Legal Issues Relating to the Notification of Australian Data Breaches

Advances in information and communications technologies during the last two decades have allowed organisations to capture and utilise data on a vast scale, thus heightening the importance of adequate measures for protecting unauthorised disclosure of personal information. In this respect, data breach notification has emerged as an issue of increasing importance throughout the world. It has been the subject of law reform in the United States and in other international jurisdictions. Following the Australian Law Reform Commission’s review of privacy, data breach notification will soon be addressed in Australia. This article provides a review of US and Australian legal initiatives regarding the notification of data breaches. The authors highlight areas of concern based on the extant US literature that require specific consideration in Australia regarding the development of an Australian legal framework for the notification of data breaches.

AITPM Email Newsletter Volume 0905, May 2009: Presidents Message

President’s Message Hello fellow AITPM members, We’ve been offered a lot of press lately about the Federal Government’s plan for the multibillion dollar rollout of its high speed broadband network, which at the moment is being rated to a speed of 100Mb/s. This seems fantastic in comparison to the not atypical 250 to 500kb/s that I receive on my metropolitan cable broadband, which incidentally my service provider rates at theoretical speeds of up to 8 Mb/s. I have no doubt that such a scheme will generate significant advantages to business and consumers. However, I also have some reservations. Only a few of years ago I marvelled at my first 256Mb USB stick, which cost my employer about $90. Last month I purchased a 16Gb stick with a free computer carry bag for $80, which on the back of my envelope has given me about 72 times the value of my first USB stick not including the carry bag! I am pretty sure the technology industry will find a way to eventually push a lot more than 100Mb/s down the optic fibre network just as they have done with pushing several Mb/s ADSL2 down antique copper wire. This makes me wonder about the general problem of inbuilt obsolescence of all things high-tech due to rapid advances in the tech industry. As a transport professional I then think to myself that our industry has been moving forward at somewhat of a slower pace. We certainly have had major milestones having significant impacts, such as the move from horse and cart to the self propelled motor vehicle, sealing and formal geometric design of roads, development of motorways, signalisation of intersections, coordination of networks, to simulation modelling for real time adaptive control (perhaps major change has been at a frequency of 30 years or so?). But now with ITS truly penetrating the transport market, largely thanks to the in-car GPS navigator, smart phone, e-toll and e-ticket, I believe that to avoid our own obsolescence we’re going to need to “plan for ITS” rather than just what we seem to have been doing up until now, that is, to get it out there. And we’ll likely need to do it at a faster pace. It will involve understanding how to data mine enormous data sets, better understanding the human/machine interface, keeping pace with automotive technology more closely, resolving the ethical and privacy chestnuts, and in the main actually planning for ITS to make peoples’ lives easier rather than harder. And in amongst this we’ll need to keep pace with the types of technology advances similar to my USB stick example above. All the while we’ll be making a brand new set of friends in the disciplines that will morph into ITS along with us. Hopefully these will all be “good” problems for our profession to have. I should close in reminding everyone again that AITPM’s flagship event, the 2009 AITPM National Conference, Traffic Beyond Tomorrow, is being held in Adelaide from 5 to 7 August. www.aitpm.com has all of the details about how to register, sponsor a booth, session, etc. Best regards all, Jon Bunker

Risk-assessment practices in the private rental sector : implications for low-income renters (Final Report)

This report focuses on risk-assessment practices in the private rental market, with particular consideration of their impact on low-income renters. It is based on the fieldwork undertaken in the second stage of the research process that followed completion of the Positioning Paper. The key research question this study addressed was: What are the various factors included in ‘risk-assessments’ by real estate agents in allocating ‘affordable’ tenancies? How are these risks quantified and managed? What are the key outcomes of their decision-making? The study builds on previous research demonstrating that a relatively large proportion of low-cost private rental accommodation is occupied by moderate- to high-income households (Wulff and Yates 2001; Seelig 2001; Yates et al. 2004). This is occurring in an environment where the private rental sector is now the de facto main provider of rental housing for lower-income households across Australia (Seelig et al. 2005) and where a number of factors are implicated in patterns of ‘income–rent mismatching’. These include ongoing shifts in public housing assistance; issues concerning eligibility for rent assistance; ‘supply’ factors, such as loss of low-cost rental stock through upgrading and/or transfer to owner-occupied housing; patterns of supply and demand driven largely by middle- to high-income owner-investors and renters; and patterns of housing need among low-income households for whom affordable housing is not appropriate. In formulating a way of approaching the analysis of ‘risk-assessment’ in rental housing management, this study has applied three sociological perspectives on risk: Beck’s (1992) formulation of risk society as entailing processes of ‘individualisation’; a socio-cultural perspective which emphasises the situated nature of perceptions of risk; and a perspective which has drawn attention to different modes of institutional governance of subjects, as ‘carriers of specific indicators of risk’. The private rental market was viewed as a social institution, and the research strategy was informed by ‘institutional ethnography’ as a method of enquiry. The study was based on interviews with property managers, real estate industry representatives, tenant advocates and community housing providers. The primary focus of inquiry was on ‘the moment of allocation’. Six local areas across metropolitan and regional Queensland, New South Wales, and South Australia were selected as case study localities. In terms of the main findings, it is evident that access to private rental housing is not just a matter of ‘supply and demand’. It is also about assessment of risk among applicants. Risk – perceived or actual – is thus a critical factor in deciding who gets housed, and how. Risk and its assessment matter in the context of housing provision and in the development of policy responses. The outcomes from this study also highlight a number of salient points: 1.There are two principal forms of risk associated with property management: financial risk and risk of litigation. 2. Certain tenant characteristics and/or circumstances – ability to pay and ability to care for the rented property – are the main factors focused on in assessing risk among applicants for rental housing. Signals of either ‘(in)ability to pay’ and/or ‘(in)ability to care for the property’ are almost always interpreted as markers of high levels of risk. 3. The processing of tenancy applications entails a complex and variable mix of formal and informal strategies of risk-assessment and allocation where sorting (out), ranking, discriminating and handing over characterise the process. 4. In the eyes of property managers, ‘suitable’ tenants can be conceptualised as those who are resourceful, reputable, competent, strategic and presentable. 5. Property managers clearly articulated concern about risks entailed in a number of characteristics or situations. Being on a low income was the principal and overarching factor which agents considered. Others included: - unemployment - ‘big’ families; sole parent families - domestic violence - marital breakdown - shift from home ownership to private rental - Aboriginality and specific ethnicities - physical incapacity - aspects of ‘presentation’. The financial vulnerability of applicants in these groups can be invoked, alongside expressed concerns about compromised capacities to manage income and/or ‘care for’ the property, as legitimate grounds for rejection or a lower ranking. 6. At the level of face-to-face interaction between the property manager and applicants, more intuitive assessments of risk based upon past experience or ‘gut feelings’ come into play. These judgements are interwoven with more systematic procedures of tenant selection. The findings suggest that considerable ‘risk’ is associated with low-income status, either directly or insofar as it is associated with other forms of perceived risk, and that such risks are likely to impede access to the professionally managed private rental market. Detailed analysis suggests that opportunities for access to housing by low-income householders also arise where, for example: - the ‘local experience’ of an agency and/or property manager works in favour of particular applicants - applicants can demonstrate available social support and financial guarantors - an applicant’s preference or need for longer-term rental is seen to provide a level of financial security for the landlord - applicants are prepared to agree to specific, more stringent conditions for inspection of properties and review of contracts - the particular circumstances and motivations of landlords lead them to consider a wider range of applicants - In particular circumstances, property managers are prepared to give special consideration to applicants who appear worthy, albeit ‘risky’. The strategic actions of demonstrating and documenting on the part of vulnerable (low-income) tenant applicants can improve their chances of being perceived as resourceful, capable and ‘savvy’. Such actions are significant because they help to persuade property managers not only that the applicant may have sufficient resources (personal and material) but that they accept that the onus is on themselves to show they are reputable, and that they have valued ‘competencies’ and understand ‘how the system works’. The parameters of the market do shape the processes of risk-assessment and, ultimately, the strategic relation of power between property manager and the tenant applicant. Low vacancy rates and limited supply of lower-cost rental stock, in all areas, mean that there are many more tenant applicants than available properties, creating a highly competitive environment for applicants. The fundamental problem of supply is an aspect of the market that severely limits the chances of access to appropriate and affordable housing for low-income rental housing applicants. There is recognition of the impact of this problem of supply. The study indicates three main directions for future focus in policy and program development: providing appropriate supports to tenants to access and sustain private rental housing, addressing issues of discrimination and privacy arising in the processes of selecting suitable tenants, and addressing problems of supply.

Crossing boundaries: Implications of advances in basic sciences for the management of addiction.

This set of papers in this issue of "Addictive Behaviors" was presented at the 2004 'Addictions' conference, which, for the first time, was held in the Southern Hemisphere, on the Sunshine Coast of Queensland, Australia. The theme of the conference, Crossing Boundaries: Implications of Advances in Basic Sciences for the Management of Addiction, speaks for itself. The papers derive from a wide range of empirical paradigms and cover issues with relevance to the development of addiction, to the maintenance of problematic use, and to assessment, treatment, and relapse. Research from Europe and the United States is represented, as well as work from Australia. An international perspective is strongly emphasized from the initial paper by Obot, Poznyak, and Moneiro, (see record 2004-19599-015) which describes the WHO Report on the Neuroscience of Psychoactive Substance Use and Dependence, and summarises some of the report's implications for policy and practice. Hall, Carter, and Morley (see record 2004-19599-014) close the issue with a paper on the wide-ranging ethical implications of advances in neuroscience research, including issues arising from the identification of high risk for addiction, the potential for coercive pharmacotherapy, use of medications to enhance function, and risks to privacy.

Efficient one-round key exchange in the standard model

We consider one-round key exchange protocols secure in the standard model. The security analysis uses the powerful security model of Canetti and Krawczyk and a natural extension of it to the ID-based setting. It is shown how KEMs can be used in a generic way to obtain two different protocol designs with progressively stronger security guarantees. A detailed analysis of the performance of the protocols is included; surprisingly, when instantiated with specific KEM constructions, the resulting protocols are competitive with the best previous schemes that have proofs only in the random oracle model.

The nature and extent of policing alcohol related crime and reducing violence in and around late night entertainment areas

The misuse of alcohol is well documented in Australia and has been associated with disorders and harms that often require police attention. The extent of alcohol-related incidents requiring police attention has been recorded as substantial in some Australian cities (Arro, Crook, & Fenton, 1992; Davey & French, 1995; Ireland & Thommeny, 1993). A significant proportion of harmful drinking occurs in and around licensed premises (Jochelson, 1997; Stockwell, Masters, Phillips, Daly, Gahegan, Midford, & Philp, 1998; Borges, Cherpitel, & Rosovsky, 1998) and most of these incidents are not reported to police (Bryant & Williams, 2000; Lister, Hobbs, Hall, & Winlow, 2000). Alcohol-related incidents have also been found to be concentrated in certain places at certain times (Jochelson, 1997) and therefore manipulating the context in which these incidents occur may provide a means to prevent and reduce the harm associated with alcohol misuse. One of the major objectives of the present program of research was to investigate the occurrence and resource impact of alcohol-related incidents on operational (general duties) policing across a large geographical area. A second objective of the thesis was to examine the characteristics and temporal/spatial dynamics of police attended alcohol incidents in the context of Place Based theories of crime. It was envisaged that this approach would reveal the patterns of the most prevalent offences and demonstrate the relevance of Place Based theories of crime to understanding these patterns. In addition, the role of alcohol, time and place were also explored in order to examine the association between non criminal traffic offences and other types of criminal offences. A final objective of the thesis was to examine the impact of a situational crime prevention strategy that had been initiated to reduce the violence and disorder associated with late-night liquor trading premises. The program of research in this doctorate thesis has been undertaken through the presentation of published papers. The research was conducted in three stages which produced six manuscripts, five of which were submitted to peer reviewed journals and one that was published in a peer reviewed conference proceedings. Stage One included two studies (Studies 1 & 2) both of which involved a cross sectional approach to examine the prevalence and characteristics of alcohol-related incidents requiring police attendance across three large geographical areas that included metropolitan cities, provincial regions and rural areas. Stage Two of the program of research also comprised two cross sectional quantitative studies (Studies 3 & 4) that investigated the temporal and spatial dynamics of the major offence categories attended by operational police in a specific Police District (Gold Coast). Stage Three of the program of research involved two studies (Studies 5 & 6) that assessed the effectiveness of a situational crime prevention strategy. The studies employed a pre-post design to assess the impact on crime, disorder and violence by preventing patrons from entering late-night liquor trading premises between 3 a.m. and 5 a.m. (lockout policy). Although Study Five was solely quantitative in nature, Study Six included both quantitative and qualitative aspects. The approach adopted in Study Six, therefore facilitated not only a quantative comparison of the impact of the lockout policy on different policing areas, but also enabled the processes related to the implementation of the lockout policy to be examined. The thesis reports a program of research involving a common data collection method which then involved a series of studies being conducted to explore different aspects of the data. The data was collected from three sources. Firstly a pilot phase was undertaken to provide participants with training. Secondly a main study period was undertaken immediately following the pilot phase. The first and second sources of data were collected between 29th March 2004 and 2nd May 2004. Thirdly, additional data was collected between the 1st April 2005 and 31st May 2005. Participants in the current program of research were first response operational police officers who completed a modified activity log over a 9 week period (4 week pilot phase & 5 week survey study phase), identifying the type, prevalence and characteristics of alcohol-related incidents that were attended. During the study period police officers attended 31,090 alcohol-related incidents. Studies One and Two revealed that a substantial proportion of current police work involves attendance at alcohol-related incidents (i.e., 25% largely involving young males aged between 17 and 24 years). The most common incidents police attended were vehicle and/or traffic matters, disturbances and offences against property. The major category of offences most likely to involve alcohol included vehicle/traffic matters, disturbances and offences against the person (e.g., common & serious assaults). These events were most likely to occur in the late evenings and early hours of the morning on the weekends, and importantly, usually took longer for police to complete than non alcohol-related incidents. The findings in Studies Three and Four suggest that serious traffic offences, disturbances and offences against the person share similar characteristics and occur in concentrated places at similar times. In addition, it was found that time, place and incident type all have an influence on whether an incident attended by a police officer is alcohol-related. Alcohol-related incidents are more likely to occur in particular locations in the late evenings and early mornings on the weekends. In particular, there was a strong association between the occurrence of alcohol-related disturbances and alcohol-related serious traffic offences in regards to place and time. In general, stealing and property offences were not alcohol-related and occurred in daylight hours during weekdays. The results of Studies Five and Six were mixed. A number of alcohol-related offences requiring police attention were significantly reduced for some policing areas and for some types of offences following the implementation of the lockout policy. However, in some locations the lockout policy appeared to have a negative or minimal impact. Interviews with licensees revealed that although all were initially opposed to the lockout policy as they believed it would have a negative impact on business, most perceived some benefits from its introduction. Some of the benefits included, improved patron safety and the development of better business strategies to increase patron numbers. In conclusion, the overall findings of the six studies highlight the pervasive nature of alcohol across a range of criminal incidents, demonstrating the tremendous impact alcohol-related incidents have on police. The findings also demonstrate the importance of time and place in predicting the occurrence of alcohol-related offences. Although this program of research did not set out to test Place Based theories of crime, these theories were used to inform the interpretation of findings. The findings in the current research program provide evidence for the relevance of Place Based theories of crime to understanding the factors contributing to violence and disorder, and designing relevant crime prevention strategies. For instance, the results in Studies Five and Six provide supportive evidence that this novel lockout initiative can be beneficial for public safety by reducing some types of offences in particular areas in and around late-night liquor trading premises. Finally, intelligent-led policing initiatives based on problem oriented policing, such as the lockout policy examined in this thesis, have potential as a major crime prevention technique to reduce specific types of alcohol-related offences.

A multiple-control fuzzy vault

We introduce multiple-control fuzzy vaults allowing generalised threshold, compartmented and multilevel access structure. The presented schemes enable many useful applications employing multiple users and/or multiple locking sets. Introducing the original single control fuzzy vault of Juels and Sudan we identify several similarities and differences between their vault and secret sharing schemes which influence how best to obtain working generalisations. We design multiple-control fuzzy vaults suggesting applications using biometric credentials as locking and unlocking values. Furthermore we assess the security of our obtained generalisations for insider/ outsider attacks and examine the access-complexity for legitimate vault owners.

User-Created Content and Online Social Networks

Traditional media are under assault from digital technologies. Online advertising is eroding the financial basis of newspapers and television, demarcations between different forms of media are fading, and audiences are fragmenting. We can podcast our favourite radio show, data accompanies television programs, and we catch up with newspaper stories on our laptops. Yet mainstream media remain enormously powerful. The Media and Communications in Australia offers a systematic introduction to this dynamic field. Fully updated and revised to take account of recent developments, this third edition outlines the key media industries and explains how communications technologies are impacting on them. It provides a thorough overview of the main approaches taken in studying the media, and includes new chapters on social media, gaming, telecommunications, sport and cultural diversity. With contributions from some of Australia's best researchers and teachers in the field, The Media and Communications in Australia is the most comprehensive and reliable introduction to media and communications available. It is an ideal student text, and a reference for teachers of media and anyone interested in this influential industry.

Regulatory approaches to genetic testing in insurance

Rapid advancements in the field of genetic science have engendered considerable debate, speculation, misinformation and legislative action worldwide. While programs such as the Human Genome Project bring the prospect of seemingly miraculous medical advancements within imminent reach, they also create the potential for significant invasions of traditional areas of privacy and human dignity through laying the potential foundation for new forms of discrimination in insurance, employment and immigration regulation. The insurance industry, which has of course, traditionally been premised on discrimination as part of its underwriting process, is proving to be the frontline of this regulatory battle with extensive legislation, guidelines and debate marking its progress.

The application of the Park & Ride and TOD concepts to develop a new framework that can maximise public transport patronage

With growing concern over the use of the car in our urbanized society, there have emerged a number of lobby groups and professional bodies promoting a return to public transport, walking and cycling, with the urban village as the key driving land use, as a means of making our cities’ transportation systems more sustainable. This research has aimed at developing a framework applicable to the Australian setting that can facilitate increased passenger patronage of rail based urban transport systems from adjacent or associated land uses. The framework specifically tested the application of the Park & Ride and Transit Oriented Development (TOD) concepts and their applicability within the cultural, institutional, political and transit operational characteristics of Australian society. The researcher found that, although the application of the TOD concept had been limited to small pockets of town houses and mixed use developments around stations, the development industry and emerging groups within the community are posed to embrace the concept and bring with it increased rail patronage. The lack of a clear commitment to infrastructure and supporting land uses is a major barrier to the implementation of TODs. The research findings demonstrated significant scope for the size of a TOD to expand to a much greater radius of activity from the public transport interchange, than the commonly quoted 400 to 600 meters, thus incorporating many more residents and potential patrons. The provision of Park & Rides, and associated support facilities like Kiss & Rides, have followed worldwide trends of high patronage demands from the middle and outer car dependent suburbs of our cities. The data collection and analysis gathered by the researcher demonstrated that in many cases Park & Rides should form part of a TOD to ensure ease of access to rail stations by all modes and patron types. The question, however, remains how best to plan the incorporation of a Park & Ride within a TOD and still maintain those features that attract and promote TODs as a living entity.

One-time-password-authenticated key exchange

To reduce the damage of phishing and spyware attacks, banks, governments, and other security-sensitive industries are deploying one-time password systems, where users have many passwords and use each password only once. If a single password is compromised, it can be only be used to impersonate the user once, limiting the damage caused. However, existing practical approaches to one-time passwords have been susceptible to sophisticated phishing attacks. ---------- We give a formal security treatment of this important practical problem. We consider the use of one-time passwords in the context of password-authenticated key exchange (PAKE), which allows for mutual authentication, session key agreement, and resistance to phishing attacks. We describe a security model for the use of one-time passwords, explicitly considering the compromise of past (and future) one-time passwords, and show a general technique for building a secure one-time-PAKE protocol from any secure PAKE protocol. Our techniques also allow for the secure use of pseudorandomly generated and time-dependent passwords.

Predicate-based key exchange

We provide the first description of and security model for authenticated key exchange protocols with predicate-based authentication. In addition to the standard goal of session key security, our security model also provides for credential privacy: a participating party learns nothing more about the other party's credentials than whether they satisfy the given predicate. Our model also encompasses attribute-based key exchange since it is a special case of predicate-based key exchange.---------- We demonstrate how to realize a secure predicate-based key exchange protocol by combining any secure predicate-based signature scheme with the basic Diffie-Hellman key exchange protocol, providing an efficient and simple solution.