I’m a professor for the Norwich University MSIA program, and since Sunday I’ve been here in Vermont for their residency week, culminating in graduation on Friday. It has been a great week! It kicked off with a wonderfully thought-provoking discussion led by Karen Worstell, former CISO for Microsoft, as well as former CEO at AtomicTangerine, and many other high-profile positions.
We’ve also had great lectures and discussions led by Dr. Peter Stephenson, , Padgett Peterson, and Dr. Mich Kabay, just to name a few.
I love being on a college campus again. And I am happy I had the opportunity to also give a lecture (which I will post in the next couple of weeks on my personal website) along with an all afternoon workshop on Tuesday on the need to partner information security and privacy efforts, with a focus on training and awareness activities.
I did see that a couple of days ago there was a ruling made that the government must have a search warrant to obtain email records:
“The government must have a search warrant before it can secretly seize and search emails stored by email service providers, according to a landmark ruling Monday in the 6th U.S. Circuit Court of Appeals. The court found that email users have the same reasonable expectation of privacy in their stored email as they do in their telephone calls — the first circuit court ever to make that finding. Over the last 20 years, the government has routinely used the federal Stored Communications Act (SCA) to secretly obtain stored email from email service providers without a warrant. But today’s ruling — closely following the reasoning in an amicus brief filed the by the Electronic Frontier Foundation (EFF) and other civil liberties groups — found that the SCA violates the Fourth Amendment.”
I have not had a chance to look at the details of this case or the ruling, but I was surprised to see that in the few news reports that I read about this that there was no mention of the USA PATRIOT Act in any of them. The USA PATRIOT Act changed the surveillance and monitoring requirements and allowances within at least 35 specifically named laws. I have heard of instances of email messages being obtained without a warrant using it.
Tags: awareness and training, EFF, email privacy, information assurance, Information Security, IT compliance, Karen Worstell, Kevin Bankston, Mich Kabay, MSIA, Norwich University, Peter Stephenson, policies and procedures, privacy, risk management, Steven Warshak