Incident Response and Data Protection

Incident response, as performed by CERTs, CSIRTs and other related acronyms, is an essential part of keeping the Internet habitable, however it raises some interesting data protection issues. In most data protection scenarios, you know in advance what people and what information you are going to be processing, so you can give them prior notice, design systems and processes to be compliant, and so on.

Incident response turns all that round: when you are given a compromised machine, or if you run a network traffic monitor, you have no idea what may turn up. A  compromised host is likely to contain a wide range of information belonging to the legitimate owner, but also potentially lots of fallout from whatever else the machine has been mis-used for: that could be credit card or e-banking details if it has been used for phishing, lists of other compromised hosts if it has been part of a botnet, or any kind of large volume file  if it has been used as a distribution point for unlawfully copied information. Any network monitoring system will pick up a mix of legitimate traffic, mis-configurations and malicious activity. It's pretty unlikely that any of this will be neatly tagged with the e-mail address of the affected people, so even informing them of what has happened may be impossible.

Fortunately EU data protection law does contain provisions that allow this sort of activity and provide as much protection as possible for those whose personal information may be caught up in it. Over the past year or so I've been working with members of various international Incident Response Teams to remind myself of what they need to do in these circumstances, to work out how that fits in with the legal requirements, and to provide a framework that I hope will help them in making sometimes hard decisions.

The resulting paper has now been published by TERENA. As with all my publications, it's not legal advice, but I hope it will be useful guidance and reassurance both to the teams and to Internet users that their interests are being taken care of. Thanks are due to all those who have contributed ideas, suggestions and corrections; any mistakes are mine.