text: ENISA Briefing

text: ENISA Briefing

text: Security – (resistance to spoofing) Unobtrusiveness Low enrolment/training time Accuracy (low EER) Persistence

text: ENISA Briefing

text: (text in this section taken from Mimicry Attack on Strategy-Based Behavioral Biometric. Yampolskiy, Roman V. (32))

text: ENISA Briefing

text: Future trends and research

text: ENISA Briefing

identifier: Behavioural Biometrics

nummer: behavioural-biometrics

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Behavioural Biometrics

serie: rapporter

text: January 10

type: stycke

text: ENISA Briefing

text: ENISA Briefing: Behavioural Biometrics

type: rubrik

text: ENISA Briefings are short descriptions of emerging issues in security aimed at policy and decision makers. They give a brief introduction to the topic, areas of debate and propose a reasoned opinion on controversial points.

text: The purpose of this briefing is to give an introduction to the possibilities offered by behavioural biometrics, as well as their limitations and the main issues of disagreement between experts in the field. Suggestions for further reading can be found in [Sources and further reading].

text: Contact details:

text: This report has been edited by: Giles Hogben, email: Giles.hogben@enisa.europa.eu

text: Acknowledgements:

text: We would like to thank the following experts for their input and advice:  Roman Yampolskiy, University of Louisville  Yannis Damousis, Center for Research and Technology Hellas

text: Behavioural Biometrics

text: Key points

text:  Behavioural biometrics offer a tool which may enhance the security of user authentication and intrusion detection applications, in some cases with very low impact on the system users.  They are most useful in multimodal systems (those using more than one type of biometric at the same time) as a complement to more robust methods largely because most behavioural biometrics are highly sensitive to the means of implementation. E.g. keystroke dynamics depend on the keyboard hardware used, blinking behavior depends on illumination etc…  Some behavioural biometrics, require specialised and sometimes highly obtrusive equipment which may be off-putting to users.  Other behavioural biometrics on the other hand offer a completely unobtrusive technique to identify or classify individuals. Such unobtrusiveness may be challenging from the point of view of collecting user consent, as required by law in many jurisdictions.  Data collected by behavioural biometrics may be used for secondary purposes which can involve the processing of highly sensitive data which may be inferred from the data collected.  Behavioural biometrics are vulnerable to several spoofing attacks specific to the technique (see [Areas of controversy and open problems]).

text: Introduction

text: Behavioural biometrics are used in an information security context to identify individuals by using unique features of activities they perform either consciously or unconsciously. There is a very large number of possible techniques. For a more complete taxonomy of behavioural biometrics see (1). Some interesting examples include:  Blinking pattern: Time between blinks, how long the eye is held closed at each blink, physical characteristics the eye undergoes while blinking  ECG: features of electromagnetic signals generated by the heart  EEG: features of electromagnetic signals generated by the brain  Gait: the way a person walks.  Game strategy: a statistical model of player’s strategy in various games including online role playing games can be used to detect imposters. This is increasingly important in massively mutiplayer games involving real money trading – see (2)  Keystroke dynamics: the way a person types. This can cover the timing of keystrokes, or with an adapted keyboard, the pressure used.  Text style: many linguistic features can be profiled such as: lexical patterns, syntax, semantics, pragmatics, information content or item distribution through a text (3).

text: Behavioural Biometrics

text:  Voice: Speaker identification is one of the best researched biometric technologies (4) (5). Speaker identification systems can be classified based on the freedom of what is spoken (6): o Fixed text: The speaker says a particular word selected at enrollment. o Text dependent: The speaker is prompted by the system to say a particular phrase. o Text independent: The speaker is free to say anything he/she wants. A number of techniques are limited to specific use-cases – for example, car driving style (to identify drivers), handgrip pressure patterns (for authentication to handheld devices including weapons) and credit card usage patterns (credit card fraud detection). Important factors in the successful implementation behavioural biometrics include:

text:  Equipment required: this can vary from none at all (e.g. in the case of simple keystroke dynamics) to multiple cameras, EEG sensors etc...  Enrollment time: the time required to train the system to recognise a given individual.  Persistence: The time before an identifying feature changes in an individual after an initial training period of the system.  Obtrusiveness: How much the system alters the normal experience of the identification subject. For example, EEG sensors which must be attached to the scalp are obviously obtrusive.  Error rates: As with all biometrics, error rates are analysed according to: o False rejection rate (FRR): the percentage of individuals wrongly denied access to a system. o False acceptance rate (FAR): the percentage of individuals wrongly authorised by a system o Equal error rate: a measure often used to evaluate the accuracy of a biometric technology. It is the value of the FRR and FAR when a system is tuned to have an equal FAR and FRR.

text: Suitability by application area

text: These factors vary dramatically between different types of behavioural biometrics. For example ECG biometrics can give EER values of less than 3% but highly obtrusive equipment is still used (7). Keystroke dynamics on the other hand when applied to timing only, requires no special equipment. The confidence in the identity of the subject however depends strongly on the length of the sample and the system training period (the time taken for the application to build up a reliable model of a given user) . This makes it most suitable for use as a way of detecting if a user is substituted after an initial login, or to add an extra level of confidence to another factor (8).

text: Behavioural Biometrics

text: ENISA Briefing

text: It is important, therefore, to understand how the limitations of a given technique affect the use-cases for which it is suited. The following table shows the requirements of different application areas – higher bars mean this requirement is more important.

text: Areas of controversy and open problems

text: Collection of sensitive information: some of the techniques used collect data which may be used to derive highly sensitive information. Perhaps the clearest example of this is the collection and analysis of EEG patterns. EEG patterns may be used simply for identification, but it is now possible to extract significant information about the thoughts of the subject from records of brain activity (fMRI): see (9) (10). Even less obviously, sensitive types of behavioural biometrics may incidentally gather highly sensitive information however. For example, gait features may reveal emotional features such as depression (11) (12).

text: It should be emphasised however that the in some cases, such as keystroke dynamics, this issue is less important since there is less likely to be a correlation between the biometric measurement and more

text: Behavioural Biometrics

text: sensitive features of a person’s profile (such as mood, health state etc...). The use-case of the technique also affects the importance of this issue. For example, when used to detect intrusion into a home computer (which is assumed to be trusted), such sensitive data may be kept private to the user, while when used to authenticate to a corporate web application, this may not be the case.

text: Furthermore, techniques exist to limit the exposure from collected behavioral profiles, provided that the data collector is trusted (e.g. hashable profiles, etc.). Currently this area of research is in its infancy and will undoubtedly grow as does the adaptation of behavioral biometrics.

text: Negative reaction to obtrusive equipment: Due to the above possibilities, as well as the obtrusiveness of the equipment used, there is a strong negative reaction on the part of end-users to certain kinds of biometrics, including behavioural biometrics such as EEG scanning. Whether or not fears are wellfounded, this is a significant problem for deployment. For a more in depth discussion of this issue see: (13) (14)

text: Consent and secondary use for data collected with unobtrusive equipment: Some behavioural biometrics are at the other end of the obtrustiveness spectrum. For example, gait recognition and keystroke dynamics are possible without any impact on the subject whatsoever. This has its own drawbacks, because it means that a subject may be identified without their awareness. This raises the issue of consent: according to the European directive (15), personal data (which are collected in every identification event involving behavioural biometrics), should always be processed with the informed consent of the data subject.

text: Highly unobtrusive techniques offer the possibility of identifying people outside the scope of the original application, without any special equipment. For example, if a person’s keystroke signature is known to ,they could be recognized on other systems with keystroke analysis software. A key question is therefore, how to limit behavioural profiles to a specific context and what happens if the information is leaked outside the system.

text: Higher error rates: Many behavioural biometrics have error rates which are high enough to make them unsuitable for use as an authentication technology in isolation. For example, haptic (touchbased) authentication has an EER of 22.3%. This does not mean that such techniques should not be used. However, they may only be useful in their current form when combined with other authentication techniques. For example, keystroke dynamics, which has a minimum FRR of 4%, may only be useful in combination with an initial static biometric technique such as fingerprint machine. An excellent summary of error rates can be found in (1).

text: Sensitivity to change of application configuration: most behavioural biometrics are sensitive to the implementation context. For example, gait recognition using video analysis is quite sensitive to

text: Behavioural Biometrics

text: ENISA Briefing

text: illumination changes, keystroke dynamics depend on the keyboard hardware used, blinking behavior also depends on illumination etc… For this reason they are mainly used in multimodal systems as complements to more robust and methods.

text: Spoofing attacks : A number of different types of spoofing attacks are described in the literature (15):  Coercive Impersonation- is a type of attack in which the attacker physically forces a genuine user to identify himself to an authentication system or removes the biometric (for example, a finger) from the person to use as a key to gain access to the resources.  Replay Attack- is based on recording a previously produced biometric such as taking a picture of a face or recording a person’s voice and submitting it to the biometric data collection unit.  Impersonation Attack- involves an attacker who can change his appearance to match a legitimate user for example use makeup to copy somebody’s face or impersonate voice or forge a signature.

text: Approaches to spoofing behavioral biometrics are similar to those for physical biometrics but with some domain specific features. Replay attacks are very popular since it is easy to record an individual’s voice or copy a signature. Human mimicking or forgery is also a very powerful technique with experts consistently breaching security of signature-based or voice-based authentication systems. On the other hand, the removal of body parts such as fingers or DNA, is less likely to be a useful attack.

text: Just as software can be trained to recognize samples based on feature recognition, it can also be trained to generate samples containing a given set of features. Such techniques produce models of behavior parameterized with observed target user data which steadily improve in their performance. It may also be possible to perform a brute force attack on a biometric system by going through a large number of possible behavioral parameters. For example, experiments demonstrate that with respect to game-strategy biometrics it is possible to secretly and automatically monitor the target user during play, generate an accurate statistical profile of his actions and train an artificially intelligent program to mimic target player’s behavior.

text: Spoofing approaches for voice-based behavioral biometrics are very numerous and creative in nature including impersonation (16) (17) (18) (19), cut-and-paste (20) (16), text-to-speech (20) (16) (21) and voice morphing (22) (16) (23) (24).

text: A promising solution proposed in the literature for preventing spoofing of behavioral biometric systems is to use automatic computerized methods aimed at telling humans and computers apart

text: Behavioural Biometrics

text: automatically. Commonly known as CAPTCHAs, these take advantage of the differences in abilities between human beings and intelligent machines to identify to which group an agent being tested belongs. The risk of spoofing or theft of biometric data should also be reduced by appropriate encryption of profiles and templates.

text: Cross over with behavioural marketing

text: Behavioural marketing uses data which is not classified as personally identifiable according to the European Directive 95/46 to target narrow classes of individuals. It is interesting to note that behavioural biometrics provide data and techniques which could be used for the same purpose. The same data which might allow the detection of anomalous behaviour for intrusion detection purposes – e.g. keystroke dynamics, haptic feedback etc..., could also be used to classify individuals for marketing purposes. This means that the same issues (25) which have sparked fierce debate on behavioural marketing in Europe, should also be considered in respect of behavioural biometrics.

text: The following are areas where significant developments can be expected in behavioural marketing:

text:  Standardisation: Some standardization initiatives are pursued under Joint Technical Committee 1 (JTC 1) of ISO/IEC subcommittee SC37 “Biometrics”. There are also some large scale projects attempting to develop standards for behavioral biometrics (26). In particular within HUMABIO project, biometric data interchange formats were defined for the new biometric modalities (EEG, ECG, anthropometric profile), as a contribution to the work of ISO SC 27, WG 3..

text: Specifically in the area of Cognitive biometrics such efforts are undertaken by the journal of the field (27) to establish an international standard(s) for cognitive biometrics which would provide a means for integrating this branch of biometrics within government frameworks, engendering widespread integration into a common global biometric framework.  Multi-modal biometrics: One approach to prevent spoofing attacks is to use multi-modal biometric systems (28). Multi-modal biometrics are more difficult to spoof since they require simultaneous spoofing of multiple different biometric modalities for example fingerprint and face. A very interesting approach is combining of physical and behavioral biometrics into a single authentication system. Probably the most popular such methodology combines the audio (voice) and video (face) signal obtained from the user. Such systems can still be spoofed by concurrent presentation of a recorded or mimicked voice together with a photograph or a video clip of the user’s face but a lot of successful techniques have been developed to check for liveness in such multi-modal biometric systems (29) (30)

text: Behavioural Biometrics

text: ENISA Briefing

text:  Unobtrusiveness: various techniques which currently require highly obtrusive devices will evolve towards more unobtrusive techniques. For example, currently some techniques for gait recognition require the subject to wear special trousers. This may be released by video based techniques.  Privacy enhancing techniques: to limit the exposure from collected behavioral profiles.  Efficiency: error rates and training periods will be reduced.

text: Sources and further reading

text: 1. Behavioral Biometrics: a Survey and Classification. R Yampolskiy, V Govindaraju. Issue 1, s.l. : International Journal of Biometrics (IJBM), 2008, Vol. Volume 1, pp. 81-113.

text: 2. Giles Hogben, ENISA. Security and Privacy in Virtual Worlds and Gaming. [Online] http://www.enisa.europa.eu/act/it/oar/massively-multiplayer-online-games-and-social-andcorporate-virtual-worlds/security-and-privacy-in-virtual-worlds-and-gaming/at_download/fullReport.

text: 3. Linguistic profiling for author recognition and verification. Halteren, H. 2004. Proceedings of ACL.

text: 4. Speaker verification for multimedia applications. Ciota, Z. 2004. IEEE International Conference on Systems. pp. 2752-2756.

text: 5. Information Fusion for Robust Speaker Verification. C. Sanderson, K. K. Paliwal. Aalborg : s.n., 2001. 7th European Conference on Speech Communication and Technology (EUROSPEECH'01).

text: 6. Automated Biometrics. N. K. Ratha, A. Senior, R. M. Bolle. Rio de Janeiro : s.n., 2001. International Conference on Advances in Pattern Recognition.

text: 7. Verification of humans using the electrocardiogram. G Wubbeler, M Stavridis, D Kreiseler, R Bousseljot, C Elster. s.l. : Elsevier Pattern Recognition Letters, 2007, Vol. 28.

text: 8. Keystroke dynamics as a biometric for authentication. F Monrose, D Aviel, B Rubin. s.l. : Future Generation Computer Systems, 2000, Vol. 16.

text: 9. Naselaris T, Prenger RJ, Kay KN, Oliver M, Gallant JL. Bayesian reconstruction of natural images from human brain activity. Neuron. 2009 Sep 24;63(6):902-15.

text: 10. Signatures of Depression in Non-Stationary Biometric Time Series. M Culic, B Gjoneska, H Hinrikus, M Jändel, W Klonowski, H Liljenström, N Pop-Jordanova, D Psatta,D von Rosen, B Wahlund. 2009, 2009, Vol. Computational Intelligence and Neuroscience. Behavioural Biometrics

text: 11. Troje, N. F. Retrieving information from human movement patterns. In: Shipley, T. F. and Zacks, J. M. (eds.) Understanding Events: How Humans See, Represent, and Act on Events. s.l. : Oxford University Press, 2008, pp. pp. 308-334.

text: 12. Spatiotemporal gait patterns during over ground locomotion in major depression compared with healthy controls. Lemke MR, Wendorff T, Mieth B, Buhl K, Linnemann M. 2000, Vols. J Psychiatr Res. 2000 Jul-Oct;34(4-5):277-83.

text: 13. Body, Biometrics and Identity. S Massari, E Mordini. 9, s.l. : Bioethics, 2008, Vol. 22.

text: 14. Bioethics, Irish Council for. Biometrics, Enhancing Security or Invading Privacy. Dublin : s.n., 2009.

text: 15. The state of the art in abuse of biometrics. Hartel, I. Buhan and P. s.l. : Technical Report TR-CTIT- 05-41 Centre for Telematics and Information Technology, University of Twente, 2005.

text: 16. Vulnerability of speaker verification to voice mimicking, Video and Speech Processing. Y. W. Lau, M. Wagner and D. Tran. s.l. : Proceedings of 2004 International Symposium on Intelligent Multimedia, 20- 22 Oct. 2004. pp. pp. 145- 148.

text: 17. Vulnerability in speaker verification- A study of technical impostor techniques. Blomberg, J. Lindberg and M. 1999. Proceedings of Eurospeech. pp. 1211-1214.

text: 18. Speaker verification scores and acoustic analysis of a professional impersonator. M. Blomberg, D. Elenius and E. Zetterholm. 2004. Fonetik. pp. 84-87.

text: 19. A comparison between human perception and a speaker verification system score of a voice imitation. E. Zetterholm, M. Blomberg and D. Elenius. Tenth Australian International Conference on Speech Science & Technology.

text: 20. Towards Speech-Generated Cryptographic Keys on Resource-Constrained Devices. F. Monrose, M. Reiter, Q. Li, D. P. Lopresti and C. Shih. San Francisco : s.n., 2002. Eleventh USENIX Security Symposium. pp. 283-296.

text: 21. Imposture Using Synthetic Speech against Speaker Verification Based on Spectrum and Pitch. T. Masuko, K. Tokuda and T. Kobayashi. Beijing : s.n., 2000. 6th International Conference on Spoken Language Processing. pp. 302-305.

text: 22. Quality-enhanced Voice Morphing using Maximum Likelihood Transformations. Young, H. Ye and S. s.l. : IEEE Audio, Speech and Language Processing, 2006. Behavioural Biometrics ENISA Briefing

text: 23. Voice Forgery Using ALISP: Indexation in a Client Memory. P. Perrot, G. Aversano, R. Blouet, M. Charbit and G. Chollet. 2005. IEEE International Conference on Acoustics, Speech, and Signal Processing. pp. 17- 20.

text: 24. Wavelet-based voice morphing. C. Orphanidou, I. M. Moroz and S. J. Roberts. s.l. : WSEAS Journal on Systems, 2004, pp. 3297-3302.

text: 25. ENISA. How to strengthen EU legislation, improve international cooperation and secure the growing market of internet services. [Online] 2007. http://www.enisa.europa.eu/act/it/library/pp/euleg/at_download/fullReportb3oFliP21RN.

text: 26. Actibio project. [Online] http://www.actibio.eu.

text: 27. International Journal of Cognitive Biometrics. [Online] http://www.inderscience.com/browse/index.php?journalCODE=ijcb.

text: 28. Spoofing and Anti-Spoofing Measures, Information Security Technical Report. Schuckers, S. A. C. 2002, pp. 56-62.

text: 29. Detecting Replay Attacks in Audiovisual Identity Verification. H. Bredin, A. Miguel, I. H. Witten, G. Chollet. Paris : s.n., 2006. Proceedings of IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP 2006). pp. 1-6.

text: 30. Audio-Video Biometric system with liveness checks. G. Chetty, M. Wagner. s.l. : Image and Vision Computing, 2005.

text: 31. [Online] http://www.inderscience.com/storage/f861114357101292.pdf.

text: 32. Mimicry Attack on Strategy-Based Behavioral Biometric. Yampolskiy, Roman V. Las Vegas : IEEE Computer Society, 2008. 5th International Conference on Information Technology: New Generations (ITNG2008). pp. 916-921.

type: vagledning

utgivare: enisa


text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: . This publication does not necessarily represent state-of the-art and it might be updated from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for educational and information purposes only. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2009

text: European Commission, e-Health – making healthcare better for European citizens: An action plan for a European e-Health Area, Communication from the Commission to the Council, the European Parliament, the European Economic and Social Committee and the Committee of the Regions, COM(2004) 356 final, Brussels, 30 Apr 2004. For more on the EC’s e-health strategy, see ICT for Health and i2010: Transforming the European healthcare landscape: Towards a strategy for ICT for Health, Office for Official Publications of the European Communities, Luxembourg, 2006. The ultimate goal is to enable access to the patient’s electronic health record and emergency data from any place in Europe.

text: European Commission, “eHealth initiatives to support medical assistance while travelling and living abroad”, Press release, IP/08/1075, Brussels, 2 July 2008. Cited in P.M. Danzon and M. Furukawa, “e-Health: Effects of the Internet on Competition and Productivity in Health Care”, in The Economic Payoff from the Internet Revolution, the Brookings Task Force on the Internet, Brookings Institution Press, Washington, DC, 2001.

text: Article 29

text: Data Protection Working Party, Working Document on the processing of personal data relating to health in electronic health records (EHR), 00323/07/EN,

text: WP 131

text: , adopted on 15 Feb 2007.

text: most people not aware of

text: true costs and vulnerabilities

text: The scenario in this paper is based on the high-level scenario used in the assessment (please refer to Annex I).

text: associated liabilities

text: determined hackers

text: creep, secondary use)

text: access is riddled with

text: Article 29

text: WP 131

text: , adopted on 15 Feb 2007.

text: data is an imperfect strategy

text: at best. Developing an

text: algorithm to check for

text: accuracy is a good idea, of

text: course, but as a bankable

text: proposition, it is highly

text: it is important they enjoy

text: there is a political risk to

text: policy-makers, an erosion in

text: trust and confidence.

text: are concerned about the

text: informed consent issue as

text: well as other issues. A

text: balance must be struck

text: A survey by The Guardian found that 59 per cent of GPs were unwilling to upload any record without the patient’s specific consent and were increasingly concerned about the government’s plan to automatically upload the records of everyone who does not register an objection. According to The Guardian story, government ministers said unless someone objected, it would be assumed that they

text: procedures are helpful, but

text: require safeguards and

text: oversight (how can we know

text: that a guardian always acts

text: in the interest of the

text: Testing for worst-case

text: scenarios is not the same as being able to cope with them. It is not possible to foresee all worst-case

text: scenarios.

text: had given “implied consent”. Carvel, John, “Family doctors to shun national database of patients' records”, The Guardian, 20 Nov 2007.

text: exchange shows how easily

text: information can be

text: technologies, such as a vest

text: equipped with biosensors is

text: theoretically a good idea, but

text: costs to the individual must

text: be taken into account. Ralph

text: Is there a risk that the costs

text: implementation of the

text: system, there is a risk that

text: “payback” may be much

text: In late January 2009, the UK House of Commons public accounts committee (PAC) warned that key parts of a £12.7 billion programme to upgrade the NHS's information technology are on the brink of failure. The NHS is currently forecasting a completion date of 2014-15, four years later than originally planned. MPs said even this revised schedule looks over-optimistic. See Carvel, John, “New NHS computer system on brink of failure, warn MPs”, The Guardian, 27 Jan 2009. http://www.guardian.co.uk/society/2009/jan/27/nhs-it-computer-programme-health-public-

text: Ralph says nothing untoward has happened to him – yet –

text: but the past is an unreliable

text: all risks. The individual must

text: do his bit too. exercise bikes. I follow a strict diet. Oh, yes, and I have to

text: doctors actually use such 11

text: systems. There are also risks, e.g., if a doctor

text: delegates the e-prescribing to a nurse or assistant who

text: abuses it. electronically. It does away with her scrawl. She decides what I need and then sends the prescription electronically to my local

text: card, then an unauthorised

text: person, e.g., a hacker, could

text: benefits advocated by

text: Only two per cent in the US. See Connolly, Ceci, “Few Doctors Sign Off on Online Prescribing”, Washington Post, 25 Nov 2008. http://www.washingtonpost.com/wp-dyn/content/article/2008/11/21/AR2008112102939.html Most doctors are already using information technologies. See, for example, the report prepared for the European Commission (DG Information Society and Media), entitled Benchmarking ICT use among General Practitioners in Europe, Final Report, Bonn, April 2008. http://ec.europa.eu/information_society/eeurope/i2010/benchmarking/index_en.htm#NEW_Pilot_on _eHealth_indicators:_Benchmarking_ICT_use_among_General_Practitioners_in_Europe

text: the benefits are clear, but

text: also the risks entailed cannot

text: be ignored

text: This seems to be happening in the case of the UK’s e-health system. Carvel, John, “New NHS computer system on brink of failure, warn MPs”, The Guardian, 27 Jan 2009. http://www.guardian.co.uk/society/2009/jan/27/nhs-it-computer-programme-health-public-

text: The International Organization for Standardization (ISO) defines vulnerability as a weakness of an asset or group of assets that can be exploited by one or more threats. It refers to an aspect of a system that can be exploited for purposes other than those originally intended, weaknesses, security holes, or implementation flaws within a system that are likely to be attacked by a threat. These vulnerabilities are independent of any particular threat instance or attack. Threat is defined as an activity or event the occurrence of which could have an undesirable impact; the circumstance or event has the potential to adversely impact an asset through unauthorised access, destruction, disclosure, modification of data, and/or denial of service. Threats may be of environmental or human origin and, in the latter case, may be either accidental or deliberate. Threat characteristics include motivation, e.g., financial gain, competitive advantage, frequency of occurrence, likelihood, and impact. See ISO / IEC 13335-1 (2004) ―Information technology - Security techniques - Management of information and communications technology security — Part 1: Concepts and models for information and communications technology security management‖.

text: For Information about device interconnections, see Bluetooth Medical Device Profile Specification http://www.musenka.com/info/doc/MDP(MedicalDevicesProfile).pdf USB Personal Healthcare Device Class Specification http://www.usb.org/developers/devclass_docs/Personal_Healthcare_1.zip

text: The Standing Committee of European Doctors (CPME) defines electronic health record as ―a comprehensive medical record or similar documentation of the past and present physical and mental state of health of an individual and the medical procedures done in electronic form and providing for ready availability of these data for medical purposes‖. http://www.cpme.eu. The Art 29 Data Protection Working Party adopted the same definition in its Working Document referenced above (see footnote 5). Gellman, Robert, ―Health Privacy: The Way We Live Now‖, Privacy Papers, Free Congress Foundation, August 2002. http://www.privacyrights.org/ar/gellman-med.htm

text: For a recent example, see Ahmed, Murad, ―India suffers massive internet disruption after undersea cables break‖, The Times, 19 Dec 2008. http://technology.timesonline.co.uk/tol/news/tech_and_web/the_web/article5372294.ece

text: Scenario Building & Topic Selection Risk Assessment Analysis

text: Information Information Trend Analysis Risk Treatment Collection Dissemination

text: Topic Selection

text: Scenario Building & Analysis

text: Risk Management

text: Information Management

text: Please note that for a more detailed description of the EFR Framework you may refer to the ENISA EFR Handbook, soon to be published and will be available for download from our website. The structure for framing the scenario is based on that developed for the ―dark scenarios‖ in the SWAMI project. See Wright, David, Serge Gutwirth, Michael Friedewald et al., Safeguards in a World of Ambient Intelligence, Springer, Dordrecht, 2008.

text: EBIOS is the acronym for Expression des Besoins et Identification des Objectifs de Sécurité (Expression of Needs and Identification of Security Objectives).

identifier: Being diabetic in 2011

title: Being diabetic in 2011

text: EFR Pilot

text: March 09

text: Being diabetic in 2011

text: ‘Being diabetic in 2011’

text: Identifying emerging and future risks in remote health monitoring and treatment

text: EFR Pilot

text: March 09

text: Being diabetic in 2011

text: About ENISA

text: The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard of information for good practices. Moreover, the agency facilitates contacts between the European institutions, the Member States and private business and industry actors.

text: EFR Pilot – “Being diabetic in 2011” 3

text: Contributors

text: This report presents the results of the risk assessment pilot performed in 2008 on a specific scenario regarding health remote monitoring and treatment. The report and the study was coordinated by the ENISA team, using input and comments from specific subject matter experts in the area, including industry, academic and government experts; notable some of these experts are already members of the ENISA Stakeholder Forum on Emerging and Future Risks. The content was collected via a mailing list, telephone conferences and face-to-face meetings. This paper should not be taken as representing the views of any company or other organisation.

text: List of contributors (in alphabetical order)

text: Catherine Chronaki, Biomedical Informatics Laboratory at the Institute of Computer Science, Foundation of Research and Technology Hellas (FORTH), Greece Claire Vishik, Intel Corporation, UK David Wright, Trilateral Consulting, UK Emilio Mordini, Centre for Science, Society and Citizenship, Italy Evangelos Markatos, Foundation of Research and Technology Hellas (FORTH), Greece Frederik Kortbaek, European Privacy Institute, Denmark Guillaume Le Galiard, Adèle Adam and Hervé Ysnel, Logica, France Hans Oude Alink, Ministry of Economic Affairs, The Netherlands Julien Touzeau, Airbus, France Milan Petkovic, Philips Research, The Netherlands Mireille Hildebrandt, Vrije Universiteit Brussel, Belgium; Erasmus School of Law, Rotterdam, the Netherlands Paul McCarthy, ESRC Centre for Economic and Social Aspects of Genomics (CESAGen), Lancaster University, UK

text: Contact details:

text: For more information on this report, you may contact: Barbara DASKALA Barbara.DASKALA@enisa.europa.eu Dr. Louis MARINOS Louis.MARINOS@enisa.europa.eu

text: EFR Pilot – “Being diabetic in 2011” 5

text: Introduction

text: Since 2007, ENISA has been conducting a series of activities towards developing a comprehensive framework for identifying and assessing emerging and future risks (EFR). As a result of these activities, ENISA has constructed an EFR Framework. The EFR Framework is scenario-based and consists of certain phases for the formulation and analysis of scenarios, mobilisation of the necessary expertise (human resources) to assess and analyse the scenarios and leveraging of the management capabilities to collect and disseminate assessed information (e.g., scenario descriptions, threats, vulnerabilities, assets, impacts, risks, etc.).

text: The agency also sought to validate a European capacity for the evaluation of those risks to network and information security that may emerge in the near term, i.e. over the next three years. The work in this area is relatively new and, as such, calls for the interaction and co-operation of many leading experts from different disciplines, which is why ENISA established an EFR Stakeholder Forum and consulted with other subject matter experts. The EFR Stakeholder Forum, comprising partners and experts from industry, EU organisations and Member States, supports the agency in its deliberations on and assessment of EFRs and has contributed significantly to this pilot.

text: The pilot was undertaken in order to test and provide a ―proof-of-concept‖ of the developed and proposed EFR Framework. It is based on a scenario in the area of remote health monitoring and treatment, an area which was selected after discussions with the EFR Stakeholder Forum. This report presents the results of the pilot exercise.

text: Why an e-health scenario?

text: The European Commission and some Member States have been actively promoting the merits of e-health in recent years. The Commission issued an e-health action plan in 2004 and, in July 2008, a Recommendation on cross-border interoperability of electronic health record (EHR) systems so that doctors can gain access to vital information on patients from other Member States whom they happen to be treating. It was also announced that it would co-fund a Smart Open Services (SOS) project (http://www.epsos.eu/) with 12

text: 6 EFR Pilot – “Being diabetic in 2011”

text: Member States and their industry players, to demonstrate the benefits of such interoperability.

text: The Commission has described e-health as the application of information and communications technologies across the whole range of functions that affect the health sector. E-health tools or solutions include products, systems and services that go beyond simply Internet-based applications. They include tools for health authorities and professionals as well as the delivery of personalised health systems for patients and citizens. Examples include health information networks, electronic health records, telemedicine services, personal wearable and portable communication and sensory systems, health portals and many other ICT-based tools assisting the prevention, diagnosis, and treatment of disease and illness, as well as health monitoring and lifestyle management to aid in the prevention of disease and illness.

text: Health care expenditure represents an increasingly large percentage of national budgets. Officials are interested in e-health in part because it can help to (1) limit costs and improve productivity in areas such as billing and record-keeping, (2) reduce medical error, (3) alleviate unnecessary care and (4) achieve savings in business-to-business ecommerce relevant to the health care sector.

text: Nevertheless, e-health remains controversial and, some would say, risky. One of the biggest challenges in implementing e-health concepts is convincing the public that their electronic health records will be safe and secure. According to the Article 29 Working Party, electronic health records pose ―significant challenges in ensuring that only appropriate health professionals gain access to information for legitimate purposes related to the care of the data subject‖.

text: It was in this context that we considered a scenario on the issue of e-health and on remote health monitoring and treatment in particular would be an excellent subject of analysis, the results of which could also contribute to discussions at EU level and have direct policy relevance.

text: Moreover and based on all these considerations, Philips Research (Netherlands) produced a very interesting proposal for a scenario on remote health monitoring and treatment. The EFR Stakeholder Forum welcomed this proposal, which formed the basis for the scenario of the EFR pilot (for the complete text of the scenario, please refer to Annex I).

text: EFR Pilot – “Being diabetic in 2011” 7

text: The EFR pilot: objectives, scope and limitations

text: The pilot had two objectives:

text:  To identify major emerging and future risks of the particular area chosen (remote health monitoring)  To obtain feedback on the EFR Framework, so that it could be updated and improved.

text: Once the topic of the scenario was identified, ENISA and Stakeholder Forum members discussed its scope and level of analysis. Eventually, it was agreed to have one scenario dealing with remote health monitoring and treatment. In addition, it was decided to identify all the major IT components at a somewhat high or strategic level and to group these into generic categories, as found in the ―What are we trying to protect‖ section of this report and in the Asset fields of the EFR Application Scenario template (see Annex I).

text: A series of assumptions were made in the development and analysis of the scenario. They are explicitly detailed in the scenario template in Annex I. The assumptions were necessary in order to develop and analyse the scenario and then to identify the risks. The risks are factored into these assumptions, which means if the assumptions are changed, an identified risk may not be valid or an additional risk may emerge.

text: The scenario does not and cannot cover all possible aspects of this very wide area of applications and therefore the results produced are by no means exhaustive. It does, however, present some of the potential risks and challenges posed by emerging e-health applications. It is expected to contribute to the dialogue on e-health implementations and to fuel further study of these issues.

text: Objective and structure of this report

text: As mentioned above, this report presents the results of the EFR pilot conducted in 2008 and which deployed the ENISA EFR Framework in order to identify major risks associated with e-health generally and remote health monitoring and treatment specifically. Its major objective is thus to provide a high level overview of the results. Of the supporting documentation on which this report is based, the scenario template and the risk assessment report are annexed and the EFR Handbook can be found on the ENISA EFR website.

text: The report begins with a cautionary tale, which is based on the application scenario prepared by ENISA and its Stakeholder Forum. It provides a brief overview of the risks and challenges identified in the deployment of remote health monitoring and treatment programmes. The next two sections present the major risks identified in the course of the pilot and the assets, i.e., what we are trying to protect. Finally, the report concludes with a very brief overview of the methodology used, namely the ENISA EFR Framework, in order to identify and analyse the risks. The Annexes provide the detailed scenario template and the risk assessment report produced by Logica‘s EBIOS experts.

text: 8 EFR Pilot – “Being diabetic in 2011”

text: A cautionary tale

text: Setting the scene – the actors Ralph knew it was going to be a tough three days. As expected, – what’s at stake – the he was sparring with Fred, his tenacious, young opponent, an

text: assistant deputy minister from the Finance Department, who was intent on derailing the health ministry’s dream of an electronic health system for all citizens. Ralph’s mission was to convince other conference delegates that the government should proceed

text: with an operational system, while Fred was diametrically

text: opposed.

text: There was a lot at stake – assumed improvements to the quality and availability of health care to the country’s population versus

text: the huge start-up costs and higher taxes at a time when

text: economies had already been battered by the continuing effects of

text: 2008’s financial meltdown three years ago. Ralph and Fred seemed to take the debate to a personal level. In open

text: discussions within the conference room, where the decisions were expected to be made this week, the animosity between the pair seemed palpable.

text: Ralph was in his late 50s, diabetic, mildly overweight, with

text: thinning hair, frequently cleaning his spectacles with the end of his tie. His grey suit matched his somewhat sombre demeanour.

text: He seemed to be the very embodiment of a bureaucrat. By

text: contrast, Fred was young, fit and quick. Nevertheless, in the

text: debate about whether an e-health system offered value for money, they seemed to be evenly matched. Participants from

text: other government departments were struck by the apparent irony

text: of the bureaucrat supporting deployment of innovative technologies while the ebullient Fred was doggedly resisting heavy new expenditures on anything. Sensing how undecided

text: other participants were, Fred, seemingly as well briefed as his counterpart, was set on calling into question the integrity of the proposed e-health system.

text: Studies show advantages of “We are in favour of this e-health system. Several studies here e-health but… and abroad have shown the advantages of e-health. We have consulted widely with the public over the past year and a majority are in favour of such a service…” said Ralph.

text: “Let me stop you there, Ralph,” Fred interjected, shaking his

text: EFR Pilot – “Being diabetic in 2011” 9

text: head. “I’ve seen surveys too and they show this majority to be very slender indeed. And, let’s face it, most people are not aware

text: of the true costs and vulnerabilities.”

text: Pilot projects are useful “We’ve had several pilot projects,” Ralph protested, “and they

text: show a very high level of user satisfaction.”

text: “Yes, I’ve heard about those, and I’ve also read the experts’ evaluation of them. In fact,” said Fred, waving a copy of a report in the air above his head, “I have a copy here. And I’d like to

text: highlight a few of the points the experts raised.”

text: “Please do,” said Ralph cautiously.

text: But there are still risks, e.g., “In the section on risks, the experts cite concerns about the data breaches and security of the e-health system and the prospects for breaches in

text: a system that would hold sensitive data on every person in the country. As an official of the finance ministry, I have grave reservations about the potential liabilities we could face if hackers were to penetrate a database with tens of millions of names. They could steal all those data or corrupt them or both. It’s not just hackers that could test how alert your officials are, but suppose

text: some of your staff get caught looking up the private medical

text: records of their favourite politicians, sports heroes, rock groups and film stars. I can just see the headlines in the tabloids now.” The loss of data on our citizens if such records were compromised would be disastrous, both for the lives of our citizens and their confidence and trust in our government.

text: Solutions, no matter how As Fred spoke, Ralph thought about possible solutions -- access good, have not stopped control procedures, a system that logs everyone who accesses

text: every file, audit trails, experts to test vulnerabilities. Such safeguards sounded okay on paper, but no system is flawless or

text: impregnable. No matter how good the security, it was just a

text: matter of time before someone would figure out a way to break it.

text: Who should have access to “Who is going to have the right to access all those electronic electronic health records? health records? Will it include insurance companies, employers, credit-checking companies? What about the Department of Motor Vehicles? Should they be allowed to know whether a prospective driver or some old fellow” Fred turned and smirked in Ralph’s direction “who wanted to renew his licence was medically fit to

text: have one?”

text: The risk of repurposing data “I also have concerns about how well officials in your (mission creep, function department”, here Fred pointed a long finger at Ralph, “could

text: resist the temptation to reuse all those data for some other

text: 10 EFR Pilot – “Being diabetic in 2011”

text: purposes not explicitly stated when the data are collected from patients and doctors. For example, I can just imagine officials in

text: your department dreaming up some new research schemes to

text: tantalise their university friends. Or indeed some health-care

text: company or department in the government may wish to collude

text: with you, being unable to resist the lure of being able to research cure or deliver more efficient health care. This sort of mission creep always worries me, not just because of the liabilities we could face, but also because it is always, I mean always, incipient

text: to growing bureaucracies.”

text: Informed consent is a “I agree,” Ralph responded, “There’s no doubt all those data will minefield of its own be a valuable resource, and that’s why we have instituted strict informed consent requirements. If anyone has any bright ideas

text: about reusing data, they must first get the data subject’s informed consent.” Even as he spoke, however, Ralph knew

text: “informed” consent was a minefield. First, there was a definitional issue – what did “informed” really mean and how practical would it be to get when you had to “inform” thousands, perhaps millions of data subjects in order to get their consent. The UK government tried going down the route of “implied consent”, but the Article 29 Working Party has said consent must be “freely given, specific and informed”. Ralph was also aware of the history of informed

text: consent, and the failures and the ways in which it could be

text: overridden for different purposes. Given the importance of trust in the system by citizens this could have disastrous implications for confidence in the entire project and the data being collected and stored.

text: Giving people the right to “All good questions, Fred,” replied Ralph, seemingly unperturbed. choose who could have “Everyone will have the right to specify exactly who should be

text: able to access their electronic health records. We will indicate problems. options and rationales for those options in everyone’s record, and

text: everyone will be able to review and change their choices

text: whenever they want.” While this sounded good, Ralph knew there were problems, somewhat like the informed consent issue – some people would not take the time to understand the choices or their

text: implications, some would be intellectually challenged and of

text: doubtful competence to make such a determination, others would forget to check the validity of their choices in six months or a year.

text: EFR Pilot – “Being diabetic in 2011” 11

text: The risk that the data will not “Okay, fine, but here’s another point. How can you ensure that be accurate the data in an e-health system will be correct? Lots of people

text: travel abroad on business or holiday and receive medical

text: attention while they are away from home. Isn’t it possible that foreign doctors might misinterpret the data in patients’ electronic health records or that our doctors misinterpret what those foreign doctors have done? Also there are already reports that our own health care professionals do not trust each other’s own entries in existing medical records, with local doctors complaining about hospital staff and vice versa. How are we to ensure standards

text: that everyone can agree on adhere to in recording patient information? Again, the ugly head of liability rears up.”

text: Relying on individuals to “Of course, that’s possible,” Ralph admitted. “Anything is ensure the accuracy of their possible, but we will minimise those risks by encouraging every

text: individual to review their electronic health records regularly and

text: every medical practitioner to do the same. We are also trialling

text: algorithms to automatically check for inconsistencies and

text: anomalies in the EHRs.” What Ralph did not say was how efficient

text: and accurate the results were from the use of these algorithms.

text: dubious. In practice, they were like facial recognition software – getting better, but achieving 100 per cent success ratios was an ever-

text: receding mirage. Yet Ralph was convinced that while

text: standardisation might be difficult it would be of benefit not only for this system but also across the health service in improving quality of care provided by health care staff and improving the experience of care on the part of patients. While e-health schemes “Based on what some of your experts have written here,” Fred might make economic sense, poked the report for emphasis, “I wonder how much support this

text: huge e-health scheme really enjoys among our fellow citizens – to public support. Otherwise,

text: whom we have fiduciary duty, I might add. While your report

text: emphasises the economic benefits of this scheme, we have to

text: wonder whether the concerns that groups have expressed about

text: problems and risks with the system outweigh these supposed

text: financial benefits.

text: Key stakeholders (doctors) Fred looked around the horseshoe-shaped conference table,

text: nodding at each delegate as if to elicit a similar response from

text: them. “Also, it seems a high percentage of physicians across the

text: country are worried about getting informed consent from their

text: patients before they enter any of their details into electronic between concerns.

text: health records for the delectation of your officials.” Fred

text: 12 EFR Pilot – “Being diabetic in 2011”

text: continued, “Indeed it is not just doctors that are concerned, patient groups are telling us they remain wary about shifting too much responsibility for care to individuals. Informed consent is key, yet even from your own report it remains difficult to see how you will balance these concerns in ensuring informed consent is

text: given?”

text: Informed consent is not “Quite right too,” said Ralph. “Informed consent is a prerequisite always possible. Fallback for initiating an EHR. Of course, informed consent is not possible

text: in some cases, for example, children or those suffering dementia,

text: so we have procedures for going to their guardians or legal

text: representatives.” Ralph does not volunteer information about

text: those procedures, because some experts have questioned their

text: patient?). adequacy and because he knows that the more stringent safeguards are, the more costly they are too. Any system suffers the risk of Fred wasn’t to be slowed down. “Another point the experts raise externalities. is this. Let’s suppose, against the odds and our better judgement that our political masters decide to go ahead with a full-blown ehealth system. Paper records get chucked. Everything is digitised. Suppose then we had a true crisis, for example, that the avian flu mutates further so that it is easily transmitted from human to human. Then, let’s suppose everyone is trying to get access to

text: the e-health system at the same time, and what happens? It

text: crashes. Then where are we. Also what happens if an individual’s own device fails: from your report there are many risks where this may occur, such as an individual incorrectly operating this device, what then will be our liability, or even the public outcry if

text: these technical failings lead to injury or fatality?”

text: Redundancy is no guarantee “Yes, that is a good point,” Ralph seemed to agree, but added, against systemic failure. “and that’s why we are building in redundancy and testing for

text: worst-case scenarios.”

text: EFR Pilot – “Being diabetic in 2011” 13

text: The risk of a conflict of Fred smiled, lifted the report as if he were inspecting the fine interest. print and then queried: “Finally, among the pilot projects

text: mentioned here is one on remote health monitoring and

text: treatment that involves employees in your department. Did you know that? How are we to trust the conclusions of this report then, is it not in the interest of your departmental officials to

text: ensure the scheme is adopted?!”

text: Ralph makes a valid “On the contrary,” said Ralph. “Our minister encouraged all response, however, the employees to take part. He felt that if we were going to sponsor a

text: national e-health system, then all of us should have first-hand

text: experience with it. I agree and that’s why I too volunteered to misinterpreted.

text: take part.”

text: Remote health monitoring “In fact”, Ralph chuckled, “I am wearing a special vest embedded and treatment, using special with various biosensors.” He ignored the scattered giggles from

text: the other delegates and carried on with his explanation. “The

text: sensors are part of what’s called a body area network. They

text: monitor my vital signs and my watch collects the data and then

text: transmits it to a data collector hub which encrypts this

text: could afford such special information and then transmits it over the Internet to my items, but will everyone? physician. In fact, she’s quite pleased that I’m taking part in the trial, because I have type II diabetes and, as you can see, I’m overweight, this system helps with my condition and the regular monitoring has helped me keep to an exercise and proper diet, for which my family is quite thankful” Ralph patted his tummy, and his fellow delegates, most of whom were also overweight, laughed appreciatively.

text: of monitoring and treatment “Like many of my generation,” he added, “I suffer from high will short-change blood pressure and diabetes. I regret to say that monitoring and prevention? treating me and others of my cohort account for quite a high percentage of the national health budget. In fact, it’s one of the If there are delays in reasons why I’m personally keen on the new e-health scheme.

text: You might not believe this, but I’m convinced that in spite of the

text: high start-up costs, the system will pay for itself within five years

text: 8 maximum.” Ralph thought back to predictions of this made in longer. 2009 when a colleague of his from the UK spoke of his national

text: 14 EFR Pilot – “Being diabetic in 2011”

text: health service spending over one million Euros a day on care and treatment of Type 2 Diabetes with 4% of the population affected. Things had not improved since then .

text: Like most technologies today, Fred was curious. “What happens if you send your vest to the there is a risk of loss, theft dry-cleaners and they damage the sensors or they lose it and accidental damage.

text: altogether or give it to another customer by mistake?”

text: Ralph chuckled. “No, the sensors are quite impervious to the

text: laundry, and I’ve never lost it. But even if I did, the manufacturer guarantee to the future. has told me that the costs of these garments will be only slightly

text: more in comparison to vests without the sensors.”

text: “Is there anything else you have to do in this project besides wear a special vest?” Fred appeared genuinely interested. His normal sarcasm seemed to have evaporated. Health monitoring and “A few things. I have to follow the treatment regime prescribed treatment cannot eliminate by my doctor – which means doing some exercise every day. I go

text: for a brisk walk, and I come to the gym to work out on the

text: maintain an online health journal.”

text: “Oh, yeah? What’s that? That sounds a bit of bore.”

text: “No, it’s not actually. It’s like keeping a journal as well as recording measurements. But I like to be able to read and have a sense of control over my own medical information. I also make

text: sure the data collection hubs in my home and office are functioning. My care centre also sends daily reminders to my

text: mobile to make sure I take my medication. I have to respond to

text: those. That’s more or less all I have to do.”

text: EFR Pilot – “Being diabetic in 2011” 15

text: E-prescribing is a good idea “My physician was willing to participate in the pilot project, to see but only a tiny percentage of how it might make her own practice more efficient and less error-

text: 10 prone.”

text: “Less error-prone? How do you mean?”

text: “Well, for example, all her prescriptions now are made

text: pharmacy and sends me a copy. I don’t have to hang about at

text: the pharmacy either. The prescription is there, ready for me to pick up. Also because my health record is viewable by me at any time I can also review my doctor’s comments. Also because they are standardised should I be treated by any other doctors I can review and understand their comments much easier as well. I feel much more in control and involved in being responsible for my

text: health and well-being”

text: If a paramedic could get a Ralph carried on: “I have an updateable health card, which has reading off Ralph’s health my personal data and latest health emergency data. So if I travel

text: somewhere and fall ill, I could just present my health card or,

text: heaven forbid, if I was in accident and fell unconscious, then the too. paramedics could just dig out my card and get a reading off it to know whether I am allergic to anything, penicillin, for example.” Ralph stopped and looked at the delegates one by one, as if to make sure they understood what he was saying. Fred interjected

text: however, “Doesn’t this mean however that you depend on these

text: places to also be digital? What happens if no electronic record is kept of this treatment?”. “This is a concern of course, but it is also a question for our partner countries as our frameworks must be interoperable at some level” replied Ralph.

text: A history of failures and Some delegates nodded, others began talking to each other. delays undermine the Ralph and Fred could see that everyone was tired; it had been a

text: long day of duelling, of thrusting and parrying, but neither

text: opponent had made a decisive cut. It was time to call it a day.

text: Ralph glanced towards Fred, who was just answering a clearly

text: unsettling call, judging by his heavy frown and his loosening the knot of his tie. Fred’s face turned ashen. “I’m on my way,” he said to the phone. He turned to Ralph and then to the delegates and explained tersely. “It’s my father. He is a diabetic and just

text: 16 EFR Pilot – “Being diabetic in 2011”

text: had a stroke and is in a critical condition at the hospital”. It seems he was walking outside his village and he collapsed. There

text: was some delay before anyone found him. He had no way of

text: communicating his condition….” Fred’s voice trailed off,. “I’ve got to go,” he said, “I’m sorry.” As he opened the door to leave, he turned and said, “If my father had been wearing a vest like yours, Ralph, perhaps he would have had the warning he needed before

text: falling ill.”

text: A sad event triggering some The next day, the last of the conference, Fred did not show up, thoughts... but he had left a message for the participants, which the

text: chairman read out: “The problem that confronts my family

text: prevents me from joining you today. It has become apparent to me that if my family had been using some of the technologies we

text: have been discussing the last two days,” – a murmur went

text: though the conference room as the chairman read these words – “this incident may have been avoided and I could have been with

text: you today. I wish you well in achieving a consensus.”

text: Caution seems to be the The chairman having read the message, eyed Ralph and raised prudent answer at this point: his eyebrows. Ralph cleared his throat and stood up. “Dear all, I

text: will be brief. First, though, I move that we send a unanimous

text: message of support for the difficult family situation faced now by

text: Fred.” Everybody nodded. Ralph went on: “We have had two days

text: of animated discussion, but we seem not to have reached a consensus. You have heard many pros and cons, benefits and risks arising from e-health and remote health monitoring and treatment. While the benefits seem laudable, as Fred has now acknowledged under unfortunate circumstances, I find that I

text: cannot just brush aside Fred’s concerns: the costs, risks and history of delays and failures of other similar systems cannot be overlooked.” He paused as if reflecting upon the irony of the situation: he had convinced Fred, but Fred had convinced him. He then said, “Perhaps caution is the best approach just now. Maybe we need to assess whether, in addressing some problems, we are creating others of a different nature, whether cost over-runs and delays would fatally undermine the credibility of the system.” Ralph sat down and slowly began cleaning his glasses with the end of his tie.

text: The chairman assented with a slight smile as delegates decided against immediate implementation, but in favour of more detailed studies of the risks.

text: EFR Pilot – “Being diabetic in 2011” 17

text: The risks

text: This section lists major risks, also mentioned in the preceding cautionary tale that were identified based on the scenario of the EFR pilot and which Ralph and other stakeholders might encounter in relation to remote health monitoring and treatment services. Some of these risks affect only the individual (e.g., Ralph), while others could affect all users. The risks mentioned in this section are listed according to their risk level (high), impacts and probability. The risks were identified in a collaborative effort by ENISA, representatives from its EFR Stakeholder Forum and external subject matter experts.

text: 1. Failure to comply with informed consent legislation

text: An e-health system will collect lots of data about citizens and it may be difficult to know precisely who should have access to those data, for what purposes and when the citizen‘s informed consent should be obtained. Even the notion of what constitutes informed consent could vary according to the circumstances of specific contexts. In some cases, informed consent could be intrusive or difficult to obtain. This also in turn poses challenges for data protection, the secondary uses of data and how to comply. There is the perception as such that medical data is different from other personal data, often in the eyes of both governments in member states and citizens of member states.

text: 2. Failure to comply with data protection legislation

text: A failure to comply with data protection legislation, such as the European Data Protection Directive (

text: ) and the e-Privacy Directive (

text: ), may happen because someone is not aware of what their obligations are. Furthermore, while Member States have transposed the Directives, there are variations in the way they have done so.

text: 3. Data breaches

text: There is always a risk that the confidentiality or integrity of the patient‘s data could be breached. Evil-doers could eavesdrop on communication between the patient and a doctor or steal or otherwise appropriate personal data. Evil-doers could, of course, be ―insiders‖. In addition, officials and patients may be negligent or careless or insufficiently careful in handling personal data and may lose such data.

text: Someone without authorisation, who could be an insider, could gain access to Ralph‘s personal medical data, modify or delete the data because the access control measures are inadequate, because the data have not been encrypted or otherwise secured. Likewise with such an amount of data being collected and stored, and the different levels of access as well as the number and variety in actors who have access to all or parts of the data, then the risks of accidental loss increase exponentially. Loss of data through accidental or mere incompetence in respecting data protection regulations are well documented across the EU.

text: 18 EFR Pilot – “Being diabetic in 2011”

text: 4. Repurposing or secondary use of data (mission creep)

text: An e-health system or some component thereof, such as a remote health monitoring and treatment system, will collect and store an enormous amount of data. Because those data exist, there will always be a strong temptation to use them for a purpose different from that for which the data were originally collected – which would be a contravention of the European Data Protection Directive (

text: ). Such repurposing of data need not always be for nefarious reasons. Sometimes, it could be as ―innocent‖ as researchers‘ wanting access to the data for purely scientific reasons which could result in successful treatment of a heretofore intractable disease, for example.

text: 5. The user could be compromised

text: Ralph might use his equipment in an unprotected environment or over an unsecured communication channel. The e-health system might not be able to authenticate him and, consequently, would deny him service.

text: 6. Equipment is damaged

text: Ralph‘s equipment could be damaged in a multitude of ways, through negligence or carelessness or accidentally or because he might use it in an inappropriate way because he is not aware of certain system requirements. It is unlikely that Ralph would use his equipment in an unprofessional way, but some users might.

text: 7. Disruption of the service

text: Some flaws in the system design and/or infrastructure could lead to a malfunction or breakdown in the system, thereby disrupting service to users. Adding new functionalities to system design can also lead to delays in implementing new systems.

text: A natural event, such as a hurricane or earthquake or forest fire, could damage the infrastructure on which the remote health monitoring and treatment system depends.

text: Ralph might find that his device or the system itself fails when it becomes overloaded, because the device is of low quality or the system infrastructure is not robust enough to cope with periods of heavy demand.

text: 8. Theft

text: There is always a risk that someone might steal Ralph‘s sensor-embedded garment, health card or other information technology which he uses to take advantage of the remote monitoring and treatment service. The cost of the garment and/or user device might be relatively low, but the theft might happen at a critical time when he is very dependent on the devices, so that a loss of even a day or less could put his health at risk.

text: EFR Pilot – “Being diabetic in 2011” 19

text: 9. Inadequate provision or availability of medical services

text: The remote patient monitoring and treatment service may not be available everywhere, at least, not at the same level of service. This could conceivably occur and be problematic at a number of different geographical levels, for example within the member state, between different member states and between the EU and other regions and external countries.

text: 10.Human error in emergencies

text: Human error can occur anywhere at any time, but the ramifications are greatest in emergencies, exactly the time you don‘t want them to happen. Human error in times of crisis is problematic but given that adoption of the system may be widespread the risks of ‗routine‘ errors precipitating crises must also be considered.

text: 11.The patient might misinterpret the data

text: Ralph might misinterpret the data generated from his device or from the e-health system or his physician. Not everyone is as computer literate, intelligent or endowed with common sense as Ralph, thus, the risk of their misinterpreting data is that much greater. The data may be too complex or incomplete for Ralph or other patients to understand properly. This risk will be greater if more responsibility is shifted to the patient for maintaining his or her own electronic health record and, more generally, their health.

text: 12.Medical staff might misinterpret, modify or delete patient data

text: Given the inevitability of human error, there is always a possibility that someone with authorised access to Ralph‘s data might misinterpret, modify or delete them, either intentionally or accidentally. This could be due to flaws in the system or a user‘s lack of knowledge or the complexity of the data or a mistake in the data.

text: 13.Users may not follow instructions

text: Users may not follow instructions because their equipment is not user friendly or their treatment may depend too much on other components of the e-health system or they may simply forget to take their medication (or may not want to).

text: An evil-doer or even someone who isn‘t aware of the implications of what they are doing might use Ralph‘s monitoring device without his or anyone else‘s authorisation which, in turn, could result in the device performing badly.

text: 14. Data surveillance and profiling

text: Insurance companies, employers, credit-checking companies, researchers and/or others may successfully engage in data surveillance (aka dataveillance) and profiling because Ralph‘s data have not been secured well enough or because access control measures are weak or are too ―porous‖ (i.e., they do not do a good enough job in filtering out those who shouldn‘t have access to the data from those access is legitimate). A part of the problem here is the incidental data that might be gathered from the sensors. The most obvious of

text: 20 EFR Pilot – “Being diabetic in 2011”

text: these would be location, knowing the location of the patient in times of emergency is a critical element of the system yet knowing the location of the person at any given time could be of interest to example law enforcement actors investigating crimes. As with any form of data collection, and given the amount of data such systems will collect, it is also difficult to predict what uses or value data might have after it has been collected. Future scenarios might occur where data was then re-used for a purpose the system was not designed for.

text: EFR Pilot – “Being diabetic in 2011” 21

text: What are we trying to protect?

text: This section identifies the assets that we are trying to protect against the risks mentioned above. Those ―assets‖ may be tangible or intangible, owned by Ralph or his doctor, hospital, health care call centre, the National Health Service or others. Assets include any devices, technologies, applications, processes, data or anything of value to the individual, organisation or, indeed, society. Some assets are more valuable than others, of course, and those values may vary over time and/or according to the context. A glass of water may not have much value for most of us, but for the straggler crawling across the desert; it might be of enormous value. Similarly, aspirin is as cheap a medicine as exists, yet for the person suffering from an incipient heart attack, 300 mg of aspirin can make the difference between life and death. Assets have vulnerabilities which can be threatened or attacked . Risks may have impacts on business operations resulting from unauthorised disclosure, modification or repudiation of information, or unavailability or destruction of information or service.

text: Identification of assets may seem straightforward at first, but in practice and as is detailed in the scenario analysis is more complicated after a sustained examination is made. After discussions within our working group, we agreed that in the context of our scenario, we are aiming at protecting the following:

text:  Health and life – refers to the physical and psychological condition or well-being of an individual and the absence of disease. Inadequate protection will result in deterioration of an individual‘s health and may even lead to loss of life.

text:  Human rights and social values – includes privacy, non-discrimination, dignity, social inclusion and e-inclusion, trusted human relationships, etc. They are important to us all as patients, individuals, family members, friends and to society. Persistent violation leads to a dysfunctional society, crisis and a breakdown in social order which in turn can lead to health problems which are psychological as well as physical.

text:  Autonomy – A person, like Ralph, who is afflicted with a disease or disability (in his case, diabetes and high blood pressure, which greatly increases his risk of a heart

text: 22 EFR Pilot – “Being diabetic in 2011”

text: attack or stroke), can regain a measure of autonomy through the use of technologies as mentioned in the scenario. On the other hand, becoming dependent on monitoring technologies can be seen as a threat to autonomy.

text:  National healthcare system – provides healthcare and medical services to people at a reasonable cost. Poor or improper provision of services could lead to a deterioration of citizens‘ health and/or to loss of life.

text:  Mobility – refers to the ability and potential of people (individuals, patients, doctors, health professionals) to move across countries and be provided with comparable quality of healthcare and information society services wherever they are.

text:  Personal data – has at least two values, one that Ralph (or we) ascribe to his (our) own data and second, the value that someone else ascribes to it. That ―someone else‖ can be a friend or a foe, a bureaucrat routinely gathering tax or health or demographic data as part of his job or an enterprise fuelled by personal data, needing to ―personalise‖ the products or services they market to us or an evil-doer who wants our data to exploit them, to siphon off the savings from our bank accounts or to make large purchases in our name or to spam us about stuff we neither need or want. Ralph‘s personal data, like ours, can be found in a number of places – in his electronic health record, health journal, health card, his own laptop, in hospital databases, in his local pharmacy, in his doctor‘s files as well as in hundreds of other places (banks, insurance agent, tax department, local Council, etc.) The more places in which our data can be found, the greater is the number of people we can assume have access and the greater the risk is that someone will misuse or abuse our data.

text:  Health cards – contain encrypted data used for authentication, possibly also for digital signatures. Each individual has his own health card. While the identity information on the card cannot be altered, the medical information can be and is expected to be read by doctors or paramedics (especially in an emergency) who, if necessary, can verify the medical data stored on the card by means of a medical examination.

text:  Health monitoring devices – include items such as Ralph‘s vest embedded with biosensors. They measure blood pressure, weight, blood glucose levels and other parameters and send data to a home hub which in turn relays the data to a patient monitoring call centre. The integrity and quality of the supplied measurements must be reliable, otherwise faulty measurements have the potential to seriously affect the health or even life of the patient.

text:  Personal information technology equipment – includes items such as laptops or workstations, digital cameras, telephones and videophones. Patients, doctors and health practitioners use these as access points to the monitoring and treatment service and to enable tele-consultations. They may contain personal and sensitive data.

text: EFR Pilot – “Being diabetic in 2011” 23

text:  Data centres and call centres – are the nerve centre of the monitoring and treatment service. Data centres are independent organisations which manage medical data on behalf of a hospital or health plan and are tasked with ensuring security, privacy and resilience as a trusted third party. Call centres are typically staffed by nurses and other health care practitioners, who create patient monitoring reports for Ralph, his physician and others like them with similar needs and who are authorised to access the data or reports derived from it. The call centres respond to alarms triggered by Ralph‘s biosensors‘ detecting any abnormalities in his health signs. They would notify Ralph, his physician, emergency services and possibly next of kin. The call centres operate a Remote Patient Monitoring (RPM) Service and Disease Management Program, which may be regarded as the core service described in the scenario, i.e., monitoring and treating patients remotely. If this asset (a viable service) were compromised or disrupted, it could mean no care for Ralph and others like him, which in turn would undoubtedly lead to serious health problems for many and significantly damage trust and confidence in the system.

text:  Electronic health records (EHR) – contain health information including prescriptions and personal data inputted and confirmed by health professionals. EHRs may also contain personal data automatically gathered by sensors (including patient location). In theory, EHRs are confidential, but sometimes law enforcement authorities (for example) will seek access to such data to help in solving crimes. In Sweden for example, the national biobank was supposed to be off-limits and its informed consent procedures were based on this premise, yet police gained access and were able to retrieve the data needed to locate and identify the killer of Foreign Minister Anna Lindh who was fatally stabbed in a Stockholm department store in 2003. Some experts have estimated that today‘s health records are seen not only by the patient and his or her physician, but also by hundreds if not thousands of call centre, hospital, medical and administrative staff as well as others such as those in pharmacies, insurance companies, our employers, etc. Electronic health records will increase the ease with which such data can be accessed and probably the numbers of people who can access them as well as increase the number of places where data can be accessed.

text:  Health journal – used to record health measurements and personal data, analyse trends and provide feedback. Data entered by the patient and health monitoring call centre are reviewed by doctors. Some of the data can be consolidated and accepted into the EHR.

text:  Electronic prescriptions – will do away with doctors‘ notoriously difficult-to-decipher hand-writing. Doctors will send prescriptions directly and electronically to pharmacies,

text: 24 EFR Pilot – “Being diabetic in 2011”

text: insurance agents for reimbursement and, if necessary (for example, if the patient was hospitalised or fell ill in another country) to the patient‘s own physician. The eprescriptions could include some personal data and a summary of the diagnosis to justify the prescription.

text:  Public health research data – preferably easily available and in abundant quantity, are needed for epidemiological research. An e-health system would greatly facilitate the research efforts of public health research institutions and governments. Consent procedures would have to be clear on this, and sufficient data protections would need to be in place and respected in order to remove all identifiable data from the records to be used in such research.

text:  Hospital information technology systems – store electronic health records and exchange data with the call centre, physicians and emergency services.

text:  Networks – are the backbone of any service provided to or on behalf of people. The basic (fixed) communications network enables telephony and data exchanges and so do the mobile phone neworks. New wireless networks have been emerging in recent years, e.g., WiFi and WiMAX. Networks employ a range of technologies including the venerable twiseted copper pairs, coaxial cable, fibre optic cable, radio waves, satellite and so on. Networks can be disrupted easily and too frequently , but usually (but not always) there is adequate redundancy or alternative routings to solve most such disruptions.

text: EFR Pilot – “Being diabetic in 2011” 25

text: Methodology

text: As mentioned in the introductory section above, during 2008, ENISA worked on building a framework to identify emerging and future risks (―EFR Framework‖).

text: The framework follows a scenario-based approach, where scenarios are used to present a particular case of the chosen technology and/or application and/or topic in order to identify the emerging and future risks. Once identified, the scenario data are subsequently analysed by using existing risk assessment methods. The following diagram presents a high level overview of this approach:

text: Subject Matter Experts 1 2 3 4 EFR Stakeholder Forum

text: Figure 1: High level overview of the EFR Framework

text: In the beginning, the topic, namely the particular technology and / or application to be assessed is selected, based on proposals we receive from our stakeholders (industry, academia, Member States, EU Institutions). After the initial identification of the topic, the scope will need to be defined, as well as which areas to target in the possible scenario

text: 26 EFR Pilot – “Being diabetic in 2011”

text: (especially if the topic, technology selected is too broad) . In the building of the scenario, the following items need to be considered and specified (please refer to Annex I):

text:  An introduction – provides an overview and background for the scenario.  The scenario – includes the scenario ―script‖ or story or the imagined future as well as a set of assumptions underpinning the scenario.  Framing the scenario – is a way of deconstructing the scenario into its component elements on the basis of which an analysis can be made of the issues raised by or implicit in the scenario. The key elements are : - Timeframe – How far into the future is the scenario situated? - Location – Where does the scenario take place, not only in geographic terms but also in its social context, e.g., in the home, at work in the community, etc.? - Actors – Who are the principal actors in the scenario? Whom do they represent? - Technologies and/or devices – What technologies or devices are used in the scenario? - Applications – What applications are referenced? - Data – What data are collected, for what purpose and who has access to them? Are the data repurposed or shared or passed on to third parties? - Drivers – What impels the actors? What are their motivations? What social, political, economic or other forces create or drive the situation described in the scenario?

text:  Analysing the scenario – The scenario is at this stage further analysed in order to identify, ―extract‖ all the elements needed in order to proceed with the risk assessment and management. The elements to be identified in this phase are: - Assets (tangible and intangible) – What assets are mentioned or implicit in the scenario? - Vulnerabilities – What vulnerabilities are apparent or can be perceived in those assets? - Existing controls – What controls appear to be in place or could or should be put in place to safeguard the assets, especially in terms of their vulnerabilities? - Threats – What threats are referenced in the scenario or are implicit or can be imagined? - Impact – If the assets are attacked or compromised in some way, what would be the impacts? - Acceptable risk level – Given the probability of a risk and its potential consequences, what is regarded as an acceptable level of risk? - Assumptions – What assumptions have been made or seem apparent in the scenario analysis, e.g., in terms of the vulnerabilities, threats, impacts and risk acceptability?

text: The report at Annex I show how this structured analysis works in practice.

text: EFR Pilot – “Being diabetic in 2011” 27

text: After an initial identification of the elements described above, we proceeded further with a more in-depth risk assessment. Any risk assessment methodology can be used at this stage, since the elements identified above are generic and may be used with the majority of the risk assessment methodologies. For the purposes of our study, we used the EBIOS Risk Assessment methodology, appropriately assisted by EBIOS experts from Logica, France. The result of these activities was basically a list of possible risks posed by the technology and/or applications under study; furthermore, controls may be identified and recommended in order to address those risks.

text: The principal steps taken by the EBIOS experts to identify and assess the risks were the following:

text:  Formulating the risks – For each threat, a risk has been produced. In this study, each risk has its own box, which lists the vulnerabilities that can be exploited and security criteria concerned by the risk, and the affected assets. The following steps complete the details for each risk box.  Valuating assets and setting of tolerance levels - Assets are assigned a value and the risk tolerance levels are set, which corresponds to the risk levels we are willing to accept, without implementing any measure or control to address the risk  Calculating the probability, the attack potential, the opportunity and the probability according to EBIOS methodology in order to evaluate the vulnerability and threats.  Identifying and valuating the impacts  Determining the risk level

text: For the full risk assessment report produced by the EBIOS experts of Logica (please refer to Annex II).

text: 28 EFR Pilot – “Being diabetic in 2011”

text: Annex I: EFR Pilot – Scenario Building and Analysis Template

text: Please refer to accompanying document.

text: EFR Pilot – “Being diabetic in 2011” 29

text: Annex II: EFR Pilot – Risk Analysis Report

text: Please refer to accompanying document.