We, the members of IT Voice, wish you Happy New Year!

The Hong Kong Government's proposal for the 2012 constitutional arrangement has fallen short of our people's aspirations for universal suffrage and true democracy. Ghost of functional constituencies past, present and future just wouldn't go away. How much longer can Hong Kong wait?



On January 1, 2010, IT Voice invites you to walk hand in hand for democracy, for the future of our next generation.
Assembly Time: 2:30-2:45pm
Assembly Place: MTR Exit J2, Central Station (next to Chater Garden)

IT Voice will also organize an open forum in January for the IT sector to discuss the proposal in the Government's constitutional reform consultation. Please stay tuned.

Once again, we wish you and your family peace, health and happiness in 2010.

IT Voice*
http://www.itvoice.hk

* (From left) Chester Soong, Dr Robin Bradbeer, Charles Mok, Sang Young, Francis Fong, Prof Joseph Ng, SC Leung, Lento Yip, Dr Joe Yau, Edmon Chung

Google Public DNS -Security & Privacy Analysis

Author: S.C. Leung
Google announced provision of free Google Public DNS service [1]. It is now in experimental stage targeting individual user only. Google Public DNS service is part of Google's cloud computing initiative to make Internet services available anywhere at any time.

It has a far reaching impact to the Internet after Google goes into the search engine business. Here is my preliminary analysis from information security & privacy perspective.

Performance and Availability
With the vast and distributed points of presence, clients are able to obtain more speedy and more resilient DNS services via geo-location awareness load balancing (technically using anycast), cache and prefetch name resolution. [2]

Comments: Just as the GMail service, Google has a wonderful resilience in infrastructure that corporations cannot generally afford. However, Google has no commitment on service level and you are always advised to have a secondary DNS pointing to your own ISP or internal DNS server.

Security
Google Public DNS has designs against spoof attacks leading to DNS cache poisoning. [3]

• filter out malformed queries and responses.
• use more randomness of source ports and responding DNS servers
• randomly vary the case of letters in domain names queried by "0x20 technique" [4] to reduce chance of spoofed response.
• remove duplicate name queries are removed to mitigate birthday attacks (spoofed flooding response to increase chance of hit)

Google Public DNS has designs against Denial-of-service (DoS) and amplification attacks [3]

• rate limiting of outgoing queries to name servers
• rate limiting of outgoing responses to clients

Comments: These security measures are very carefully designed to combat the most current DNS attacks. Note that, however, there is a limitation in Public DNS. It can only accept and forward DNSSEC requests but CANNOT validate DNSSEC responses. When DNSSEC is popularizing we need to keep an eye on this.






Privacy
Everyone knows that a log of you DNS queries is merely the same as a log of your web access habit without the content involved. Another Google service Safe Browsing was challenged by a researcher RSnake of potentially infringe clients' privacy by collecting client machines' browsing history[5]. Will that happen to Public DNS? What does Google log?

The Privacy Policy [6] specifies that they stores two sets of logs: temporary and permanent. Temporary logs (kept within 24-48 hours) store the user's full IP address so that Google can spot potentially bad things like attacks and fix problems like particular domains not showing up for specific users. The permanent log has no personally identifiable information or IP information but user's geolocation and ISP (AS number). Google will not correlate user's use of other services, like Search and advertisement.

Comments: The Google privacy policy has looked into the privacy concerns properly. However, as in cloud computing, how can they provide the transparency to assure the privacy policy is followed closely. Secondly, we also need to take into account the overriding conditions that may apply if Google is asked to cooperate with law enforcement agencies or authorities. Google not only keep track of everything you search, but every address you are visiting. Depending on which country you live in, government agencies have various powers to compel online service providers, such as Google and your ISP, to give them whatever information they might have about your identity and activities. For US, the post-9/11 Patriot Act made it easier for law enforcement agencies to get this information. Other governments will learn to get have access to such widespread surveillance powers for reasons they see fit. [7]


Other Comments

1. We need to be aware that DNS server is a key infrastructure for the directory of information on the Internet. Controlling DNS can directly control information access. Moreover, if a client cannot access an information repository, he has no knowledge if that information repository is unavailable or the name resolution is denied by the DNS server. So a key for freedom of information access is to guarantee that Google does not implement any kind of filtering without user authorization. Google has acknowledged this [1] but should have more transparency on this.

2. As with Google's Safe Browsing service, Public DNS can be used to filter against malware and phishing. It could be a future revenue stream, like Google's competitor OpenDNS. Besides, similar technology can be applied to pornography and gambling filtering for parental care. Once filtering is added, we have to look at how these services could impact freedom of information access and privacy.

3. Fast flux DNS technology is widely used by botnets to provide dynamic DNS resolution of malicious web sites to evade investigation. With Public DNS, Google can play an active role in malware and botnet detection through analysis of the DNS server responses. The information would be very useful for the security community.

4. Last by not least, I like to point out the importance of diversity as commented by the CEO of OpenDNS[8]. From Chrome OS at the bottom, to Chrome browser, and to Google Search at the top, Google is running the end-to-end infrastructure. Google is the largest advertising company in the world. Do we want Google to keep control over so much of our Internet experience? How can we preserve a heterogeneous Internet with lots of parties collaborating to make this thing work.


Back to Top

Reference:

[1] Google Gets Into The DNS Business. Here’s What That Means"
http://www.techcrunch.com/2009/12/03/google-dns-opendns/

[2] Google Public DNS: Performance Benefits
http://code.google.com/speed/public-dns/docs/performance.html

[3] Google Public DNS: Security Benefits
http://code.google.com/speed/public-dns/docs/security.html

[4] Use of Bit 0x20 in DNS Labels to Improve Transaction Identity
http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00

[5] Google Safe Browsing Feature Could Compromise Privacy
http://www.darkreading.com/security/privacy/showArticle.jhtml?articleID=218800199

[6] Google Public DNS: Privacy Policy
http://code.google.com/speed/public-dns/privacy.html

[7] You Have Zero Privacy Anyway -- Get Over It
http://www.osnews.com/story/22603/You_Have_Zero_Privacy_Anyway_--_Get_Over_It/

[8] Some thoughts on Google DNS, by David Ulevitch, Founder of OpenDNS
http://blog.opendns.com/2009/12/03/opendns-google-dns/

香港會計師甄文星、梁繼昌、韋志堅 : 聯交所諮詢文件 ，拱手相讓國際金融中心地位

幾位香港會計師挺身而出，對聯交所建議中港互認對方的會計準則及核數師諮詢文件提出意見， 頗值得參考。香港有會計師對諮詢文件其實頗有意見，但礙於不想得罪有關方面或影響生意，不敢挺身而出。

我支持國內專業來港發展，但須符合本港標准、經過評核和接受監管，這樣香港可以在協助國家專業人士提高水平、和國際接軌上作出貢獻。香港若作出遷就，讓國家專業人士繞過關卡，反而會降低本港專業水平的國際認受性，對本港和國家均有負面影響。

此事關乎整個香港的專業水平和其獨立性，各專業界不宜忽視。 試想類似的情形在法律、醫學、工程、城規和精算等專業領域可能陸續發生，可能會全面沖擊香港專業的國際地位。

-----------------------------------------------------
甄文星、梁繼昌、韋志堅 : 拱手相讓國際金融中心地位
2009年 11月19日 刊 明報

URL: http://www.procommons.org.hk/?p=2828&lang=zh


聯交所於今年8 月28 日刊發諮詢文件，建議中港互認對方的會計準則及核數師，有關規則修訂建議於2010 年1 月1 日生效，並適用於明年1 月1 日或以後開始的年度會計期間。有關建議乃由中港各監管機構聯手研究，當中有聯交所、財經事務及庫務局、香港會計師公會、證監會、財務匯報局、中國財政部及中國證監會等。

換言之，建議於明年初開始實施後，在內地註冊而在香港上市的公司（ 即H股），可選用國內註冊之會計師處理新上市的申報或上市後之每年審計工作。同樣，香港註冊或在「公司註冊處」有登記的本港上市公司，將來如在內地上市，亦可用選用香港註冊的會計師。

截至去年底，在香港上市H 股（主板加創業板）達150家，佔香港市場總值27%及成交額的49%，它們原本是用香港註冊的會計師，但若將來內地企業可選擇採用內地註冊的會計師，那明顯不利於香港會計師。相反，距離內地推出國際板或紅籌回歸A 股仍然有一段時間，短期內香港會計師會有何得益？出奇地，此文件在市場上並沒有大迴響。

誰來監管

雖然有論者認為新政策有助中港兩地交流，說中國自2007 年1 月起已採用與國際會計準則基本趨同之內地會計準則，聯交所接納內地核數師是合情合理的事。但新政策衍生多個問題，最明顯是對監管制度的憂慮。將來在港上市的H 股採用內地會計師審核財務報表，而其內地的會計師卻不受任何香港監管機構監管，出了問題也投訴無門，聯交所最多只能查詢或停牌。2007 年7 月成立的財匯局，理論上可調查本港上市公司的核數師審計帳目不當行為或查詢上市公司的財務報告未有遵從會計規定，但由於內地會計師在國內，財匯局也無權調查，只可要求中國財政部及中證監協助。

國際慣例

至於其他國際金融中心交易所如何處理非本國註冊之會計師呢？紐約、倫敦、東 京、澳洲交易所等，他們認可的會計師均需在本地註冊並受監察（Oversight）（參聯交所諮詢文件附錄三，第39 頁）。那麼，我們為何不修訂《專業會計師條例》，使那些中國「獲認可」的會計師在港註冊，受香港法律監管，卻反而提出由證監會行使其豁免權，准許「獲認可」的內地會計師事務所擔任《公司條例》附表三所指的申報會計師（參聯交所諮詢文件第12（f）段）。哪種處理方法更符合國際慣例，請讀者判斷。

核數師質素

對於其他協助公司上市的專業人士，如保薦人等，接納內地核數師，對他們亦不無疑慮。《上市規則》規定保薦人要對企業進行盡職審查，過程中需依賴會計師提供企業的資料。如資料提供是來自一家保薦人不熟悉的內地會計師行，保薦人是否有足夠信心？再者，保薦人要對內地會計師行進行更詳細盡職審查談何容易？其實諮詢文件本身也指出，仍未有足夠資料提供有關執業審核、質檢制度及對內地會計師事務所的監察和持續監管的等效情况（參聯交所諮詢文件第63 段）。那麼現時提出諮詢是否成熟？又何須急於明年一年便實行呢？

本港的上市標準一直達到國際水平，這亦是本港維持國際集資及金融中心的基 石，他日H 股採用內地會計師審核的財務報表，國際投資者能放心嗎？新政策背後的種種想法，究竟是香港會計師數量不夠，要加入內地「生力軍」，抑或是本港會計師收費太貴？又或是根本此乃聯交所的商業決定，藉以協助企業節省成本，從而吸引更多內地企業到聯交所上市？

香港過去的成功，一直賴以嚴謹的法規、高質素的人才及有效的辦事效率等。新機制並不能將這些成功因素帶給內地，相反只會令香港失去競爭力，令年輕一代失去就業機會。

若要配合中央頒布的「關於加快發展中國註冊會計師行業」的政策，及讓大型國企可聘用內地核數師以保密國家敏感資料，那大可讓內地核數師到港註冊，讓他們吸收國際經驗，而香港又可繼續保持其國際金融中心地位，何樂而不為？

作者是公共專業聯盟執委委員、香港會計師公會會員

IT Voice Responeded to review of the Personal Data (Privacy) Ordinance

IT Voice had submitted our response to the review of Personal Data (Privacy) Ordinance, i.e. PDPO. This article provides a highlight of 3 of the 21 responses. The full paper can be downloaded at here.


IT Voice agreed that we need to balance business interests and individuals' rights. At the same time we need to take into account the Hong Kong context, with a weak consumer community and the lack of class action in litigation.

Regulation of Data Processors and Sub-contracting Activities

• specific obligations should be imposed on the data users by requiring them to take specific security measures when contracting out the processing of personal data to third parties.
• the scope of inclusion should be clearly defined and restricted to penalize only negligent parties but not ignorant parties. Internet service providers and online service provides who are only providing conduits or platforms for data communication and storage do not know the nature of data passing through the conduits or stored in the platform.

Personal Data Security Breach Notification

• We propose the mandatory notification of personal data security breach. Voluntary disclosure practices will not create a fair playing field for organizations and will not be effective
• We propose that large data breach be reported to PCPD who should keep a database of data breach of previous 7 years for public enquiry.
• The notification of breach should be implemented in two phases according to risk level and nature of business. Government, public institution, critical infrastructure, financial and regulated industry should implement first while other sectors follow in second phase which is 3 years after start of first phase

Territorial Scope of the PDPO

• IT Voice urged Government to enact Section 33 of PDPO which provide that cross border personal data flow be cover by PCPO as they are in HK
• PDPO should be compared to international standard. Enactment of Section 33 is in line with The Council of Europe's 1981 Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data and the Organization for Economic Cooperation and Development (OECD) Guideline
  
• The Madrid Privacy Declaration urges countries that have not ratified Council of Europe Convention 108 together with the Protocol of 2001 to do so as expeditiously as possible
• The compliance is vital for Hong Kong to stay competitive and allow outsourcing business to capture the international market.

防止高鐵撥款出現利益輸送 人民規劃行動致信立法會

高鐵規劃的討論熾熱之際，再殺出利益衝突的質疑。IT呼聲對利益衝突的事件十分關注，會留意政府的回覆。

以下是人民規劃行動致立法會工務小組委員會的信件 ，要求立法會澄清利益衝突。

--------------------------
致立法會工務小組委員會：

防止高鐵撥款出現利益輸送，要求立法會澄清利益衝突

廣深港高速鐵路的工程撥款將於十二月二日於立法會工務小組委員會進行
表決。由於整個項目的撥款申請達港幣六百六十九億元，涉及龐大的金錢利益，
我們強烈關注有關的工程撥款會否出現利益輸送，令市民的利益受損。近日我們
留意到個別工務小組委員於高鐵撥款的議題上或有利益衝突，故特此來函要求立
法會作出澄清及處理。

我們留意到工務小組委員會主席何鍾泰議員為中國建築國際集團有限公司
的非執行董事，其公司在過往參與多項本港鐵路設施及地下鐵隧道工程，如：九
鐵南環線佐敦至南昌的鐵路隧道工程及東鐵馬鞍山－大圍至石門及石門至利安
的工程，以及西鐵車廠土木工程等（詳情請見附件一、二），其公司並曾向傳媒
發布將會競投廣深港高鐵香港段的項目。何鍾泰在此事上有明顯的利益衝突，若
繼續主持有關高鐵撥款的會議，確實不當。

而石禮謙議員為香港鐵路有限公司的非執行董事，並同時為新創建集團有限
公司的非執行董事；除了因其港鐵董事身份可引起利益衝突外，我們留意到其所
屬的新創建集團旗下的一間子公司惠保(香港) 有限公司於本年十月份承辦了一
份有關廣深港高速鐵路建造合約，金額達港幣一千一百多萬元。（詳情請見附件
三）。

此外，根據政府的高鐵方案，高鐵的鐵路走線將經過元朗區及新界北區。我
們注意到劉皇發議員擁有多間公司股份，及於元朗和新界北區擁有二十三塊土地
及數個物業。為此，我們促請劉皇發議員澄清，其有否因廣深港高速鐵路工程的
收地，而有可能獲補償；及其所擁有的公司有否直接或間接參與廣深港高速鐵路
的工程合約。
鑑於高鐵工程撥款涉及龐大的公帑運用，我們認為立法會在處理其撥款申請
時應避免潛在的利益衝突發生，以令公眾利益得以保障及維持立法會的公正性及
獨立性。為此，我們促請何鍾泰及石禮謙議員避席有關高鐵項目撥款的所有討論
及表決，並要求各議員如在廣深港高速鐵路工程中獲收地補償，或其所擁有的公
司會直接或間接參與有關的鐵路工程，需於會議前作出申報及按情況決定是否避
席撥款的討論及表決。

人民規劃行動
2009 年11 月30 日