GOVCERT.NL Symposium 2008

Jaap-Henk Hoepman TNO/Radboud Universiteit Nijmegen

Jaap-Henk Hoepman is a Senior Scientist in security and applied cryptography at TNO, the Dutch Organization for Applied Scientific Research. He also holds an associate professorship position at the Security of Systems Group of the Institute for Computing and Information Sciences of the Radboud University Nijmegen.

His research into information security and cryptographic protocols is usually inspired by practical problems. He focuses on RFID, NFC, sensors and the design of secure and fault tolerant protocols for pervasive systems. He speaks on these topics at national and international conferences and publishes papers in (inter)national journals, as well as in the popular press. Occasionally, he appears in the media as security expert. He is always interested in stimulating debate on the effects of security on society, and the effectiveness of security countermeasures.

He is chair of the IFIP working group 11.2 on "Small System Security", a member of the permanent stakeholders group (PSG) of the European Network and Information Security Agency (ENISA), co-founded by SAFE-NL, and is the coordinator of the Kerckhoffs Institute, offering a master programme in Computer Security.

In his free time, he enjoys creating his own music, designing visuals, and practicing Okinawan Goju Ryu karate-do.

Revocable privacy: achieving security _and_ privacy Tuesday 16 September, 10:35 - 11:20, Diamond Room

Unfortunately, security and privacy are seen as one another’s enemies. Without any unpinning evidence, it is thought that one cannot be achieved without sacrificing the other. Given the high political importance given to homeland security these days, this has resulted in approaches to increase societal safety that disregard the privacy of citizens. Similarly, when designing privacy-enhancing technologies (PET), no attention is paid to the quite reasonable request to also consider societal security issues.

Legal or regulatory attempts to remedy the situation are inadequate. Rules and regulations may change over time, allowing for more opportunities for gathering information about people after the fact. The solution must, therefore, be found in limiting these opportunities at the outset, through technical means, in the architecture and design of the system.

To balance the security and privacy needs, we introduce the concept of _revocable privacy_. In essence the idea is to design systems in such a way that no personal information is collected, unless a user violates the (pre-established) terms of service.

The presentation will discuss the concept of revocable privacy in more detail, will present some known solutions to the problem, and propose an agenda for further research.