A.M. Arnbak, Author at IVIR

In: Communications of the ACM, vol. 57, no. 10, pp. 47-55., 2014, ( Also published in:<i> <a href="http://dl.acm.org/citation.cfm?id=2673311&CFID=582181517&CFTOKEN=51677975" target="_blank">ACM Queue - Security</a></i>, 2014-8, vol. 12. ).

(Abstract | Links | BibTeX)

@article{,

title = {Security Collapse in the HTTPS Market},

author = {Asghari, H. and Eeten, M.J.G. van and Arnbak, A. and van Eijk, N.},

url = {http://www.ivir.nl/publicaties/download/CACM_2014_10.pdf},

year  = {2014},

date = {2014-10-10},

journal = {Communications of the ACM},

volume = {57},

number = {10},

pages = {47-55.},

abstract = {

	HTTPS (Hypertext Transfer Protocol Secure) has evolved into the de facto standard for secure Web browsing. However, widely reported security incidents\textemdashsuch as DigiNotar's breach, Apple's #gotofail, and OpenSSL's Heartbleed\textemdashhave exposed systemic security vulnerabilities of HTTPS to a global audience. The Edward Snowden revelations\textemdashnotably around operation BULLRUN, MUSCULAR, and the lesser-known FLYING PIG program to query certificate metadata on a dragnet scale\textemdashhave driven the point home that HTTPS is both a major target of government hacking and eavesdropping, as well as an effective measure against dragnet content surveillance when Internet traffic traverses global networks. HTTPS, in short, is an absolutely critical but fundamentally flawed cybersecurity technology.



	To evaluate both legal and technological solutions to augment the security of HTTPS, our article argues that an understanding of the economic incentives of the stakeholders in the HTTPS ecosystem, most notably the CAs, is essential. We outlines the systemic vulnerabilities of HTTPS, maps the thriving market for certificates, and analyzes the suggested regulatory and technological solutions on both sides of the Atlantic. The findings show existing yet surprising market patterns and perverse incentives: not unlike the financial sector, the HTTPS market is full of information asymmetries and negative externalities, as a handful of CAs dominate the market and have become "too big to fail." Unfortunately, proposed E.U. legislation will reinforce systemic vulnerabilities, and the proposed technological solutions that mostly originate in the U.S. are far from being adopted at scale. The systemic vulnerabilities in this crucial technology are likely to persist for years to come.

},

note = {

	Also published in:\<i\> \<a href="http://dl.acm.org/citation.cfm?id=2673311\&CFID=582181517\&CFTOKEN=51677975" target="_blank"\>ACM Queue - Security\</a\>\</i\>, 2014-8, vol. 12.

},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

Close

Arnbak, A.

Loopholes for Circumventing the Constitution: Unrestrained Bulk Surveillance on Americans by Collecting Network Traffic Abroad

In: pp. 1-24, 2014.

(Abstract | Links | BibTeX)

@article{,

title = {Loopholes for Circumventing the Constitution: Unrestrained Bulk Surveillance on Americans by Collecting Network Traffic Abroad},

author = {A.M.  Arnbak},

url = {http://www.ivir.nl/publicaties/download/1375.pdf},

year  = {2014},

date = {2014-07-08},

pages = {1-24},

abstract = {

	We reveal interdependent legal and technical loopholes that the U.S. intelligence community could use to circumvent constitutional and statutory safeguards for Americans. These loopholes involve the collection of Internet traffic on foreign territory, and leave Americans as unprotected as foreigners by current U.S. surveillance laws. We also describe how modern Internet protocols can be manipulated to deliberately divert American\'s traffic abroad, where traffic can then be collected under a more permissive legal regime (Executive Order 12333) that is overseen solely by the Executive branch of the U.S. government. While the media has reported on some of the techniques we describe, we cannot establish the extent to which these loopholes are exploited in practice.


	


	An actionable short-term remedy to these loopholes involves updating the antiquated legal definition of "electronic surveillance" in the Foreign Intelligence Surveillance Act (FISA), that has remained largely intact since 1978. On the long term, however, a fundamental reconsideration of established principles in U.S. surveillance law is required, since these loopholes cannot be closed by technology alone. Legal issues that require reconsideration include: the determination of applicable law by the geographical point of collection of network traffic; the lack of general constitutional or statutory protection for network traffic collection before users are "intentionally targeted"; and the fact that constitutional protection under the Fourth Amendment is limited to "U.S. persons" only. The combination of these three principles means that Americans remain highly vulnerable to bulk surveillance when the U.S. intelligence community collects their network traffic abroad.

},

note = {

	Forthcoming in Michigan Telecommunications \& Technology Law Review, May 2015.


	Presented at the Privacy Enhancing Technologies Symposium, July 2014, Amsterdam.



	See also:


	Legal loopholes could allow wider NSA surveillance, researchers say, CBS news, 30 June 2014.


	“Loopholes for Circumventing the Constitution”, the NSA Statement, and Our Response, Freedom to Tinker, 11 July 2014.

},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

Close

Arnbak, A.

Nederland als internetdokter tussen cybergrootmachten: Faciliteer een veilige en vrije IT-infrastructuur passend bij onze structurele culturele, economische en politieke belangen

2014.

(Links | BibTeX)

Arnbak, A.

9 Problems of Government Hacking: Why IT-Systems Deserve Constitutional Protection

In: 2014.

(Links | BibTeX)

Arnbak, A.

ECHR Fast-Tracks Court Case on PRISM and TEMPORA (and VERYANGRYBIRDS?)

2014.

(Links | BibTeX)

Arnbak, A.

The Politics of the EU Court Data Retention Opinion: End to Mass Surveillance?

2013.

(Links | BibTeX)

Arnbak, A.

Het maatschappelijke debat na PRISM - vijftig open vragen over privacy

2013.

(Links | BibTeX)

Arnbak, A., van Hoboken, J.

De wind van Snowden in de Amerikaanse informatieparaplu

In: Mediaforum, no. 7/8, pp. 173, 2013.

(Links | BibTeX)

Arnbak, A., Asghari, H., Eeten, M.J.G. van, van Eijk, N.

Security Economics in the HTTPS Value Chain

11.07.2013, ( Paper peer-reviewed and presented at WEIS 2013, 3 June 2013. ).

(Abstract | Links | BibTeX)

Arnbak, A.

PRISM: Obscured by Clouds or the Dark Side of the Moon?: How to Address Governmental Access to Cloud Data from Abroad

27.06.2013.

(Links | BibTeX)

Arnbak, A., van Hoboken, J.

Gespreksnotitie RTG 'praktijken, gevolgen en wettelijke kaders inzake het aftappen van persoonsgegevens'

25.06.2013.

(Links | BibTeX)

Arnbak, A., van Eijk, N., van Hoboken, J.

Obscured by Clouds or How to Address Governmental Access to Cloud Data From Abroad

11.06.2013.

(Links | BibTeX)

Arnbak, A., van Eijk, N., van Hoboken, J.

Cloud Computing in Higher Education and Research Institutions and the USA Patriot Act

2012.

(Abstract | Links | BibTeX)

@techreport{,

title = {Cloud Computing in Higher Education and Research Institutions and the USA Patriot Act},

author = {J.V.J. van Hoboken and A.M. Arnbak and N.A.N.M. van Eijk},

url = {http://www.ivir.nl/publicaties/download/Cloud_Computing_Patriot_Act_2012.pdf},

year = {2012},

date = {2012-11-29},

abstract = {

Institutions have started to move their data and ICT operations into the cloud. It is becoming clear that this is leading to a decrease of overview and control over government access to data for law enforcement and national security purposes. This report looks at the possibilities for the U.S. government to obtain access to information in the cloud from Dutch institutions on the basis of U.S. law and on the basis of Dutch law and international co-operation. It concludes that the U.S. legal state of affairs implies that the transition towards the cloud has important negative consequences for the possibility to manage information confidentiality, information security and the privacy of European end users in relation to foreign governments. The Patriot Act from 2001 has started to play a symbolic role in the public debate. It is one important element in a larger, complex and dynamic legal framework for access to data for law enforcement and national security purposes. In particular, the FISA Amendments Act provision for access to data of non-U.S. persons outside the U.S. enacted in 2008 deserves attention. The report describes this and other legal powers for the U.S. government to obtain data of non-U.S. persons located outside of the U.S. from cloud providers that fall under its jurisdiction. Such jurisdiction applies widely, namely to cloud services that conduct systematic business in the United States and is not dependent on the location where the data are stored, as is often assumed. For non-U.S. persons located outside of the U.S., constitutional protection is not applicable and the statutory safeguards are minimal. In the Netherlands and across the EU, government agencies have legal powers to obtain access to cloud data as well. These provisions can also be be used to assist the U.S. government, when it does not have jurisdiction for instance, but they must stay within the constitutional safeguards set by national constitutions, the European Convention on Human Rights and the EU Charter.

},

note = {

This is the English translation of a report that was released in September 2012 in The Netherlands. It was covered extensively in Dutch newspapers, on Radio1 and the 8 PM news bulletin of public broadcaster NOS. Politicians across the spectrum reacted on the report, both directly in the media and through Parliamentary questions. Meanwhile, the State Secretary of Security and Justice has responded to the Parliamentary questions on 15 October 2012.

The report is also available on SSRN.

See also:

- Patriot Act can "obtain" data in Europe, researchers say, CBS News, 4 December 2012;

- Im Bann des amerikanischen Schn\"{u}ffelwahns, S\"{u}d Deutsche, 10 January 2013.

},

keywords = {},

pubstate = {published},

tppubtype = {techreport}

}

Close

Institutions have started to move their data and ICT operations into the cloud. It is becoming clear that this is leading to a decrease of overview and control over government access to data for law enforcement and national security purposes. This report looks at the possibilities for the U.S. government to obtain access to information in the cloud from Dutch institutions on the basis of U.S. law and on the basis of Dutch law and international co-operation. It concludes that the U.S. legal state of affairs implies that the transition towards the cloud has important negative consequences for the possibility to manage information confidentiality, information security and the privacy of European end users in relation to foreign governments. The Patriot Act from 2001 has started to play a symbolic role in the public debate. It is one important element in a larger, complex and dynamic legal framework for access to data for law enforcement and national security purposes. In particular, the FISA Amendments Act provision for access to data of non-U.S. persons outside the U.S. enacted in 2008 deserves attention. The report describes this and other legal powers for the U.S. government to obtain data of non-U.S. persons located outside of the U.S. from cloud providers that fall under its jurisdiction. Such jurisdiction applies widely, namely to cloud services that conduct systematic business in the United States and is not dependent on the location where the data are stored, as is often assumed. For non-U.S. persons located outside of the U.S., constitutional protection is not applicable and the statutory safeguards are minimal. In the Netherlands and across the EU, government agencies have legal powers to obtain access to cloud data as well. These provisions can also be be used to assist the U.S. government, when it does not have jurisdiction for instance, but they must stay within the constitutional safeguards set by national constitutions, the European Convention on Human Rights and the EU Charter.

Close

Arnbak, A., van Eijk, N., van Hoboken, J.

Cloud diensten in hoger onderwijs en onderzoek en de USA Patriot Act

2012.

(Abstract | Links | BibTeX)

@techreport{,

title = {Cloud diensten in hoger onderwijs en onderzoek en de USA Patriot Act},

author = {J.V.J. van Hoboken and N.A.N.M. van Eijk and A.M. Arnbak},

url = {http://www.ivir.nl/publicaties/download/Clouddiensten_in_HO_en_USA_Patriot_Act.pdf},

year = {2012},

date = {2012-09-12},

abstract = {

Instellingen en gebruikers gaan massaal over op de cloud, en daardoor vermindert de controle en het overzicht over de toegang tot onze gegevens door overheden. Dit heeft belangrijke consequenties voor de privacy en andere fundamentele belangen bij de vertrouwelijkheid van informatie. Er is de laatste tijd veel geroepen over de Patriot Act, maar niemand heeft goed zicht op de Amerikaanse wetgeving die de VS de mogelijkheid van toegang geeft tot gegevens in de cloud. Dit rapport van het IViR in opdracht van SURFdirect geeft antwoord op deze belangrijke vragen. De Amerikaanse Grondwet en de specifieke wetten beschermen buitenlanders in mindere mate dan Amerikanen. Cloudgegevens van niet-Amerikanen in het buitenland kunnen daarom sneller en makkelijker worden opgevraagd dan van Amerikanen, en dat zonder juridische waarborgen als transparantie over het aantal opvragingen en rechtsbescherming van het individu. Daarnaast wordt het maatschappelijke debat gedomineerd door hardnekkige misvattingen en een te grote focus op de Patriot Act. Er is sprake van een veel groter geheel aan wetgeving. Voor opvraging door Amerikaanse autoriteiten maakt het niet uit op welke plek in de wereld cloudgegevens zijn opgeslagen. Het hoeft ook geen Amerikaanse cloudprovider te zijn. Als een Nederlandse cloudaanbieder structureel zaken doet in de VS, dan geeft VS wet- en regelgeving in beginsel al de mogelijkheid voor VS autoriteiten om gegevens op te vragen vanuit Nederland. Voor afnemers van clouddiensten zullen zulke relaties in de praktijk moeilijk te achterhalen zijn en door overnames in de sector kan de situatie opeens veranderen.

},

note = {

Rapport in opdracht van SURF, september 2012.

Zie ook:

- Persbericht van SURF;

- Toezicht op gegevens in een cloud is hard nodig, NOS Journaal, zaterdag 13 oktober 2012;

- Cyberaanvallen nieuwe vorm van politieke acties, Joris van Hoboken op Radio 1, zaterdag 13 oktober 2012;

- Reactie van Jeanine Hennis-Plasschaert, Radio 1, zaterdag 13 oktober 2012;

- Kamervragen SP;

- Antwoord Staatssecretaris Teeven op vragen SP;

- Onrust pati\ëntendossier neemt toe, website NOS, 30 november 2012;

- VS kan toegang tot EPD krijgen, video NOS journaal, 30 november 2012;

- \'De vraag is of VS medisch geheim Nederland zal respecteren\', NOS journaal, 30 november 2012.

},

keywords = {},

pubstate = {published},

tppubtype = {techreport}

}

Close

Arnbak, A., van Eijk, N.

Certificate Authority Collapse: Regulating Systemic Vulnerabilities in the HTTPS Value Chain

07.09.2012.

(Abstract | Links | BibTeX)

@misc{,

title = {Certificate Authority Collapse: Regulating Systemic Vulnerabilities in the HTTPS Value Chain},

author = {A.M.  Arnbak and N.A.N.M.  van Eijk},

url = {http://www.ivir.nl/publicaties/download/paper_TPRC_2012.pdf},

year  = {2012},

date = {2012-09-07},

abstract = {

	Recent breaches and malpractices at several Certificate Authorities (CA\’s) have led to a global collapse of trust in these central mediators of Hypertext Transfer Protocol Secure (HTTPS) communications. Given our dependence on secure web browsing, the security of HTTPS has become a top priority in telecommunications policy. In June 2012, the European Commission proposed a new Regulation on eSignatures. As the HTTPS ecosystem is by and large unregulated across the world, the proposal presents a paradigm shift in the governance of HTTPS. This paper examines if, and if so, how the European regulatory framework should legitimately address the systemic vulnerabilities of the HTTPS ecosystem. To this end, the HTTPS authentication model is conceptualised using actor-based value chain analysis and the systemic vulnerabilities of the HTTPs ecosystem are described through the lens of several landmark breaches. The paper explores the rationales for regulatory intervention, discusses the proposed EU eSignatures Regulation and ultimately develops a conceptual framework for HTTPS governance. It apprises the incentive structure of the entire HTTPS authentication value chain, untangles the concept of information security and connects its balancing of public and private interests to underlying values, in particular constitutional rights such as privacy, communications secrecy and freedom of expression. On the short term, specific regulatory measures to be considered throughout the value chain includes proportional liability provisions, meaningful security breach notifications and internal security requirements, but both legitimacy and effectiveness will depend on the exact wording of the regulatory provisions. The EU eSignatures proposal falls short on many of these aspects. In the long term, a robust technical and policy overhaul is needed to address the systemic weaknesses of HTTPS, as each CA is a single point of failure for the security of the entire ecosystem.

},

note = {

	Telecommunications Policy Research Conference, augustus 2012 Zie ook: 29C3: "Das SSL-System ist grundlegend defekt - und jemand muss es reparieren", Heise Online, 28 december 2012; Onderzoeker zet vraagtekens bij Europese https-regels, Tweakers.net, 29 december 2012.

},

keywords = {},

pubstate = {published},

tppubtype = {presentation}

}

Close

Arnbak, A.

Annotatie bij Rb. 's-Gravenhage 11 januari 2012 (Brein / Ziggo & XS4ALL)

2012.

(Links | BibTeX)