topic Re: (ISC)2 Tweeting Community Thread Links??? in Member Support

(ISC)2 Tweeting Community Thread Links???

CraginS — Fri, 03 Aug 2018 19:45:23 GMT

It appears that someone at (ISC)2 has decided to Tweet links to Community discussion threads in Twitter:

https://twitter.com/ISC2/status/1025383344970846209

I don't recall giving anyone at (ISC)2 permission to quote me outside of the Community site.

Did every member who took part in the CPE thread give permission for (ISC)2 to expose them on Twitter like this?

All are in the twitted thread.

Re: (ISC)2 Tweeting Community Thread Links???

Early_Adopter — Sat, 04 Aug 2018 00:48:50 GMT

Thanks for bringing this to our attention Cragin.

No, we shouldn’t be tweeting content out using the great amplifying network without asking folks.

I don’t see many problems with a person tweeting one or two things outfits asking for permission, but this is a bit much as identities are not anonymised, kills debate etc.

i think we should have a chat with the mods.

Re: (ISC)2 Tweeting Community Thread Links???

rslade — Sat, 04 Aug 2018 01:36:53 GMT

@Early_Adopter wrote:

i think we should have a chat with the mods.

Oh, we have. Believe me, we have. It's been mentioned. Frequently. (You can, in fact, search for those discussions via Google.) So far without any particular result.

(Wait. Let me Google that for you.)

But, go ahead and have a chat with the mods, if you wish ...

Re: (ISC)2 Tweeting Community Thread Links???

rslade — Sat, 04 Aug 2018 01:53:39 GMT

@CraginS wrote:

I don't recall giving anyone at (ISC)2 permission to quote me outside of the Community site.

All are in the twitted thread.

"Twitted." I like that. (No, sorry, trademark infringement. I "kudo" that.)

Anyway, no, I certainly didn't give explicit permission to be quoted. Mind you, apparently we all gave implicit permission to be quoted, and have ISC2 do anything they please with whatever we post here. At the bottom of this, and every other page on the site, it states "All contents of this site constitute the property of (ISC)², Inc."

(Then again, careful examination of the timestamps on this post and that post could probably prove that I had posted already knowing what ISC2 was doing, but you'd have to have admin access to get that level of detail ...)

Of course, we could always move to the CISSPforum, where it's more private ...

(And more fun ...)

Re: (ISC)2 Tweeting Community Thread Links???

Shannon — Sat, 04 Aug 2018 01:51:25 GMT

We haven't explicitly consented, but this may be covered by their Privacy Policy.

(I confess, I didn't bother reading the policy before accepting it)

I suppose a justification from (ISC)2 would throw some light on this...

Re: (ISC)2 Tweeting Community Thread Links???

rslade — Sat, 04 Aug 2018 01:59:28 GMT

@Shannon wrote:
We haven't explicitly consented, but this may be covered by their Privacy Policy.

Nah. That's on the main site. And it states:

And we are on another site, and it's probably run by a third party.

Re: (ISC)2 Tweeting Community Thread Links???

Early_Adopter — Sat, 04 Aug 2018 07:35:59 GMT

@rslade hmm, I took a break from the internet in general a for a while why that was going on so missed it- it’s a nice try, but I don’t think that ISC2s stance will pass muster in terms of a GDPR compliant privacy notice, though given the current shenanigans around elections and influence I don’t even think the EU is the biggest issue - just wait till we see what Facebook gets served up by the FTC, it’s got to be larger than the EU judgement over android and chrome against Google otherwise it will look weak. We might even end up with a Federal Privacy a couple of yours down the road if only for the reason of annoying California via pre-emption of its nice new law (as a British subject I of course hasten to say that I do not have a dog in any confrontation between rebellious former colonies :P).

However the main issue as I see it for Cragin might be the use of his IP, most of us here are in some way public personas, so the fact that it is googleable might not be such a big thing(signature blocks and all), but the use of well structured and nuanced posts vs say more journalistic hipshooting might be vexing.

I’d say that a chat with the mods is still a good thing - we can always trot off somewhere else, if it doesn’t work and if it’s still a biggie for folks they can Breakout a couple of bottles of Schrems3000TM, though I’d always rather pick-up the phone, or corner some folks at congress.

Re: (ISC)2 Tweeting Community Thread Links???

SamanthaO_isc2 — Tue, 07 Aug 2018 15:22:42 GMT

Hello everyone,

As it has been mentioned, this area of the Community and a large portion of the Community, in general, is publicly available. Within our Website Access Policy, which can be found here, the section about User Contributions covers this topic. It states “Any User Contribution you post to the site will be considered non-confidential and non-proprietary. By providing any User Contribution on the Website, you grant us and our affiliates and service providers, and each of their and our respective licensees, successors, and assigns the right to use, reproduce, modify, perform, display, distribute, and otherwise disclose to third parties any such material for any purpose.”

The idea behind sharing Community content across our social channels is to help grow the Community with more of your cybersecurity colleagues and to help show the vast amount of helpful information that the Community contains. For example – this post that was shared is helpful to all members of (ISC)² find ways to obtain the necessary CPEs for their given credential(s) for free. Seeing as there are some great options listed here, we wanted to help circulate this to a larger audience for more of our members to be aware of.

I know that some of you take issue with the Community being publicly available and searchable on search engines like Google; however, I wanted to touch on why we have it this way. We have left a large potion of this site publicly available and searchable because we believe that the information shared within the Community is helpful to the advancement of not only the profession but also of the contributors to the threads within the Community. We have started creating private areas in the Community, as most of you know, under the Groups Category for any conversations that you might not want to make public. If you are interested in expanding the private areas in the Community, we are happy to hear your ideas on what types of areas you are looking for.

Thank you,

Re: (ISC)2 Tweeting Community Thread Links???

rslade — Tue, 07 Aug 2018 19:04:45 GMT

I went to post my disclaimer and found a new limitation on the "community."

"Message cannot exceed 20,000 characters."

Re: (ISC)2 Tweeting Community Thread Links???

Dain — Wed, 08 Aug 2018 21:05:55 GMT

Try # 2 - first appeared to be marked as spam... hmm

I quote quote:

"Any User Contribution you post to the site will be considered non-confidential and non-proprietary. By providing any User Contribution on the Website, you grant us and our affiliates and service providers, and each of their and our respective licensees, successors, and assigns the right to use, reproduce, modify, perform, display, distribute, and otherwise disclose to third parties any such material for any purpose.”

Use this however you like: ISC2 has become a marketing machine, that appears to be concerned with 2 things - making money, and making more money - apparently on the backs of the membership it should be serving.

Basically this might as well be FaceBook - except - oh wait - we pay for this service. But apparently that doesn't matter to ISC2, they have to have the right to do whatever they want with our contributions.

Just our of curiosity, how exactly does the above web policy of ISC2 fit with the organizations own Canons?

Protect society, the commonwealth, and the infrastructure.
Act honorably, honestly, justly, responsibly, and legally.
Provide diligent and competent service to principals.
Advance and protect the profession.

Certainly no protecting anyone (particularly members) I don't see taking blatant advantage of every member, and taking control of anything and everything they post, to use as you see fit on the Canons anywhere. I certainly don't see any of this as advancing the profession - frankly I find it irritating and more than a little embarrassing, professionally speaking. It most certainly is not acting honorably, nor justly - unless you want to claim the huge expense of this unnecessary, lightly customized, off the shelf web portal justifies ISC2 using anything herein however they please (not to mention allowing affiliates, etc, use of the posts, however they please.) Would clients be principals? Would members be principals? I'd like to think in this case they would be - so that ones out the door too, as this is certainly not being diligent nor competent with our data.

ISC2 has basically become a joke, and unless something drastically changes I for one will not be renewing a useless cert, marketed by an organization that seems to care little to nothing about its members, as long as it gets the renewal fees.

Disappointed,

-d

Re: (ISC)2 Tweeting Community Thread Links???

Dain — Wed, 08 Aug 2018 21:13:05 GMT

and 1 more thing - are we just supposed to take ISC2 at your word that the "Private" areas are really private, as in exempt from the web use policy? Hope that someone won't decide down the road that they can use anything, and everything from those sections as well?

That's great - nothing like expecting a bunch of security professional to ignore a facebook like use policy for a platform our dollars were wasted on, and ask us to just take for granted that private means private.

Re: (ISC)2 Tweeting Community Thread Links???

Early_Adopter — Thu, 09 Aug 2018 15:23:55 GMT

So... Assuming we don’t all wish to emoragequit ISC2(if those subs are not spent on something they get drunk, and my liver is probably already a fine example of Foie Gras) how should we go about changing this?

Re: (ISC)2 Tweeting Community Thread Links???

CraginS — Fri, 10 Aug 2018 10:25:30 GMT

@SamanthaO_isc2 wrote:
Hello everyone,

As it has been mentioned, this area of the Community and a large portion of the Community, in general, is publicly available. Within our Website Access Policy, which can be found here, the section about User Contributions covers this topic. It states “Any User Contribution you post to the site will be considered non-confidential and non-proprietary. By providing any User Contribution on the Website, you grant us and our affiliates and service providers, and each of their and our respective licensees, successors, and assigns the right to use, reproduce, modify, perform, display, distribute, and otherwise disclose to third parties any such material for any purpose.”

It is time for the (ISC)2 legal team to re-examine the Website Access Policy with respect to GDPR implications, and in particular in light of a recent French court ruling on Twitter's 256-clause privacy policy.

French court orders Twitter to change smallprint after privacy case
AFP•August 9, 2018

and

http://www.dailymail.co.uk/sciencetech/article-6046519/French-court-orders-Twitter-CHANGE-terms-conditions-new-privacy-case.html

From that article:

"The consumer association had called on the high court "to recognise the abusive or illegal nature" of 256 clauses contained in Twitter's terms and conditions that it said breached users' privacy. In particular, UFC-Que Choisir said the court's decision guarantees Twitter users that their photos and tweets can no longer be "commercially exploited" if they have not given their consent.

"By ticking a small box to accept the terms of service, the consumer has not expressly accepted their data can be exploited," the group said."

Re: (ISC)2 Tweeting Community Thread Links???

Early_Adopter — Sat, 11 Aug 2018 01:48:57 GMT

Just to add more grist to the mill here from a privacy standpoint. ISC2 should speak to it’s lead supervisory authority. differntiatianion in the way it handles it’s dealings with folks it has contracts with (members, candidates et) and folks it doesn’t(casual users of the community). If it was me running it I’d want completely separate privacy notices and terms and conditions for the community and core sites.

Under GDPR should be given on specifity for the purpose of processing, consent must be explicit, etc. For example if we were to say ‘may be linked’ then a Supervisory Authrority might correct you and say that we’d need to be definite with the data subject about whe we were doing and ambiguous language should be removed. For example after combination of that data could be worked back from a screen name to a real name, and the data subject had a reasonable expectation that their name was not going to be made public(why yes Mr Sockpuppet, this is one of the reasons we have sreennames after all) then that in itself could be construed to be a misuse of personal data if consent was the basis of processing as we didn’t point out it was going to Twitter. Couple of gems from the website access/privacy policies:

‘All information we collect on this Website is subject to our Privacy Policy. By using the Website, you consent to all actions taken by us with respect to your information in compliance with the Privacy Policy’

‘Generally, we do not consider Usage Data as Personal Information because Usage Data by itself usually does not identify an individual. Personal Information and Usage Data may be linked together. Different types of Usage Information also may be linked together and, once linked, may identify an individual person. Also, some Usage Data may be Personal Information under applicable law.’

Comments on the Web Policy

Dain — Fri, 17 Aug 2018 18:20:29 GMT

@isc2

How is it possible that "The World’s Leading Cybersecurity and IT Security Professional Organization"

feels that the web usage policy of this website is acceptable?

Any User Contribution you post to the site will be considered non-confidential and non-proprietary. By providing any User Contribution on the Website, you grant us and our affiliates and service providers, and each of their and our respective licensees, successors, and assigns the right to use, reproduce, modify, perform, display, distribute, and otherwise disclose to third parties any such material for any purpose.

Presumably our fees paid for this community, or at the very least contribute to whatever cost was incurred. And yet ISC2 seems intent to treat it like any "free" social media environment where the users information, posts, etc. can be used and shared with anyone ISC2 sees fit. That is to say, the web usage policy suggests that our information, posts, etc. is in fact likely to be the PRODUCT that ISC2 intends to peddle to interested parties, regardless of the fact that all the ISC2 members paid for our membership.

In regards to the ISC Canon please consider the following:

Protect society, the common good, necessary public trust and confidence, and the infrastructure.

Certainly isn't protecting anything other than ISC2 current/potential profits derived from selling information pulled from our community, and surely I am not the only one who finds this policy indicative of ISC2 being roughly as trustworthy as e.g. facebook, let alone considering what the wider security community would feel about these policies, and how the fly (or at the very least, can be interpreted to fly) directly in the face of our own canons.

Act honorably, honestly, justly, responsibly, and legally.

Legally, sure. Honestly? yeah, its right there in black and white. Honorably? Justly? Responsibly? The web policy certainly makes it legal for ISC2 to use the data however they want, and provide to anyone they want. So we, the members who pay for these "services" simply have to trust that private groups are really private, and that anything we post won't be provided to anyone, as ISC2 deems fit for any reason. How is potentially using anything we contribute, as paying members, honorable or just? In the absence of limiting disclosure policies (not to mention bugs in the community web site that could certainly do little to suggest a lack of risk of information disclosure) how is telling us you will do whatever, whenever, and by extension with whomever you want a responsible way to act?

Provide diligent and competent service to principals.

As members of this organization do we not count as principals? I do not find the idea of blindly trusting ISC2 to do the right thing with my data to be diligent, or competent service (particularly in light of the web usage policy which explicitly permits ISC2 to disclose whatever they want, at any time, to anyone they want).

In fact, I find the idea of ISC2 expecting us to simply trust any discussions of private areas (in respect e.g. to the CISSP only board), in the absence of any specific policies, absolutely counter to any of the most basic information security tenants.

Advance and protect the profession.

This sort of thing in absolutely no way advances or protects the profession. If anything, I would say it gives the impression that ISC2 has become nothing more than a profit making machine, intent on increasing revenue at the expense of its own reputation, and by extension the reputation of those who are members.

I may be in the minority, but I find this extremely disappointing, and counter to nearly everything our canons are supposed to represent.

Dain Perkins

Re: Comments on the Web Policy

denbesten — Sat, 18 Aug 2018 00:28:07 GMT

@Dain wrote:
...ISC2 seems intent to treat it like any "free" social media environment where the users information, posts, etc. can be used and shared with anyone ISC2 sees fit.

It does occur to me that for a forum to operate, they do need permission to redistribute our comments (for which individual posters hold the copyright) at a minimum so other members of the forum can read them.

Similar verbiage appears on all the forum TOS I have reviewed. Consistent across all of them is a requirement for a license grant. None require copyright assignment, although some are explicit about no assignment.

Interesting thought experiment.... Today, if (ISC)² wishes to move the community messages from Lithium to a new provider, they can do so because the license grant is to "(ISC)² and its providers". However to move the old CISSPforum messages, it seems that Yahoo! would need to sublicense the new location. Any idea if (a) (ISC)² also required a license grant to themselves (perhaps as part of the sign up process), or if (b) Yahoo! is willing to sublicense to competitors?

----------------------------------------------

(ISC)²

By providing any User Contribution on the Website, you grant us and our affiliates and service providers, and each of their and our respective licensees, successors, and assigns the right to use, reproduce, modify, perform, display, distribute, and otherwise disclose to third parties any such material for any purpose.

Twitter

By submitting, posting or displaying Content on or through the Services, you grant us a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Content in any and all media or distribution methods (now known or later developed). This license authorizes us to make your Content available to the rest of the world and to let others do the same

Facebook

Specifically, when you share, post, or upload content that is covered by intellectual property rights (like photos or videos) on or in connection with our Products, you grant us a non-exclusive, transferable, sub-licensable, royalty-free, and worldwide license to host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of your content (consistent with your privacy and application settings).

Snapchat

…you grant Snap Inc. and our affiliates a worldwide, royalty-free, sublicensable, and transferable license to host, store, use, display, reproduce, modify, adapt, edit, publish, and distribute that content. … [for] Public Content … you also grant us a perpetual license to create derivative works from, promote, exhibit, broadcast, syndicate, sublicense, publicly perform, and publicly display Public Content in any form and in any and all media or distribution methods (now known or later developed).

A worldwide, transferable and sublicensable right to use, copy, modify, distribute, publish, and process, information and content that you provide through our Services and the services of others, without any further consent, notice and/or compensation to you or others.

Google

When you upload, submit, store, send or receive content to or through our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content.

Oath (Yahoo! Groups)

you grant Oath a worldwide, royalty-free, non-exclusive, perpetual, irrevocable, transferable, sublicensable license to (a) use, host, store, reproduce, modify, prepare derivative works (such as translations, adaptations, summaries or other changes), communicate, publish, publicly perform, publicly display, and distribute this content in any manner, mode of delivery or media now known or developed in the future;

groups.io

By uploading any User Content you hereby grant and will grant Groups.io and its affiliated companies a nonexclusive, worldwide, royalty free, fully paid up, transferable, sub licensable, perpetual, irrevocable license to copy, display, upload, perform, distribute, store, modify and otherwise use your User Content in connection with the operation of the Service.

Re: Comments on the Web Policy

Dain — Fri, 24 Aug 2018 20:35:12 GMT

1) Sure would be nice if ISC2 had ANYTHING to say on the matter

2) In no way addresses the "private" component of various community areas, and how that expectation is exempted (if at all) from said policy

3) Other than chipping in to host the archives, I don't recall paying any of those other organizations for service

Seems like it could be a whole lot more specific about what, when, how, & by whom our information may be used (seems to cover a whole lot more than e.g. switching providers.

Re: Comments on the Web Policy

StephanB — Sat, 01 Sep 2018 15:38:32 GMT

There are a million different forums out there. Most of them are publicly searchable, are indexed by the likes of Google, and have permalink features to individual posts and comments. Some have private areas, some don't.

I'm just here reading all this made up outrage, shaking my head. You don't have to be here. Bye.

Re: Comments on the Web Policy

Early_Adopter — Mon, 03 Sep 2018 03:13:33 GMT

@StephanB

I’m not sure, that it’s required for ISC2’s forums to have 100% equivalence with all the other forums out there - after all most forums do not have a security focused code of ethics, for some career required certifications and subscription fees attached.

Put bluntly, ISC2 holds itself to higher ideals than other chat forums, and it’s current offering in terms of content, privacy policy and IP rights could all be reshaped to be more supportive of its ideal in the community.

The demise of CISSPforum seems to be one of the chief drivers of discontent, but even if that hadn’t happened or was perfectly agreed there would still be a lot of room for improvement in the status quo.

Given the nature of forums things tend to spill out of the nice bounds there were in and conversations linger, and there might be something of an edge to some of the comments here, however I haven’t seen anything that steps beyond the bounds of the reasonable. Simply dismissing the (valid or otherwise) concerns of ISC2 members accociates and community members who would like more control over the stuff they put out there and their digital personas as ‘made up outrage’ and telling them ‘bye’ without even specifically addressing them logically seems to me to be .... well, at the very least an unenforceable sentiment.

I would leave you with this article from the BBC as I think it’s interesting and conveys a lot of the why, people in communities want more control:

https://www.bbc.com/ideas/videos/wake-up-foucaults-warning-on-fake-news/p06gzcn4

Re: Comments on the Web Policy

StephanB — Mon, 03 Sep 2018 04:48:14 GMT

I would argue that being upset about a shared link to a post on a public forum is something reasonable people would call the very definition of made up outrage.