SELinux policy management framework for HIS

Health Information Systems (HIS) make extensive use of Information and Communication Technologies (ICT). The use of ICT aids in improving the quality and efficiency of healthcare services by making healthcare information available at the point of care (Goldstein, Groen, Ponkshe, and Wine, 2007). The increasing availability of healthcare data presents security and privacy issues which have not yet been fully addressed (Liu, Caelli, May, and Croll, 2008a). Healthcare organisations have to comply with the security and privacy requirements stated in laws, regulations and ethical standards, while managing healthcare information. Protecting the security and privacy of healthcare information is a very complex task (Liu, May, Caelli and Croll, 2008b). In order to simplify the complexity of providing security and privacy in HIS, appropriate information security services and mechanisms have to be implemented. Solutions at the application layer have already been implemented in HIS such as those existing in healthcare web services (Weaver et al., 2003). In addition, Discretionary Access Control (DAC) is the most commonly implemented access control model to restrict access to resources at the OS layer (Liu, Caelli, May, Croll and Henricksen, 2007a). Nevertheless, the combination of application security mechanisms and DAC at the OS layer has been stated to be insufficient in satisfying security requirements in computer systems (Loscocco et al., 1998). This thesis investigates the feasibility of implementing Security Enhanced Linux (SELinux) to enforce a Role-Based Access Control (RBAC) policy to help protect resources at the Operating System (OS) layer. SELinux provides Mandatory Access Control (MAC) mechanisms at the OS layer. These mechanisms can contain the damage from compromised applications and restrict access to resources according to the security policy implemented. The main contribution of this research is to provide a modern framework to implement and manage SELinux in HIS. The proposed framework introduces SELinux Profiles to restrict access permissions over the system resources to authorised users. The feasibility of using SELinux profiles in HIS was demonstrated through the creation of a prototype, which was submitted to various attack scenarios. The prototype was also subjected to testing during emergency scenarios, where changes to the security policies had to be made on the spot. Attack scenarios were based on vulnerabilities common at the application layer. SELinux demonstrated that it could effectively contain attacks at the application layer and provide adequate flexibility during emergency situations. However, even with the use of current tools, the development of SELinux policies can be very complex. Further research has to be made in order to simplify the management of SELinux policies and access permissions. In addition, SELinux related technologies, such as the Policy Management Server by Tresys Technologies, need to be researched in order to provide solutions at different layers of protection.

Why stagnant? behind the scenes in Indonesia���s reformed state asset management policies

This study seeks to answer the question of ���why is policy innovation in Indonesia, in particular reformed state asset management laws and regulations, stagnant?��� through an empirical and qualitative approach, identifying and exploring potential impeding influences to the full and equal implementation of said laws and regulations. The policies and regulations governing the practice of state asset management has emerged as an urgent question among many countries worldwide (Conway, 2006; Dow, Gillies, Nichols, & Polen, 2006; Kaganova, McKellar, & Peterson, 2006; McKellar, 2006b) for there is heightened awareness of the complex and crucial role that state assets play in public service provision. Indonesia is an example of such country, introducing a ���big-bang��� reform in state asset management laws, policies, regulations, and technical guidelines. Two main reasons propelled said policy innovation: a) world-wide common challenges in state asset management practices - such as incomplete information system, accountability, and governance adherence/conceptualisation (Kaganova, McKellar and Peterson 2006); and b) unfavourable state assets audit results in all regional governments across Indonesia. The latter reasoning is emphasised, as the Indonesian government admits to past neglect in ensuring efficiency and best practice in its state asset management practices. Prior to reform there was euphoria of building and developing state assets and public infrastructure to support government programs of the day. Although this euphoria resulted in high growth within Indonesia, there seems to be little attention paid to how state assets bought/built is managed. Up until 2003-2004 state asset management is considered to be minimal; inventory of assets is done manually, there is incomplete public sector accounting standards, and incomplete financial reporting standards (Hadiyanto 2009). During that time transparency, accountability, and maintenance state assets was not the main focus, be it by the government or the society itself (Hadiyanto 2009). Indonesia exemplified its enthusiasm in reforming state asset management policies and practices through the establishment of the Directorate General of State Assets in 2006. The Directorate General of State Assets have stressed the new direction that it is taking state asset management laws and policies through the introduction of Republic of Indonesia Law Number 38 Year 2008, which is an amended regulation overruling Republic of Indonesia Law Number 6 Year 2006 on Central/Regional Government State Asset Management (Hadiyanto, 2009c). Law number 38/2008 aims to further exemplify good governance principles and puts forward a ���the highest and best use of assets��� principle in state asset management (Hadiyanto, 2009a). The methodology of this study is that of qualitative case study approach, with a triangulated data collection method of document analysis (all relevant state asset management laws, regulations, policies, technical guidelines, and external audit reports), semi-structured interviews, and on-site observation. Empirical data of this study involved a sample of four Indonesian regional governments and 70 interviews, performed during January-July 2010. The analytical approach of this study is that of thematic analysis, in an effort to identify common influences and/or challenges to policy innovation within Indonesia. Based on the empirical data of this study specific impeding influences to state asset management reform is explored, answering the question why innovative policy implementation is stagnant. An in-depth analysis of each influencing factors to state asset management reform, and the attached interviewee���s opinions for each factor, suggests the potential of an ���excuse rhetoric���; whereby the influencing factors identified are a smoke-screen, or are myths that public policy makers and implementers believe in; as a means to explain innovative policy stagnancy. This study offers insights to Indonesian policy makers interested in ensuring the conceptualisation and full implementation of innovative policies, particularly, although not limited to, within the context of state asset management practices.

Napster: Infinite digital jukebox or pirate bazaar?

This paper considers the copyright litigation over the file-sharing program, Napster. The first section examines the culture of collecting at work in Napster. The next part examines the litigation by the major record companies and Metallica against Napster. The final section considers the future of file-sharing, looking at alternatives to Napster, such as Filetopia, Freenet, Gnutella, MP3board.com and streaming media.

Efficacy of family mediation and the role of family violence: Study protocol

Background Family law reforms in Australia require separated parents in dispute to attempt mandatory family dispute resolution (FDR) in community-based family services before court attendance. However, there are concerns about such services when clients present with a history of high conflict and family violence. This study protocol describes a longitudinal study of couples presenting for family mediation services. The study aims to describe the profile of family mediation clients, including type of family violence, and determine the impact of violence profiles on FDR processes and outcomes, such as the type and durability of shared parenting arrangements and clients��� satisfaction with mediated agreements. Methods A mixed method, naturalistic longitudinal design is used. The sampling frame is clients presenting at nine family mediation centres across metropolitan, outer suburban, and regional/rural sites in Victoria, Australia. Data are collected at pre-test, completion of mediation, and six months later. Self-administered surveys are administered at the three time points, and a telephone interview at the final post-test. The key study variable is family violence. Key outcome measures are changes in the type and level of acrimony and violent behaviours, the relationship between violence and mediated agreements, the durability of agreements over six months, and client satisfaction with mediation. Discussion Family violence is a major risk to the physical and mental health of women and children. This study will inform debates about the role of family violence and how to manage it in the family mediation context. It will also inform decision-making about mediation practices by better understanding how mediation impacts on parenting agreements, and the implications for children, especially in the context of family violence.

Competition laws and policies in China and Hong Kong : a tale of two regulatory journeys

Reviews the background to China's enactment of the Anti-Monopoly Law in 2007 and compares the debate surrounding the proposed introduction of similar legislation in Hong Kong. Examines the main issues arising during the Law's 13 year drafting stage, its key provisions and the remaining areas of uncertainty concerning its enforcement. Discusses ongoing efforts to introduce competition law regulations in Hong Kong, the main features of the draft General Competition Law and the shortcomings of its approach to penalties and exemptions.

Competition policy review : draft recommendations on competition laws

On 4 December 2013, the Prime Minister and the Minister for Small Business announced a ���root and branch��� review of Australia���s competition policy. The Minister for Small Business released the final Terms of Reference for the competition policy review on 27 March 2014, following consultation with the States and Territories, and announced the Review Panel headed by Professor Ian Harper. Under the terms of reference the Competition Policy Review Committee (the Harper Committee) is required to focus on three broad areas: ���examining what can be done to create more competition in service areas such as health, education and intellectual property; ���considering whether the structure and powers of the competition institutions (the ACCC , the NCC, the Tribunal and the AER) remain appropriate; and ���examining the effectiveness of the competition provisions of the Competition and Consumer Act 2010 (Cth) (CCA) and laying down a broad framework through which the law can be streamlined and reformed over time.

Fifield faces a hard road to bring Australia���s media regulations into the 21st century

With his feet barely under the desk, Communications Minister Mitch Fifield has flagged a renewed attempt to change Australia���s media laws. Given his predecessor Malcolm Turnbull���s long-standing interest in the field ��� dating all the way back to his work with Kerry Packer in the 1980s ��� Fifield can expect the new prime minister���s backing. Fifield is set to meet with media bosses as early as next week.

Privacy invasive geo-mashups : privacy 2.0 and the limits of first generation information privacy laws

Online technological advances are pioneering the wider distribution of geospatial information for general mapping purposes. The use of popular web-based applications, such as Google Maps, is ensuring that mapping based applications are becoming commonplace amongst Internet users which has facilitated the rapid growth of geo-mashups. These user generated creations enable Internet users to aggregate and publish information over specific geographical points. This article identifies privacy invasive geo-mashups that involve the unauthorized use of personal information, the inadvertent disclosure of personal information and invasion of privacy issues. Building on Zittrain���s Privacy 2.0, the author contends that first generation information privacy laws, founded on the notions of fair information practices or information privacy principles, may have a limited impact regarding the resolution of privacy problems arising from privacy invasive geo-mashups. Principally because geo-mashups have different patterns of personal information provision, collection, storage and use that reflect fundamental changes in the Web 2.0 environment. The author concludes by recommending embedded technical and social solutions to minimize the risks arising from privacy invasive geo-mashups that could lead to the establishment of guidelines for the general protection of privacy in geo-mashups.

Regulating Multi-National Corporations Through State-Based Laws : Problems with Enforcing Human Rights Under The Alien Tort Statute

Under the Alien Tort Statute United States of America (���America���) Federal Courts have the jurisdiction to hear claims for civil wrongs, committed against non-American citizens, which were perpetrated outside America���s national borders. The operation of this law has confronted American Federal Courts with difficulties on how to manage conflicts between American executive foreign policy and judicial interpretations of international law. Courts began to pass judgment over conduct which was approved by foreign governments. Then in 2005 the American Supreme Court wound back the scope of the Alien Tort Statute. This article will review the problems with the expansion of the Alien Tort Statute and the reasons for its subsequent narrowing.

Harmonisation of OH&S regulations

Policy instruments of education, regulation, fines and inspection have all been utilised by Australian jurisdictions as they attempt to improve the poor performance of occupational health and safety (OH&S) in the construction industry. However, such policy frameworks have been largely uncoordinated across Australia, resulting in differing policy systems, with differing requirements and compliance systems. Such complexity, particularly for construction firms operating across jurisdictional borders, led to various attempts to improve the consistency of OH&S regulation across Australia, four of which will be reviewed in this report. 1. The first is the Occupational Health and Safety Act 1991 (Commonwealth) which enabled certain organisations to opt out of state based regulatory regimes. 2. The second is the development of national standards, codes of practice and guidance documents by the National Occupational Health and Safety Council (NOHSC). The intent was that the OHS requirements, principles and practices contained in these documents would be adopted by state and territory governments into their legislation and policy, thereby promoting regulatory consistency across Australia. 3. The third is the attachment of conditions to special purpose payments from the Commonwealth to the States, in the form of OH&S accreditation with the Office of the Federal Safety Commissioner. 4. The fourth is the development of national voluntary codes of OHS practice for the construction industry. It is interesting to note that the tempo of change has increased significantly since 2003, with the release of the findings of the Cole Royal Commission. This paper examines and evaluates each of these attempts to promote consistency across Australia. It concludes that while there is a high level of information sharing between jurisdictions, particularly from the NOSHC standards, a fragmented OH&S policy framework still remains in place across Australia. The utility of emergent industry initiatives such as voluntary codes and guidelines for safer construction practices to enhance consistency are discussed.

Driving and licensing experiences of learner drivers in two Australian states prior to major changes in the licensing laws

The learner licence is an important component of the graduated driver licensing system. This research describes the driving and licensing experiences of learner drivers in Queensland and New South Wales licensed prior to the changes made to the system in mid-2007. The sample consisted of 392 participants who completed a telephone interview just after they obtained their provisional licence. The results suggest that learner drivers in the two states had many similar experiences when they were obtaining a learner licence. However, once a learner licence was obtained, there were differences in the amount of practice, the supervisor learners practised with, the type of vehicle they used and the amount of unlicensed driving. This paper provides important baseline descriptive data that can be used to measure the impact of the changes that were introduced to the learner licence phase in mid-2007 in both of these states.

Application of system dynamics for evaluating truck load regulations in Anhui, China

In the critical situation of prevailing overweight transportation and crag-fast enforcement in Chinese highway networks, this paper develops a methodological framework for truck weight regulation (TWR) evaluation using System Dynamics (SD). Composed of five interrelated subsystems, the framework is able to capture the highway, vehicle and freight variables that influence the effect of TWR and transportation efficiency over time. It specifically describes the development and use of the Truck Weight Regulation Evaluating Model (TWREM) for the highway freight system in Anhui province, China. Three policy alternatives are analyzed: 1) tolerant policy approach, which allows heavy-duty freight activity to continue in its current state, and is shown to lead to nearly catastrophic results; 2) rigid policy approach, which would terminate all heavy-duty freight activities immediately, and is shown to be economically infeasible; and 3) moderate policy approach, which advocates a gradual reduction of heavy-duty freight activities to a moderate state. The simulation results shows that the moderate policy approach is the most appropriate option to solve the social and economic problems arising from the activities of the heavy-duty freight transportation in Anhui. In addition, some suggestions of TWR policy in China are also made in this paper.

National consumer credit laws, financial exclusion and interest rate caps : The case for diversity within a centralised framework

Australia is going through a major reform of consumer credit regulation, with the implementation of a proposal to transfer regulatory responsibility from the State and Territory Governments to the Commonwealth Government. While the broad policy approach is supported, the reform process has missed a significant opportunity to engage directly with issues of financial exclusion and with the potential role of regulation to reduce financial exclusion. The imposition of an interest rate cap can limit the impact of financial exclusion. However, the future of the existing interest rate caps is uncertain, given the diversity of approaches, and the heated debate that surrounds this issue. In the absence of support for regulatory initiatives to increase the availability of low cost, small loans, permitting regulatory diversity on this issue of interest rate caps, within an otherwise centralised regulatory framework., can minimise the impact of financial exclusion on consumers.

"There's no way in hell I would pull up" : Deterrent and other effects of vehicle impoundment laws for hooning

Traffic law enforcement is based on deterrence principles, whereby drivers control their behaviour in order to avoid an undesirable sanction. For ���hooning���-related driving behaviours in Queensland, the driver���s vehicle can be impounded for 48 hours, 3 months, or permanently depending on the number of previous hooning offences. It is assumed that the threat of losing something of value, their vehicle, will discourage drivers from hooning. While official data shows that the rate of repeat offending is low, an in-depth understanding of the deterrent effects of these laws should involve qualitative research with targeted drivers. A sample of 22 drivers who reported engaging in hooning behaviours participated in focus group discussions about the vehicle impoundment laws as applied to hooning offences in Queensland. The findings suggested that deterrence theory alone cannot fully explain hooning behaviour, as participants reported hooning frequently, and intended to continue doing so, despite reporting that it is likely that they will be caught, and perceiving the vehicle impoundment laws to be extremely severe. The punishment avoidance aspect of deterrence theory appears important, as well as factors over and above legal issues, particularly social influences. A concerning finding was drivers��� willingness to flee from police in order to avoid losing their vehicle permanently for a third offence, despite acknowledging risks to their own safety and that of others. This paper discusses the study findings in terms of the implications for future research directions, enforcement practices and policy development for hooning and other traffic offences for which vehicle impoundment is applied.