satisfactory use policies of the organisation when the
transmission of the data and they should take the specific care when the transmission or
the re-transmission of the confidential data is done.
 When using the email message for sending the confidential information, the information
is required to be severely encrypted.

9
CYBERSECURITY
 Wireless transmission, which is used for accessing the portable computing devices or the
internal network, are required to be strictly encrypted using the proper protocols and the
specific security mechanisms.
Conclusion
Therefore, it can be concluded that the encryption could be immensely important for
executing the secured computing processes, but it includes the several ethical issues that are
required to be monitored for securing the transmissions. The hard drives that have not been
completely encrypted like the encrypted partitions, the virtual disks are unencrypted but
connected to the encrypted USB devices might be significantly vulnerable to the information
leakage from that encrypted sector within the unencrypted sector. The portable devices
represent the specific category of the devices that contains the data. Several incidents that
include the unauthorised exposure of the confidential data are sometimes the result of the
stealing or the lost portable devices. The encryption could be referred as the transformation of
the data into the form, which is closely impossible to read deprived of the proper knowledge
or in this situation the key. The main purpose of implementing the encryption is ensuring
privacy by preventing the information to fall in possession of any unauthorised user who
could exploit the data for their benefits.

10
CYBERSECURITY
References
Brakerski, Z., & Vaikuntanathan, V. (2014). Efficient fully homomorphic encryption from
(standard) LWE. SIAM Journal on Computing, 43(2), 831-871.
Brakerski, Z., Gentry, C., & Vaikuntanathan, V. (2014). (Leveled) fully homomorphic
encryption without bootstrapping. ACM Transactions on Computation Theory
(TOCT), 6(3), 13.
Cash, D., Grubbs, P., Perry, J., & Ristenpart, T. (2015, October). Leakage-abuse attacks
against searchable encryption. In Proceedings of the 22nd ACM SIGSAC conference
on computer and communications security (pp. 668-679). ACM.
Cash, D., Jaeger, J., Jarecki, S., Jutla, C. S., Krawczyk, H., Rosu, M. C., & Steiner, M. (2014,
February). Dynamic searchable encryption in very-large databases: data structures and
implementation. In NDSS (Vol. 14, pp. 23-26).
Garg, S., Gentry, C., Halevi, S., Raykova, M., Sahai, A., & Waters, B. (2016). Candidate
indistinguishability obfuscation and functional encryption for all circuits. SIAM
Journal on Computing, 45(3), 882-929.
Goldwasser, S., Gordon, S. D., Goyal, V., Jain, A., Katz, J., Liu, F. H., ... & Zhou, H. S.
(2014, May). Multi-input functional encryption. In Annual International Conference
on the Theory and Applications of Cryptographic Techniques (pp. 578-602). Springer,
Berlin, Heidelberg.
Gorbunov, S., Vaikuntanathan, V., & Wee, H. (2015). Attribute-based encryption for
circuits. Journal of the ACM (JACM), 62(6), 45.

11
CYBERSECURITY
Hohenberger, S., & Waters, B. (2014, March). Online/offline attribute-based encryption.
In International workshop on public key cryptography (pp. 293-310). Springer,
Berlin, Heidelberg.
Li, J., Huang, X., Li, J., Chen, X., & Xiang, Y. (2014). Securely outsourcing attribute-based
encryption with checkability. IEEE Transactions on Parallel and Distributed
Systems, 25(8), 2201-2210.
Li, J., Li, J., Chen, X., Jia, C., & Lou, W. (2015). Identity-based encryption with outsourced
revocation in cloud computing. Ieee Transactions on computers, 64(2), 425-437.
Naveed, M., Prabhakaran, M., & Gunter, C. A. (2014, May). Dynamic searchable encryption
via blind storage. In 2014 IEEE Symposium on Security and Privacy (pp. 639-654).
IEEE.
Rajendran, J., Zhang, H., Zhang, C., Rose, G. S., Pino, Y., Sinanoglu, O., & Karri, R. (2015).
Fault analysis-based logic encryption. IEEE Transactions on computers, 64(2), 410-
424.
Sahai, A., & Waters, B. (2014, May). How to use indistinguishability obfuscation: deniable
encryption, and more. In Proceedings of the forty-sixth annual ACM symposium on
Theory of computing (pp. 475-484). ACM.
Stefanov, E., Papamanthou, C., & Shi, E. (2014, February). Practical Dynamic Searchable
Encryption with Small Leakage. In NDSS (Vol. 71, pp. 72-75).
Subramanyan, P., Ray, S., & Malik, S. (2015, May). Evaluating the security of logic
encryption algorithms. In 2015 IEEE International Symposium on Hardware
Oriented Security and Trust (HOST) (pp. 137-143). IEEE.

12
CYBERSECURITY
Zhou, Y., Bao, L., & Chen, C. P. (2014). A new 1D chaotic system for image
encryption. Signal processing, 97, 172-182.