Skip to content

Data Retention Strikes Back in Italy

The Italian Parliament is going to pass a provision (“hidden” into an elevator’s safety decree) to re-introduces the extension of the original (and still possibly illegal) data-retention term up to 72 months. (Continued)

The Danger of Remotely Managed (i.e. cloud-based) Software

Today you can buy a lot of software on a subscription, cloud basis scheme.

Of course, from the software-house point of view there are no issues.  But from the users’ perspective the fact that cloud, subscription-based business models are widely enforced by the market, and that its supporters claim this to be an advantage for the users doesn’t turn a bad management choice into a good one. (Continued)

No More Mandatory Data Retention in Italy? – Update

As a consequence of the Parliament/Govern inactivity, the huge quantity of traffic data that survived the June, 30 midnight – and that some ISP might still have in its own hand, maybe hoping for a last-minute, never passed, prorogation – is currently being deleted.

Right now, traffic-Database deleting schedules should have been re-set to the old standard: one year retention period as set forth by sec. 132 of the Italian Data Protection Act.

And the Data Protection Authority still hasn’t hissed a word.


No More Data Retention in Italy?

Yesterday the Internet Traffic Mandatory Data Retention regulation expired without being re-enacted by the Parliament. This means that at the midnight of June, 30, all the Italian Telcos and ISPs just (or should have) deleted last year Internet usage information from their databases.

Maybe the Parliament and the Data Protection Authority just had a strike of consciousness and decided so, after having “forgotten” for years to stress test the national data retention legislation to check if it could still stands against the EU Court of justice 2014 decision that bashed the data-retention directive.

Or, maybe, the powers-that-be just forgot about the data-retention.

We’ll never know for sure, but fact is that current high profile criminal investigations are now deprived of an important information gathering tool.

NSA, Search Engines and Political Competitions the Frank Underwood’s Way

Playing God. CRISPR and the re-shaping of fundamental rights

I just came back from Japan where I gave a few lectures on data protection, computer forensics and genetics. I addressed this last topic at Tokyo’s Keio University with a talk titled “Playing God. CRISPR and the re-shaping of fundamental rights“.

This is the agenda (the transcript is coming…):

Agenda 議題

Molecular Biology and Bioinformatics Basics


CRISPR – A Step Ahead


Law, Science, Religion

法則, 科学, 宗教

Can Life be Owned?


Copyright: a New Cage

Copyright: 新しい檻

Who Owns (Bio) information


Genetics, Privacy and Data Protection

遺伝学, 内証, 情報の保護

Freedom of Research


Criminal Investigations and Trials


National DNA Database and Public Policing




Intesa Sanpaolo and the Careless Copywriter

I have always been fascinated by the unwanted consequences of an advertising slogan, and by the lack of perspective of (some) communication campaigns.

This time, what grabbed my attention was a claim published on Intesa Sanpaolo website, whose small-prints read:

Until July 2, in Rome, Milan and Turin, the experience of living with no cash.

Almost automatically a reaction snapped out in my – and I assume not only mine – mind: looking at how economy is currently performing, a lot of people don’t need a bank to “feel” how does it is to live with no cash.

This simple consideration – a pun, actually – sinks down the copywriter’s attempt to spin the optimistic view of the world, that incites people to live… sorry spend money without (immediate) worries.

How could Intesa Sanpaolo CEO handles himself if, for instance during a TV debate where he talks about this ad campaign, somebody throws at him a line like the one I’ve figured out?

Yes, he might explain that the message is not meant to offend people that have hard time in carry out their daily life, that the message, on the contrary, is an hymn to the joie-de-vivre and so on. But as always happens with short, neat and powerful hits, when you start dodging the blow with complicated explanation, the damage is already there.

Of course this scenario is not going to happens for the probability that somebody might notice, understand and speculate on this minor issue is actually close to none. But as once a great advertising man told me about the importance of covering all bases:

nobody is going to notice a small mistake, but the one who will exploit it against you.

AntiPublic, British Airways and the Italian Data Protection Supervisor

Italy just discovered AntiPublic, the next data-leak with about half a million of personal accounts made publicly available by the lack of care of “trusted” websites in handling its “security measures”.

British Airways got a shut down of its IT infrastructure due, according to the Italian newspaper, a lack of management of the business continuity plan.

This two cases, while unrelated, are both evidence of an infringement of the EU Data Protection Directive (95/46/CE).

In the AntiPublic data-leak the reason why is obvious, as it should be for the British Airways IT infrastructure “freeze”: business continuity, indeed, is one of the security measures that the Data Processor should enforce to avoid damages arising from the unavailability of personal data.

This is a challenge for the (Italian) Data Protection Supervisor. He can either look elsewhere, or open an investigation to ascertain what happened and who is the culprit of these personal data mismanagement.

The EU Directive 95/46 and his own case law give the Italian Data Protection Supervisor the power to act even outside the national and European jurisdictions, so there wouldn’t be a motive no to start an investigation.

So, if the Italian Data Protection Authority will actually starts poking around to find out the “truth”, then a message is sent to the business and civil servant community: we don’t need to wait for the General Data Protection Regulation (GDPR) to enter into force, to exercise our prerogatives against no matter who.

Should he, on the contrary, look elsewhere, the message would have a very different meaning. Citizen, companies and public services might be led to think that all the “early warnings” about the upcoming GDPR and the dire consequences of the non compliance are just a pre-emptive notice of some sort of “hidden tax payment through fines” approach, targeted against SME, some big Italian company and a couple of USA multinationals.)

In the meantime, AntiPublic & C shall continue to access unnoticed our personal data, while citizen will continue paying the consequences (in term of damages and lack of services) of the poor compliance to a set of provisions that, just yet, are felt as useless bureaucratic burden.

When Security Becomes Service Disruption: the Banca Popolare di Bari Case

The message reads: For security reasons, this ATM doesn’t provide cash between Friday, 16,30 and Monday, 09,00. We are sorry for the inconvenience.

This way of looking at IT Security reminds me of those Security “Managers” who were use to advise to unplug the Ethernet cable at the daily close of business, to put it back the very next day.

Security can’t be a way to make the customers’ life more miserable. The challenge of a Security Manager is exactly the opposite: let customers doing their business while keeping the environment safe.


Does Your Privacy Actually Matters To You?

An article published by the New York Times addresses the possible outcomes of the announced changes in the US privacy legislation that allows a free sales of people’s Internet “life”, and advise to use TOR, VPN or similar tools to “protect the right to privacy”.

I actually think that the best privacy protection tool is to comply to what the latin poet Orazio said: Nescit vox missa reverti (Once you said something, it is useless to say “I didn’t want…”) Or, to put it short, “what you want to keep secret, don’t tell Google” 🙂

Kidding apart I think that the privacy hysteria led us much beyond any logic thinking.

Like a Pavlovian reflex, as soon as something is announced that might slightly interact with us, a rant shouts out: hey! This infringes my privacy!

Sure, Google and companies are snooping into our private lives, but it is every single of us that allow for that. Google (Facebook & C) are companies that seek for profit, and since there is no free lunch, somebody has to pay the bill (in terms of personal data.)

I don’t like this status quo but I have to face actuality: if we care about our privacy, we should start using these tools in a more aware way, by selecting what we want to share. We can’t throw our life into the wild and then complain that somebody else took it away.

So, privacy protection starts from ourselves.

Do we have a right not to be “blamed” for some specific interest or personal inclination (as soon as it isn’t criminal?) Absolutely. But the Internet it is not the only place where we can cultivate our personal interest. It is an oxymoron to call for privacy protection when we are withdrawing this right in the very moment we hit “search” on Google. I may dare to say that on the Internet, as in public spaces, there is no “reasonable privacy expectation”.

What scares me more is the State surveillance because in this case I have neither a technical nor a legal protection to enforce. I can avoid to give Facebook some information, and I don’t care if Amazon gives somebody else my shopping history (dind’t buy bombs or mass-murder weapons to be shipped to Middle East) but I can’t stop a spook to dig into my life.

So, “shouting fire” every time something goes remotely “personal” is the best way to pollute the notion and the value of privacy.