The Ethics of Cybersecurity

Front matter

The International Library of Ethics, Law and Technology 21

Markus Christen Bert Gordijn Michele Loi Editors

The Ethics of Cybersecurity

Contents

Markus Christen, Bert Gordijn, and Michele Loi

PartI Foundations

Basic Concepts and Models of Cybersecurity ....

Part II Problems A Care-Based Stakeholder Approach to Ethics

Gwenyth Morgan and Bert Gordijn

Karsten Weber and Nadine Kleine

Eleonora Viganò, Michele Loi, and Emad Yaghmaei

David-Olivier Jaquet-Chiffelle and Michele Loi vi

Eva Schlehahn

Freedom of Political Communication, Propaganda and the Role of Epistemic Institutions in Cyberspace. . . Seumas Miller

Cybersecurity and Cyber Warfare: The Ethical Paradox George Lucas

Reto Inversini

Part II Recommendations

Josep Domingo-Ferrer and Alberto Blanco-Justicia

Best Practices and Recommendations

Alexey Kirichenko, Markus Christen, Florian Grunow,

and Dominik Herrmann

A Framework for Ethical Cyber-Defence for Companies Salome Stevens

Towards Guidelines for Medical Professionals David Koeppe

Norms of Responsible State Behaviour in Cyberspace . . Paul Meyer

Contents

About the Contributors

Alberto Blanco-Justicia is a Postdoctoral Researcher at Universitat Rovira i Virgili. He obtained his MSc in Computer Security in 2013 from Universitat Rovira i Virgili, and his PhD in Computer Engineering and Mathematics of Security from the same university in 2017, with a thesis focused on the reconciliation of privacy, security and functionality in e-commerce applications. His research interests include data privacy, data security and cryptographic protocols. He has been involved in several European and national Spanish research projects, as well as technology transfer contracts.

Markus Christen is a Research Group Leader at the Institute of Biomedical Ethics and History of Medicine and Managing Director of the UZH Digital Society Initiative. He received his MSc in Philosophy, Physics, Mathematics and Biology from the University of Berne, his PhD in Neuroinformatics from the Federal Institute of Technology in Zurich and his Habilitation in Bioethics from the University of Zurich. His research interests include empirical ethics, neuroethics, ICT ethics and data analysis methodologies.

Josep Domingo-Ferrer is the Distinguished Professor of Computer Science and an ICREA-Académia Researcher at Universitat Rovira i Virgili, Tarragona, Catalonia, where he holds the UNESCO Chair in Data Privacy and is the founding director of CYBERCAT-Center for Cybersecurity Research of Catalonia. He received his MSc and PhD degrees in Computer Science from the Autonomous University of Barcelona. He also holds an MSc in Mathematics. His research interests include data privacy, data security, statistical disclosure control and cryptographic protocols, with a focus on the conciliation of privacy, security and functionality. He is an IEEE Fellow, an ACM Distinguished Scientist and an elected member of Academia Europaea.

Gloria Gonzalez Fuster is a Research Professor in the Faculty of Law and Criminology at the Vrije Universiteit Brussel (VUB). She is Co-Director of the Law, Science, Technology and Society (LSTS) Research Group, and a member of viii About the Contributors the Brussels Privacy Hub (BPH); she investigates legal issues related to privacy, personal data protection and security, and teaches ‘Data Policies in the European Union’ at the Data Law option of the Master of Laws in International and European Law (PILC) of VUB’s Institute for European Studies (IES). She studied law at the Universidad Nacional de Educación a Distancia (UNED), journalism in the Faculty of Communication Sciences of the Universidad Autónoma de Barcelona (UAB) (including a stay at the Université Paris VIII) and modern languages and literature at the Université Libre de Bruxelles (ULB).

Bert Gordijn has been a Full Professor and Director of the Institute of Ethics at Dublin City University (Ireland) since 2008. He is a Visiting Professor at Lancaster University (UK), Georgetown University (USA), the National University of Singapore, the Fondation Brocher (Switzerland), Yenepoya University (India) and the University of Otago (New Zealand). He has served on advisory panels and expert committees of the European Chemical Industry Council, the European Patent Organisation, the Irish Department of Health and UNESCO. He is currently the Secretary of the European Society for Philosophy of Medicine and Healthcare and President of the International Association of Education in Ethics.

Florian Grunow is a Security Analyst and currently CEO of ERNW GmbH, Heidelberg, Germany. He holds a Master of Science degree in computer science with a focus on software engineering and a Bachelor of Science degree in medical computer sciences. He is committed to practical security education, both internally at ERNW and by giving public talks.

Dominik Herrmann is a Full Professor of Privacy and Security in Information Systems at University of Bamberg (Germany). Prior to this, he was a Temporary Professor at the University of Siegen between October 2015 and March 2017. He holds a PhD in Computer Science (University of Hamburg, 2014) and a Diploma with Honors in Management Information Systems (University of Regensburg, 2008). He has received a series of awards, including the GI-Dissertationspreis 2014 for the best computer science dissertation in Germany. He was also named a Junior Fellow of the German Computer Science Society for his services to the profession.

Reto Inversini studied Geography at the University of Berne and Information Technology at the University of Applied Sciences in Berne. He worked for Amnesty International as a network and systems engineer and for the Swiss Federal Administration as a security architect. He currently works as a malware analyst and security officer for the Swiss Governmental CERT (GovCERT.ch). He is a part-time lecturer at the University of Applied Sciences in Bern in the domains of network engineering and information security. His focus lies on network intrusion detection and malware analysis. It is important to him that core values of our society such as individual responsibility, democracy, freedom of speech and privacy are preserved while increasing the security of the Internet.

About the Contributors ix

David-Olivier Jaquet-Chiffelle is a Full Professor at the School of Criminal Justice, University of Lausanne, Switzerland. He is the head of the Master programme in forensic science, orientation digital investigation and identification. He accomplished his PhD in Mathematics at the University of Neuchatel, Switzerland. He spent a post-doc at Harvard University (Boston, USA). He then strengthened his experience in cryptology while working for the Swiss government at the Swiss Federal Section of Cryptology. He has a long experience in projects related to identity, security and privacy. His current research includes cybercrime, security and privacy, and new forms of identities in the information society, as well as authentication, anonymisation and identification processes, especially in the digital world.

Lina Jasmontaite is a PhD candidate at the Vrije Universiteit Brussel. She joined the Law, Science, Technology and Society (LSTS) Research Group in September 2016. Currently, she works on the awareness raising project under the Rights, Equality and Citizenship Programme 2014-2020 titled ‘Support Small and Medium Enterprises on the Data Protection Reform I’ (STARII). Under the supervision of Professor Gloria González Fuster, she contributed to the Horizon 2020 project titled “Constructing an Alliance for Value-driven Cybersecurity’ (CANVAS). She is also a Contributing Fellow at the Brussels Privacy Hub, where she explores the legal implications of new technologies that are being operationalised in humanitarian practice. Her PhD research concerns primarily the interaction between data breach notification obligations foreseen in the General Data Protection Regulation and the Network and Information Security Directive.

Alexey Kirichenko received his MSc in Mathematics from Leningrad (St. Petersburg) State University, Russia, and completed his PhD in Theoretical Computer Science at Aalto University, Finland. He joined F-Secure in 1997 and was for a long time leading the development of the company’s cryptographic modules and authorisation infrastructure. Since 2007, he has been working as Research Collaboration Manager, coordinating F-Secure’s participation in European and Finnish national research collaboration projects. He represents F-Secure in WG6 of European Cyber Security Organisation (ECSO) and significantly contributed in the ECSO SRIA preparation. Prior to joining F-Secure, he worked in the Computer Graphics area at Altsys Corp., and prior to this he lectured in mathematical courses at St. Petersburg Electro-Technical University. He is actively involved in training the Finnish national team for the International Mathematical Olympiad.

Nadine Kleine studied sociology and political science at the University of Potsdam, Germany, as well as cultural sciences with a focus on technology at the BTU Cottbus-Senftenberg, Germany. She was a Research Associate at the Institute for Social Research and Technology Assessment (IST), Regensburg University of Applied Studies, where she worked on the H2020 project “Constructing an Alliance for Value-driven Cybersecurity” (CANVAS) concerning issues of cyber security and ethics in healthcare. Currently, she researches worker’s autonomy and x About the Contributors acceptance of digital technologies in the work environment as a member of the doctoral research group “Trust and Acceptance in Augmented and Virtual Working Environments” (va-eva) and is involved in the project “Teamwork 4.0” at the Department of Economic and Industrial Sociology, both at the University of Osnabrueck.

David Koeppe studied economics at the Free University of Berlin (Diplom- Kaufmann) and has worked in various positions in hospitals since 1995. As Privacy Officer of the Vivantes Group (Netzwerk fiir Gesundheit GmbH), he is intensively involved with all facets of data protection in the health care sector. Within the framework of the society “Gesellschaft für Datenschutz und Datensicherheit e.V? (Society for Data Protection and Data Security), he is leading the working group ‘Data Protection and Data Security in Health and Social Services’ and the regional experience exchange group in Berlin. He is the co-editor of the Handbuch Datenschutz und Datensicherheit im Gesundheits und Sozialwesen (Datakontext, 2016) and co-author of a number of published data protection tools.

Michele Loi (PhD, Luiss Guido Carli) is an applied philosopher working at the intersection between digital ethics and bioethics. Besides researching the ethics of cybersecurity, he is also interested in fairness and transparency in machine learning and in the regulation access and use to big data in health. Currently, he is affiliated as Postdoctoral Researcher with the Digital Ethics Lab, Digital Society Initiative and with the Institute of Biomedical Ethics and the History of Medicine (both University of Zurich). His research on the ethics of cybersecurity has been funded by the CANVAS project, the same H2020 project funding the project of this book.

George Lucas is retired as Distinguished Chair of Ethics at the US Naval Academy (Annapolis, Maryland). He is a Senior Fellow at the Stockdale Center for Leadership and Ethics at US Naval Academy. His most recent book is Ethics and Military Strategy in the 21st-Century: Moving Beyond Clausewitz (Routledge, 2019).

Paul Meyer is Fellow in International Security and Adjunct Professor of International Studies at Simon Fraser University and a Senior Fellow with The Simons Foundation in Vancouver, Canada. He is also a Senior Advisor with ICT4Peace, an NGO devoted to preserving a peaceful cyberspace. Previously, he had a 35-year career with the Canadian Foreign Service, including serving as Canada’s Ambassador to the United Nations and to the Conference on Disarmament in Geneva (2003-2007). He writes on issues of nuclear non-proliferation and disarmament, space security and the diplomacy of international cyber security.

Seumas Miller holds research positions at Charles Sturt University, Technical University Delft and the University of Oxford. He is the author or co-author of 20 books, including Social Action (CUP, 2001), Moral Foundations of Social Institutions (CUP, 2010), Terrorism and Counter-terrorism (Blackwell, 2009), Shooting to Kill: The Ethics of Police and Military Use of Lethal Force (OUP, 2016)

About the Contributors xi and Institutional Corruption (CUP, 2017), and of over 200 academic articles. He is currently working on a co-authored book on the ethics of cybersecurity with a computer scientist, Terry Bossomaier.

Gwenyth Morgan is a PhD candidate at the ADAPT Centre for Digital Content Technologies and at the Institute of Ethics in All Hallows Drumcondra. She is conducting her research on the topic of ethically appropriate business responses to ransomware attacks and data breaches. Her work encompasses ethics and cybersecurity, ranging from ethical issues in cybersecurity relating to dataveillance, hacking back and the use of AI, to the dynamic and ambiguous relationship between businesses and security researchers, i.e., white hats, grey hats and black hats. She aims to open up the field of ethics and cybersecurity research in such a way that business ethics theories such as stakeholder theory can be used to practically establish how businesses can ethically manage and respond to issues that arise in cybersecurity. She teaches bachelor’s and master’s students at the Dublin City University on the topics of applied ethics, ethics of technology and health care ethics.

Henning Pridöhl is a Research and Teaching Assistant in the Privacy and Security in Information Systems Group at University of Bamberg. Prior to this, he was a Research Assistant in the Security in Distributed Systems Group at University of Hamburg. He holds an MSc in Computer Science from the University of Hamburg, where he graduated in 2016. He enjoys playing Capture The Flag security competitions and mentors young hackers in programming and IT security.

Eva Schlehahn is a Senior Legal Researcher and Consultant employed at Unabhängiges Landeszentrum für Datenschutz (ULD) in the German federal state of Schleswig-Holstein. Her work focuses on the requirements of the European General Data Protection Regulation (GDPR) and Privacy Enhancing Technologies (PETs). Since 2010, she has been working in various EC-funded FP7 and H2020 R&D projects focused on a multitude of data protection relevant topics. In her work, she has obtained a variety of know-how and experience related to topics such as cloud computing, identity and consent management, accessibility, UI design and usability, IT security, data privacy vocabularies and ontologies, data policy enforcement, surveillance technologies, requirements analysis and conceptualisation. Her research interests include interdisciplinary requirements analysis, balancing and evaluation, specifically considering Privacy by Design solutions.

Salome Stevens is a Teaching and Research Fellow at the Department of Criminal Law of the University of Zurich. She is pursuing her PhD on the subject of cybersecurity. Before joining the university, she worked as a Legal and Political Advisor for the Federal Department of Foreign Affairs and the Police Force, as well as for the private sector and the United Nations. She also supported several NGOs in their mandate to prevent international crime and fight impunity. Throughout her professional development, she has lived in Switzerland, Italy, Israel and the United Arab Emirates.

xii About the Contributors

Ibo van de Poel is Anthoni van Leeuwenhoek Professor in Ethics and Technology and head of the Department of Values, Technology and Innovation at the Faculty of Technology, Policy and Management at the Technical University Delft in the Netherlands. He has published on engineering ethics, the moral acceptability of technological risks, design for values, responsible innovation, moral responsibility in research networks, ethics of newly emerging technologies and the idea of new technology as a social experiment. He has recently received an ERC Advanced grant for “Design for changing values: a theory of value change in sociotechnical systems’.

Eleonora Viganò is a Postdoctoral Researcher at the Institute of Biomedical Ethics and History of Medicine and at the Digital Society Initiative of the University of Zurich. Her research is funded by the Cogito Foundation and the CANVAS project. She is a Moral Philosopher with a strong interest in the neuroscience of ethics. Her research interests include intrapersonal conflicts of values, the morality of prudence, and the implications for ethics of the neuroscientific discoveries on decision making. She has recently started working on ethical trade-offs in cybersecurity and on trust and transparency in machine learning algorithms.

Karsten Weber studied philosophy, informatics and sociology at University Karlsruhe (TH), Germany, and from 1996 to 1999 worked there as a Junior Researcher. After his doctorate in 1999, from 1999 to 2008 he was a Senior Researcher at European University Viadrina in Frankfurt (Oder), Germany. From 2006 to 2012, he worked as a Professor of Philosophy at University Opole, Poland. Since 2007, he has held an honorary professorship for Culture and Technology at BTU Cottbus-Senftenberg, Germany. At TU Berlin from 2008 to 2009, he was a Professor for Information Ethics and Data Protection and from 2009 to 2011 Professor for Computer Science and Society. From 2011 to 2016, he was Chair for General Science of Technology at BTU Cottbus-Senftenberg. Since 2013, Prof. Weber has taught technology assessment at OTH Regensburg, Germany and is cohead of the Institute for Social Research and Technology Assessment (IST) and one of the three directors of the Regensburg Center of Health Sciences and Technology (RCHST).

Emad Yaghmaei is a Senior Researcher at the Faculty of Technology, Policy and Management at the Technical University Delft. His research interests include the innovation management issues arising from the intersections of science, technology and society. The emphasis of his research and consulting is on innovation and technology management of emerging technologies such as ICT, the Internet of Things, nanotechnology and so on to identify and work on the social impacts of these technologies. He has been working on monitoring industry business innovation across non-financial values. He is currently focusing on Responsible Research and Innovation (RRI) principles in an industrial context to demonstrate how industry can work productively together with societal actors and integrate methodologies of RRI into research and innovation processes.

Acronyms and Abbreviations

ACM Al APT ASLR AV C&C CA CANVAS CCC CENELEC CERT CFI CFSP CJEU CNIL CoE DDoS DEP DNS DPI DPIA EC ECHR ECSO ECHR EDPS EFF eHC ENISA EU FRS

Association for Computing Machinery

Artificial Intelligence

Advanced Persistent Threat

Address Space Layout Randomization

Anti Virus

Command and Control

Certification Authority

Constructing an Alliance for Value-driven Cybersecurity Convention on Cyber Crime

European Committee for Electrotechnical Standardization Computer Emergency Response Team

Control-Flow Integrity

Common Foreign and Security Policy

Court of Justice of the European Union

Commission Nationale de l’ Informatique et des Libertés Council of Europe

Distributed Denial of Service

Data Execution Prevention

Domain Name System

Deep Packet Inspection

Data Protection Impact Assessment

European Commission

European Convention of Human Rights

European Cyber Security Organisation

European Court of Human Rights

European Data Protection Supervisor

Electronic Frontier Foundation

electronic Health Card

European Network and Information Security Agency European Union

Face Recognition System xiii

Acronyms and Abbreviations

Google, Apple, Facebook, Amazon and Microsoft General Data Protection Regulation

Group of Governmental Experts

Hypertext Transfer Protocol

International Committee of the Red Cross Information and Communication Technology Implantable Medical Device

Internet of Things

Information Systems Audit and Control Association International Organization for Standardization Internet Service Providers

International Telecommunication Union

Law Enforcement Agency

Message Authentication Code

Medical Device Regulation

Man in the Middle

North Atlantic Treaty Organization

Named Entity Recognition

Network Intrusion Detection Systems

Network and Information Security

National Security Agency (USA)

Official Journal of the European Communities Organization for Security and Cooperation in Europe Pretty Good Privacy

Privacy-Preserving Data Mining

Quantum Computing

Return-Oriented Programming

Statistical Disclosure Control

Standard Data Protection Model

Small and Medium Enterprises Surveillance-Oriented Security Technology Structured Query Language

Tailored Access Operations

Cybercrime Convention Committee

Treaty on European Union

Treaty on the Functioning of the European Union Transport Layer Security

List of Figures ie 2 -Safety versns RNY reduca eene Fig. 2.2 Relationship between vulnerability and risk... ee Fig. 2.3 Example of a C program with a buffer overflow vulnerability Fig. 2.4 Login source code fragment of a PHP program that is vulnerable to SOL injectionS..sisissssiisissisisissssieruressirsss Fig. 2.5 PHP code with a prepared statement to protect against SQL OTEO HACKS: A E EE

Fig. 3.1 Value tensions in cybersecurity. (Reproduced from

Cinsten etal 2017 hamnen ARN EA Fig. 7.1 Technical aims mapping to ethical principles... Pio. 9.1 “Word cloud around “hackers” wisi. seadsscnscscscenessnestacssanaseacaninns Fig 9.2 Smi i he hackers’ MMS MES ssiri Fig. 9.4 A third dimension to represent true hackers and hacktivists ... Fie 9.7 Etna Qi ocna an a Fig. 9.8 Potential conflicts between collections of possibly competing

ethical VIMES ciranean aea anaia Fig. 10.1 Simplified overview of cybersecurity issues... eee Fig. 10.2 Data protection goals (darker grey) integrating the IT

XV

List of Tables

Table 6.1 Table 8.1

Table 9.1 Table 9.2

A table in an SQL database that is used by an application vulnerable to SQL injections sssccsdaswsarcecendssanacvavdesheiavardiinmubaecaniads

Definitions of cybersecurity in national cybersecurity stiatecies of EU Member States opie. oscsissasiseciaseaicscanczenatseparnesiestioss

Ethical issues in cybersecurity in DUSINESS «00.0... eee eeeereereees

The main ethical issues and value conflicts in the literature On national cybersecurity STAG EIES ....5:iccetssccsisssasssaasesaassssasescizeniocs Types of attacks on critical infrastructure sssiroicinvieiuresiirencisursrs

Analogy between authentication technologies and criteria TOCIASSIEY hacke RTE Similarities between authentication technologies

and ethical evalüation Parameters sinsir

Application of a second layer of categorisation tey perdere E aA cra edammoutan meuaatiess

Example of a protection needs MatriX -seiiceeisierissooiioarereris xvii

Chapter 1 A) Introduction Geek for Markus Christen, Bert Gordijn, and Michele Loi

Abstract This introduction provides a short overview on the book “The Ethics of Cybersecurity”. The volume explains the foundations of cybersecurity, ethics and law, outlines various problems of the domain such as ethical hacking and cyberwar, and it lists recommendations and best practices for cybersecurity professionals working in various application areas. Furthermore, the introduction outlines the background of the European CANVAS project, from which this volume emerged.

Keywords Cybersecurity - Ethics - Law - Trust - Values

The increasing use of information and communication technology (ICT) in all spheres of modern life makes the world a richer, more efficient and interactive place. However, it also increases its fragility, as it reinforces our dependence on ICT systems that can never be completely safe or secure. Therefore, cybersecurity has become a matter of global interest and importance. Accordingly, we can observe in today’s cybersecurity discourse an almost constant emphasis on an ever-increasing and diverse set of threats, ranging from basic computer viruses to sophisticated kinds of cybercrime and cyberespionage activities, as well as cyber-terror and cyberwar. This growing complexity of the digital ecosystem in combination with increasing glo bal risks has created the following dilemma. Overemphasising cybersecurity may violate fundamental values such as equality, fairness, freedom or

M. Christen (È<) UZH Digital Society Initiative, Zürich, Switzerland e-mail: christen @ethik.uzh.ch

B. Gordijn

Dublin City University, Dublin, Ireland

e-mail: bert.gordijn @dcu.ie

M. Loi Digital Society Initiative, University of Zurich, Zurich, Switzerland

Institute of Biomedical Ethics and History of Medicine, Zurich, Switzerland e-mail: michele.loi@uzh.ch

© The Author(s) 2020 1 M. Christen et al. (eds.), The Ethics of Cybersecurity, The International Library

2 M. Christen et al.

privacy. However, neglecting cybersecurity could undermine citizens’ trust and confidence in the digital infrastructure, in policy makers and in state authorities. Thus, cybersecurity supports the protection of values such as nonmaleficence, privacy and trust, and therefore imposes a complex relationship among values: some may be supportive and others conflicting, depending on context. For example, whereas cybersecurity is in most cases a precondition to protect data and thus the privacy of people, it may also make private information more accessible to cybersecurity experts, in order to detect malicious activities.

Understanding this and other value dilemmas has become imperative, yet cybersecurity is still an under-developed topic in technology ethics. Although there are numerous papers discussing issues such as ‘big data’ and privacy, cybersecurity is—if at all—only discussed as a tool to protect (or undermine) privacy. Nevertheless, cybersecurity raises a plethora of ethical issues such as ‘ethical hacking’, dilemmas of holding back ‘zero day’ exploits, weighting data access and data privacy in sensitive health data, or value conflicts in law enforcement raised by encryption algorithms. For example, a governmental computer emergency response team (CERT) may fight a ransomware attack by turning off the payment servers and destroying the business model of the attackers to prevent future attacks—but this means that people whose data already has been encrypted would never retrieve it. A medical implants producer may want to protect the data transfer between implant and receiver server by means of suitable cryptology—but this significantly increases the energy consumption of the implant and frequently requires more surgeries for battery exchange. Finally, a white hat hacker may discover a dangerous vulnerability in an IoT device and inform the manufacturer—but the company does not attempt to correct the error and the hacker considers how to generate public attention for the case. Such issues are usually discussed in an isolated manner, whereas a coherent and integrative view on the ethics of cybersecurity is missing. Only a few authors such as Kenneth Einar Himma (2005, 2008) have worked systematically on the ethical issues of cybersecurity for a longer time, and recent authors on this topic have focused on more specific issues such as cyberwar (Lucas 2017; Taddeo and Glorioso 2017). A rare example of broader coverage of the topic is Manjikian (2017).

This book aims to provide the first systematic collection of the full plethora of ethical aspects of cybersecurity. It results from the research activities of the CANVAS Consortium—Constructing an Alliance for Value-driven Cybersecurity— that unified technology developers with legal and ethical scholar and social scientists to approach the challenge of how cybersecurity can be aligned with European values and fundamental rights. The project was funded by the European Commission and aimed to bring together stakeholders from key areas of the European Digital Agenda—business/finance, the health system and law enforcement/national security—in order to discuss challenges and solutions when aligning cybersecurity with ethics. A special focus of CANVAS was on raising the awareness of the ethics of cybersecurity through teaching in academia and industry.

In a series of four White Papers, the CANVAS consortium provides an extensive overview of the discourse of ethical, legal and social aspects of cybersecurity. The first White Paper “Cybersecurity and Ethics’ outlines how the ethical discourse on cybersecurity has developed in the scientific literature, which ethical issues have gained interest, which value conflicts are being discussed, and where the ‘blind spots’ are in the current ethical discourse on cybersecurity (Yaghmaei et al. 2017). Here, an important observation is that the ethics of cybersecurity is not yet an established subject. In all domains, cybersecurity is recognised as being an instrumental value, not an end in itself, which opens up the possibility of trade-offs with different values in different spheres. The most prominent common theme is the existence of trade-offs and even conflicts between reasonable goals, for example between usability and security, accessibility and security, and privacy and convenience. Other prominent common themes are the importance of cybersecurity to sustain trust (in institutions) and the harmful effect of any loss of control over data.

The second White Paper ‘Cybersecurity and Law’ explores the legal dimensions of the European Union’s value-driven cybersecurity policy (Jasmontaite et al. 2017). It identifies the main critical challenges in this area and discusses specific controversies concerning cybersecurity regulation. The White Paper recognises that legislative and policy measures within the cybersecurity domain challenge EU fundamental rights and principles, stemming from EU values. Annexes provide a review of EU soft-law measures, EU legislative measures, cybersecurity and criminal justice affairs, the relationship of cybersecurity to privacy and data protection, cybersecurity definitions in national cybersecurity strategies, and brief descriptions of EU values.

The third White Paper “Attitudes and Opinions regarding Cybersecurity’ summarises the currently available empirical data regarding the attitudes and opinions of citizens and state actors regarding cybersecurity (Wenger et al. 2017). The data emerges from the reports of EU projects, Eurobarometer surveys, policy documents of state actors and additional scientific papers. It describes what these stakeholders generally think, what they feel and what they do about cyber threats and security (counter)measures.

Finally, the fourth White Paper “Technological Challenges in Cybersecurity’ summarises the current state of discussion regarding the main technological challenges in cybersecurity and their impact, including ways and approaches to address them, on key fundamental values (Domingo-Ferrer et al. 2017).

These White Papers serve as a baseline for this volume, which involves the contributions of CANVAS researchers as well as those of external experts. The first part of the volume outlines the general problems associated with the ethics of cybersecurity. This involves defining the basic technical concepts of cybersecurity, the values affected by cybersecurity, and the ethical and legislative framework, with a particular focus on Europe. The second part of the volume introduces a variety of ethical questions raised in the context of cybersecurity. The contributions are mostly structured along the major domains of interest that were investigated in the CANVAS project: business/finance, the health system, and law enforcement/national security. The last part of the volume is dedicated to recommendations in order to tackle some of the ethical challenges of cybersecurity. Overall, given the broad scope of the topics addressed in this book, it will not only be relevant for scholars focusing on philosophy and the ethics of technology. Many practitioners in cybersecurity—providers of security software, CERTs or Chief Security Officers in companies—are increasingly aware of the ethical dimensions of their work. We therefore hope that the practical focus of this book will also help those experts to not only gain awareness

4 M. Christen et al.

of the ethics of cybersecurity but also provide them with the concepts and tools to tackle them.!

As cybersecurity is a quickly evolving domain, this book will not provide a complete overview of all relevant topics. Emerging issues concern, for example, cybercurrencies or the role of artificial intelligence (AI) in cybersecurity. The latter will become important both as a tool to complement the toolset for defending against attacks (e.g., for supervising large networks) as well as for more efficient attacks. AI may also become a dangerous tool for very new kinds of attacks (e.g. for learning instabilities in electronic stock markets and providing buy/sell ‘signals’ that destabilise the stock market). Furthermore, ‘hacking’ AI systems—which in the future may play important roles such as in autonomous driving—through compromised data may also become an increasingly relevant issue for cybersecurity. In addition, as processes and interactions in many social spheres increasingly rely on ICT systems, traditional security issues interfere with cybersecurity issues in domains such as food-security or migration and security. In this book, we only cover a few of these emerging issues, such as the danger of “hacking democracy’ through ICT-mediated means such as deep fakes and botnets (see Chaps. 11 and 12) and partly AI threads related to critical infrastructure (Chap. 8). Others should become topics of a new book, perhaps with more emphasis on autonomous decision-making systems and machine learning.

1.1 Explaining the Foundations

In the first chapter, Dominik Herrmann and Henning Pridöhl provide a technical introduction to the topic of this book. In this chapter, they review the fundamental concepts of cybersecurity by explaining common threats to information and systems to illustrate how matters of security can be addressed with methods from risk management. They also describe typical attack strategies and principles for defence. They review cryptographic techniques, malware and two common weaknesses in software: buffer overflows and SQL injections. This is followed by selected topics from network security, namely reconnaissance, firewalls, Denial of Service attacks and Network Intrusion Detection Systems. Finally, they review techniques for continuous testing, stressing the need for a free distribution of dual-use tools.