EU – New Biometric ID Cards Are Not Secure, Warns EU FIDIS project

The EU-funded FIDIS (Future of Identity in the Information Society) has issued a stark warning that implementation of the current generation of biometric travel ID will dramatically decrease security and privacy, and increase the risk of identity theft. In an open declaration, adopted at the project’s last meeting in Budapest (hence called the Budapest Declaration), FIDIS calls for short-term damage control measures to be taken and for “a new convincing and integrated security concept” to be developed within the next three years. It further states that: “by failing to implement an appropriate security architecture, European governments have effectively forced citizens to adopt new European passports which dramatically decrease their security and privacy”. FIDIS claims that the new biometric passports, currently being introduced throughout Europe, present a number of additional risks over and above traditional ID document abuse scenarios. In particular, such Machine Readable Travel Documents (MRTDs) can be remotely read or ‘eavesdropped’ from distances of up to 10 metres. This means that confidential data held on the passport can be read by unauthorised third parties without the document holder’s knowledge. It may also make it possible to ‘track’ passport holders. In addition, use of biometric data stored on ID documents is exploitable by both the public and private sectors for additional purposes - a violation of European privacy principles. [Source] [Budapest Declaration on Machine Readable Travel Documents – 08 Nov 2006] [Coverage] [FIDIS]

US – DHS Holds Biometrics Conference With Focus On Privacy

Department of Homeland Security (DHS) agencies sponsored a conference in Washington, D.C., on privacy and biometric technology this week. IT vendors, other federal agencies, officials from foreign governments and nonprofit groups active in domestic and international privacy attended the conference, which was largely closed to the media. Stewart Baker, Assistant Secretary for Policy at DHS, gave introductory remarks that highlighted the public’s concern about three factors involved in biometrics and information sharing policy:

1. distaste that people might feel about unfamiliar, invasive technologies such as fingerprinting;

2. concern that biometric information gathered for identification purposes could also reveal other information, such as vulnerability to a health problem; and

3. concerns about the expansion of the categories of uses for personal information, such as when information gathered for counterterrorism purposes might later be applied to problems such as tracking down people who don’t pay child support or speeding tickets

Baker went on to state that keeping biometric information in discrete systems to maintain privacy, as was the practice before the September 2001 terrorist attacks, is no longer an acceptable limit on counterterrorist methods. [Source]

US – Disneyland Launches Biometric Ticketing

Disneyland has begun to implement biometric ticketing. Customers who choose to take advantage of Disneyland’s Ticket Tag system provide their fingerprint, which is converted to a numeric value, run through a hash and encrypted. The system is also capable of detecting blood flow and cartilage to guard against the use of phony fingerprints. The system does not require Disney to store the entire fingerprint image, thus avoiding the associated security concerns. Customers are relieved of the need to provide photo IDs to prove their identities. The Ticket Tag system is currently available at Disneyworld in Florida and at two turnstiles at Disneyland Hong Kong. Visitors who do not want to submit fingerprints may still opt to show photo IDs. [Source]

CA – Federal Privacy Commissioner Speaks to Parliamentary PIPEDA Review

In her opening statement to the Standing Committee on Access to Information, Privacy and Ethics on the Statutory Review of PIPEDA on November 27, 2006, Commissioner Stoddart focuses on six issues, which are canvassed in greater detail in the background document:

1. The OPC does not ask for enhanced enforcement powers, but believes the ombudsman model to be the appropriate one for now.

2. The OPC states that applying PIPEDA to the workplace has been challenging, but does not advocate for adopting the Alberta and B.C. models without more thought and asks the Committee to consider if and how PIPEDA might be amended to deal more appropriately with employee information.

3. The OPC raises the issue of transborder flows of personal information, and states that this issue can best be addressed by additional guidance rather than through changes to PIPEDA.

4. The OPC asks the Committee to consider amending PIPEDA to make it easier for the OPC to deal with complaints involving other jurisdictions, through info-sharing with other authorities.

5. The OPC raises the possibility of breach notification requirements and states that they “look forward to discussing with the Committee whether it is possible to fit a notification requirement into the PIPEDA framework.” The background document states that the OPC “supports the notion of a duty to notify individuals, but recognizes the difficulty of choosing the appropriate model.”

6. The OPC raises a specific, pressing concern arising out of a court decision limiting the OPC’s powers to review documents claimed to be solicitor-client privileged, and asks for an amendment as soon as possible to remove the ambiguity in PIPEDA about its powers in this respect. [Source]

Although the above six issues were highlighted, the background document also discusses submissions received by the OPC on the following additional issues and provides, in some cases, the OPC’s recommendations: · collection and disclosure for law enforcement and national security purposes; · designation of investigative bodies; · attempted collection without consent; · individual, family and public interest exceptions to consent requirements; · blanket consent; · disclosures of personal information before transfer of businesses; and · work product.[Background paper]

CA – Legislation Would Protect Manitobans From Identity Theft: Selinger

Proposed legislation that would give Manitoba consumers a tool to protect themselves against identity theft was introduced this week by Manitoba Finance Minister Greg Selinger. Measures include: Consumers who suspect they are or may become the victim of identity theft would have the right to have a credit reporting agency place a security alert on their file; When there is a security alert on a consumer’s file, a credit grantor who checks that file would have to verify the identity of the person applying for the credit by phoning the consumer at the number specified by the consumer in the alert. [Source]

CA – One in Three Canadians Surveyed Not Protecting Their Identity: Survey

Nearly one in three Canadians surveyed are putting their identity at risk by not shredding their personal documents before throwing them in the garbage according to internet research issued this week by Royal & SunAlliance Insurance Company of Canada. A quarter of those surveyed will be shopping online during the holiday season and 80% will use credit and debit cards so it is important people take measures to protect their identity. Young people are even worse when it comes to protecting their identities with a half of 18-24 year olds surveyed not shredding their personal documents and one in ten keeping their pin in their wallet or bag - some even keep it on their cell phones. A quarter of Canadians surveyed keep their PIN number in their home, which could still be risky if it falls into the wrong hands and a small percentage even keep it at work. [Source]

CA – Billions Blown on IT Deals: 5 of 7 Major Tech Projects Mismanaged

The Canadian government is spending billions of dollars a year on hefty computer systems without the proper controls to keep project costs from ballooning many times over. Examining just seven of $8.7 billion worth of IT projects approved in the past three years, Auditor General Sheila Fraser found that five lacked adequate business cases. A $2.5-million Canada Revenue Agency project aimed at prioritizing tax-collection work has inflated to a revised price tag of $147 million -- a 58-fold increase over five years. Four of the projects were launched by departments without the appropriate skills and experience to handle projects of such scope, the auditor’s report states. It goes on to point out that this is the fourth time the office has expressed concern about the lack of controls over expensive IT projects. [Source] [Source]

WW – Report: Spam Messages Have Tripled Since June

U.S. email security firm Postini reports that nine out of 10 emails are spam as the result of criminal gangs that have secretly overtaken computers to pump out emails seeking to scam users on everything from drugs to stock tips. The firm said that many email systems that have been inundated with spam are overloaded trying to manage the volume. The company estimates that 7 billion spam emails were circulating worldwide in November compared with 2.5 billion in June. [Source]

EU – Up to 80% of E-mail in Europe is Spam; EU Mulls New Spam Legislation

The European Commission has issued a report on spam that identifies the U.S. as the main source of the fraudulent emails, followed by China. Unsolicited e-mails account for between 50 and 80% of all messages sent to mail inboxes, the European Commission said. EU Media Commissioner Viviane Reding called on EU governments to step up their fight against spam, spyware and other illegal online activities and implement EU rules to improve Internet safety. The EU authorities also are looking at new legislation that would make it easier to prosecute spammers. The report points out the spread of spam, spyware and other online threats is undermining consumer trust in the Internet and email. The commission is working with the U.S. on joint enforcement efforts to curb spam. [Source] [Source]

US – Privacy Advocate Wins $19,500 In Telemarketing Dispute

Diana Mey of West Virginia has made headlines for her consumer crusades against telemarketers who violate the law. Discover Financial Services had been ordered by an arbitrator to pay Mey $19,500 for four telemarketing calls the company made to Mey in January 2003. The company, which said in a statement that it disagrees with the decision made by the Judicial Arbitration and Mediation Services, is considering whether to appeal the ruling. A legal expert interviewed in this DMNews story said the case underscores the importance of scrubbing calling lists not only against the Do-Not-Call registry, but company-specific lists as well. [Source]

AR – E-Voting Stirs Suspicion in Venezuela

Under pressure from opponents of President Hugo Chavez, Venezuela’s elections council has adopted safeguards for the country’s electronic voting machines to prevent tampering in Sunday’s election. The conditions are so strict that experts say they surpass some standards in the U.S. Venezuelans will get paper receipts that verify their choices were properly recorded, and must deposit them into boxes before leaving the polls. [Source]

CA – OPC Fact Sheet: Digital Rights Management and Technical Protection Measures

The OPC has issued a Fact Sheet on DRM and TPM. Excerpt: “There has been recent media coverage of the use of rootkit-like techniques as a technical protection measure in music CDs and movie DVDs. This has focused public attention on the subject of digital rights management (DRM), and in particular technical protective measures (TPM), from both a security and privacy perspective.” The OPC Fact Sheet discusses what is digital rights management? What are technical protection measures? How do they work and why are they a concern?” [Source]

EU – Hungary State President Returns Data Act to Parliament

President László Sólyom this week returned an act on the relaying of EU-American passenger-registration information back to Parliament for reconsideration, as he held that it breached constitutional laws on data

privacy. Sólyom asked the House to add a specification that those concerned must assent to the forwarding of their data abroad. The president sent the act back to the House just one day after US President George Bush, speaking at the Riga NATO summit, announced that he will try to persuade the US Congress to include more countries in its US visa-waiving scheme. The Hungarian Foreign Ministry welcomed Bush’s announcement and expressed hope that the now Democrat-dominated Congress will back Bush’s proposals. [Source]

EU – EU Considers Legislation to Require Telecoms to Report Security Breaches

A security breach involving a stolen laptop that contained customer data is focusing attention on whether companies should tell consumers when their personal information has been jeopardized by exposure. European Commission legislation is expected to pass next year to address security breaches. The legislation would require telecoms to notify regulators and customers when their data was compromised during a security breach. [Source]

CA – Canadian ISPs Agree to Block Child Porn Sites

Canada’s biggest Internet service providers have agreed to block hundreds of offending websites in an effort to stamp out child pornography. Telecom companies such as Bell Canada, Rogers, Shaw, SaskTel, Telus, Videotron and MTS Allstream are partnering with Cybertip.ca to launch “Project Cleanfeed Canada” that will block between 500 and 800 offending websites. [Source] [Source]

EU – Data Supervisors Warn Banks to Notify Consumers About Data-Sharing With U.S.

The Article 29 body has advised that European financial institutions share some responsibility with the Society for Worldwide Interbank Financial Telecommunication (SWIFT) for privacy violations related to the sharing of private financial transactions with U.S. officials looking for evidence of terrorism financing. The group also warned European banks that use the SWIFT system that they should advise their customers that U.S. authorities may have access to their personal information. The European Banking Federation has rejected the contention that banks share responsibility for data protection involving SWIFT transactions. SWIFT, which has maintained that it was required to turn over information after receiving subpoenas, is pushing for negotiations between the EU and the U.S. on data-sharing. [Source] [Press Release of the Article 29 Working Party on Swift Case]

UK – Most Patients Reject NHS Database in Poll

A national UK campaign was launched this week to persuade people to refuse on privacy grounds to have their medical records uploaded to a national database. The campaigners, who are part-financed by the charitable Joseph Rowntree trust, released ICM poll findings commissioned by the trust which they said showed a majority of the population was hostile to Whitehall’s plans. The figures show 53% of those questioned were either “strongly opposed” or “tended to oppose” the centrepiece of the Department of Health’s £12bn NHS computerization scheme. These results follow a poll of doctors earlier this month, which found that 52% of GPs were not prepared to upload their clinical records to the so-called national Spine without each patient’s consent. Ross Anderson, professor of security engineering at Cambridge, and one of the campaigners, said: “The NHS database starts off with 53% of patients opposed. The opposition can only get stronger once the public realize what NHS administrators plan to do.” [Source]

CA – Entrust to Help Secure Canadian Provider of Electronic Health Records

As more service sectors move to storing records, data and information online, the need for strong security solutions continues to be a priority. Following that trend, Canadian-based Aristex Health Solutions selected worldwide security expert Entrust to deploy Entrust IdentityGuard for strong protection of their online environment. In a first for the Canadian healthcare system, Aristex will provide patients with online access to their comprehensive health records and medical history. Aristex sought a strong, cost-effective authentication solution that would not only provide mutual authentication to all parties, but also help protect sensitive information and maintain patient confidence. [Source]

WW – Stolen Computer News Roundup (3 Items)

Stolen Laptops Hold Scotland Yard Officers’ Financial Data

Three laptop computers stolen from the offices of LogicaCMG hold sensitive financial information belonging to more than 15,000 London Metropolitan Police officers (Met – often called Scotland Yard, the name of its headquarters.) LogicaCMG is an outsourcing company that manages payroll and pension payments. One man has been arrested in connection with the theft. [Source] [Source] [Source]

Stolen Laptop Holds Ontario Science Centre Member Data

A laptop computer stolen from the Ontario Science Centre contains a database with members’ registration data, including names, addresses and credit card information. The laptop and the database are protected with separate passwords. The computer was stolen from a locked office on September 18. The Ontario Science Centre notified affected members by letter. An investigation is ongoing. [Source]

Stolen Computers Hold Women’s Health Information

Two computers stolen from an Indiana health center in November contain sensitive personal data of more than 7,500 Indiana women. The health center had a contract with the state of Indiana to manage data for the state’s Breast and Cervical Cancer Program. The data on the computers include names, addresses, birth dates, SSNs and medical and billing information. The data are password protected at two levels. The women whose data were on the computers were sent letters notifying them of the theft. [Source]

Kaiser Permanente laptop with info on 38,000 patients stolen

A laptop computer containing private medical information on 38,000 Kaiser Permanente members in the Denver area was stolen last month, the health care provider said Tuesday. The computer was stolen in early October from a car belonging to a Kaiser Permanente employee in California. The information in the computer included names, membership identification numbers, dates of birth; gender; and physician information for clients treated, according to Kaiser. [Source]

WW – Anti-Phishing Toolbars Not Doing Their Job: Study

A study of 10 anti-phishing toolbars conducted by Carnegie Mellon University researchers found that none provided effective protection from phishing web sites. The best detected just 85% of phishing sites; the rest identified under half of the sites. Most of the tool bars generated false positives; this can be dangerous because users may learn to ignore warnings if they are often wrong. [Source] [Source]

WW – ICANN Launches Public Comments on Whois Task Force Report

ICANN is launching a public comments period on the Preliminary Task Force Report on Whois Services. The public comment period will last from 24th November, 2006 to 15 January, 2007. The draft report sets out the key findings that have emerged during the work of the Whois Task Force, including determining what data collected should be available for public access in the context of the purpose of Whois, how best to access data that is not available for public access, and how to improve the process for notifying a registrar of inaccurate Whois data, and the process for investigating and correcting inaccurate data. [Source] [Preliminary Task Force Report on Whois Services] [View comments]

CA – RCMP Gets New Tracking Tool to Hunt Down Online Predators

Sexual predators victimizing minors online have counted on the Web’s anonymity and lack of boundaries for years. But those protections may not be available to them anymore. Software engineers and police investigators are working together to further enhance Child Exploitation Tracking System (CETS), an evidence gathering and analytics tool developed in Canada. Microsoft Canada said it is preparing to release a beefed up version of CETS next year. The tool was first jointly developed in 2005 by Microsoft, the RCMP and the Toronto Police Service. [Source]

UK – Police Want High-Powered Microphones on CCTV Cams

UK Police and councils are considering monitoring conversations in the street using high-powered microphones attached to CCTV cameras. The microphones can detect conversations 100 yards away and record aggressive exchanges before they become violent. The devices are used at 300 sites in Holland and police, councils and transport officials in London have shown an interest in installing them before the 2012 Olympics. The Association of Chief Police Officers has warned that a full public debate over the microphones’ impact on privacy will be needed before they can be introduced. [Source] [UPDATE: Blunkett Blasts Audio/CCTV Surveillance Proposal]

WW – GoDaddy Receives Patent for Domain Privacy Services

GoDaddy has been awarded a patent for its domain privacy services. The company sells domain privacy services, which allow registrants to hide their data from the WHOIS database. The services were initially intended to help people evade stalkers and spam, but many people who own trademark and typo domain names use the services to make it harder for attorneys to find them. [Source]

AU – Australia Money Laundering Bill: Everyday Purchases Could be Recorded

Top law firms, privacy groups and shopping giant Westfield fear low-risk and low-value items such as gift cards, phone cards and toll road passes could be subject to the Anti-Money Laundering and Counter-Terrorism Financing Bill, which was passed in the Australian House of Representatives this week. The Bill requires financial agencies, gaming organizations, pawnbrokers, bookmakers, jewelers, lawyers, accountants, real estate agents and any operator handling thousands of dollars in cash to make “risk assessments” of clients. If there is even a slight suspicion of money laundering or terrorism funding, operators must report details of a client’s income and assets to the Federal Government’s AUSTRAC database. Privacy Commissioner Karen Curtis told the inquiry there were concerns over the 2700 people authorized to access the AUSTRAC database, with more than half from the ATO. “Information collected for the purpose of enforcing serious crime, such as terrorism, should generally only be used for such purposes.” [Source]

US – Groups File Brief In Support Of Email Privacy

The Electronic Frontier Foundation, the ACLU, and the Center for Democracy and Technology have filed an amicus brief in federal court to support the protection of email stored online from unreasonable search and seizure. The brief argues that users of online email services have a “reasonable expectation of privacy” for their stored emails. The amicus takes the position that the Fourth Amendment protections against unreasonable search and seizure that cover telephone calls and postal mail should extend to email as well. [Source] [Amicus brief] [Order] [Warshak Brief] [Government Brief]

US – Taxpayers Shy From Sharing Info Online: Study

A majority of taxpayers still feel insecure about sharing personal financial information online, but they are comfortable with shopping online, a new survey found. Released this week by the Internal Revenue Service Oversight Board, the survey shows that 73% of 1,000 taxpayer households strongly/somewhat agree that they were not secure in sharing personal financial information via the Internet, even if the information was going to a government agency such as the Internal Revenue Service. The top reason - cited by 46% of 742 respondents - was concern that the Internet was not secure. 37% said they were not confident their privacy was protected, and 6% feared identity theft. [Source]

CA – Industry Canada’s Binder says RFID brings up policy issues

Spectrum, privacy and interoperability need attention, GS1 Canada told. Industry Canada’s Assistant Deputy Minister may be enthusiastic about RFID’s potential, but don’t count on the Government to lead the charge for its adoption nationwide. Speaking at an event hosted by GS1 Canada, a non-profit organization that helps establish radio frequency identification (RFID) standards, Michael Binder touched briefly on RFID during a speech that touched on more broad ICT issues, including the state of e-commerce in Canada, spam troubles, and broadband access. While he acknowledges that “sensor networks are the next big thing,” he said that the widespread adoption of them raises public policy issues such as spectrum issues, privacy protection, data security, and system interoperability. [Source]

UK – Visa to Introduce Contactless Payment for Small Purchases in UK

Visa is slated to introduce contactless payment in the UK by the end of 2007. Customers will be able to make small purchases, typically under GBP 10, by waving their debit cards in front of a reader without the need to enter PINs or sign receipts. The system could also be used for toll roads, parking meters and other “unattended payment situations” The payment system will be piloted in London and then brought to locations throughout the UK. [Source]

US – Utah Colleges, Universities Need More Formal Security Policies

The first in-depth information technology audit for the state public college and university system indicates a need for improvements to protect students’ private information. The report recommends that each school update its information technology policy to include 19 elements, including how to report a security breach and acceptable use of technology. The report also recommends that the chief information officer organize an annual audit of each institution’s security policy. [Source]

JP – Japan Weighs a New Smart Card ID

Japan has not had much luck convincing citizens to apply for the voluntary smart card identification document it launched in 2003 – only about 1 million have been issued in a country of 130 million. But a new card could be on the way. A high-level committee of government officials and corporate representatives will meet next week to consider a proposal for a new version of the eID card. At the heart of the proposal is the concept of creating a personal account for each citizen, in effect a Web site for every citizen that would store such information as their health records, insurance information and projected pension. Access to that personal data would be controlled by the digital certificate on the card, which would be based on PKI, a system of mathematically related “keys.” One key can be made public, the other is kept a secret, stored on the individual’s smart card. That way a doctor could encrypt data about a medical test using the individual’s public key, but only someone with access to the private key could decrypt the data and read the results. [Source]

AU – Australia Privacy Warning over PM’s Card Plan

Privacy groups have warned that a new single smartcard to be issued to 17 million Australians to replace cards such as those used for Medicare could result in increased identity theft and fraud. Consumers have been told the proposed Access Card is a fraud risk because it would include a digitized photograph, signature and personal number displayed on the card as well as encoded on a microchip. Privacy advocates say the Federal Government has ignored several key recommendations of the Consumer and Privacy Taskforce, set up to investigate privacy and security concerns. [Source]

NZ – Echelon Spymasters Meet: 50th anniversary of SIS

The leaders of an elite Anglo-Saxon global spying network known as Echelon have been meeting in New Zealand this week. A spokesperson for the New Zealand Prime Minister Helen Clark, who is also the minister in charge of the Security Intelligence Service, was reported as saying the gathering was part of ongoing liaison between the New Zealand intelligence community and its international counterparts. The catalyst for the three day visit by American CIA director general, Michael Hayden, and spy chiefs from Australia, Britain and Canada was apparently the 50th anniversary of the New Zealand SIS. [Source]

UK – Licence Plate Cameras May Be Unlawful

The UK Home Office is reviewing the legal status of automatic number plate surveillance cameras after the Chief Surveillance Commissioner advised that they could be operating unlawfully. In his annual report, Chief Surveillance Commissioner Sir Andrew Leggatt has warned that automatic number plate recognition (ANPR) cameras could qualify as covert surveillance, and be illegal. “The unanimous view of the Commissioners is that the existing legislation is not apt to deal with the fundamental problems to which the deployment of ANPR cameras gives rise,” he wrote in his report to the Prime Minister and to Scottish Ministers. [Source] [Surveillance Commissioners’ Report]

US – Cingular Gets $1.1 Million Award in Case Against Hackers

In a victory over data miners who used fraud, computer hacking and “social engineering” to collect the private cell phone numbers and calling histories of its customers, Atlanta-based Cingular Wireless has been awarded $1,135,000 in federal court. Following up on an earlier default judgment, on Nov. 9, Judge Clarence Cooper of Atlanta’s U.S. District Court ordered that Tamarac, Fla.-based 1st Source Information Specialists Inc. and company principals Kenneth W. Gorman and Steven Schwartz disgorge all profits and pay Cingular compensatory and punitive damages and attorney fees. [Source]

US – Carriers Seek to Capitalize on New Ad Revenues Without Igniting Privacy Backlash

Sprint Nextel is offering marketers the opportunity to target ads to the mobile Web page where cellphone users access the Internet from their phones. The targeting will identify consumers by demographics and behavior. Marc Lefar, Chief marketing Officer at Cingular Wireless, cautioned that carriers have to be mindful about privacy concerns when it comes to targeting advertising to cellphone users. Research conducted at Northeastern University has found that privacy is especially a concern to women and consumers over 30. [Source]

US – TIVO to Insert Ads at End of Programs

TiVo has announced a new service that will insert ads at the end of recorded programs and let marketers track how many people watch them. With the growth in popularity of DVRs, advertisers and television networks have become increasingly worried that most viewers skip through commercials. [Source]

US – Callers Can Communicate by Telephone With Privacy Features

A telephone service start-up known as Jangl offers consumers the opportunity to connect via telephone without revealing their personal phone numbers. Consumers obtain a Jangl ID on the company’s Web site to give out instead of their personal telephone numbers. The service is conducive to dating services. Online dating company Match.com started offering Jangl as a free service, which 275,000 people have tried since it was first offered Nov. 2. [Source]

AU – Privacy Concerns Over Phone Databases

The Australian Privacy Foundation says proposed federal legislation to protect information stored in a massive public phone number database is fundamentally flawed. The protections in the Bill, which will likely pass the Senate in the next two weeks, only apply to the Telstra-managed Integrated Public Number Database, which contains constantly updated information on every individual and business user of any type of phone line. The group points out that other directories do not use the Integrated Public Number Database, which means that the legislation would not apply to them. [Source][Source]

US – DHS Privacy Report: “Secure Flight” Needs Improvements

The Department of Homeland Security released its long overdue annual privacy report last week. The annual report covers two years. The department condensed its privacy-related efforts and concerns from July 2004 through July 2006 into 38 pages. The report to the U.S. Congress covers airline security and airline watch lists, border security and identification requirements, information sharing between departments, the use of biometrics, data mining, and the Real ID Act. The report consists mainly of an overview citing participation in hearings, workshops, and references to other reports. It covers a period during which DHS had three chief privacy officers. The report said the Transportation Security Administration changed its Secure Flight program without the required public notification. It said the TSA collected commercial data on people without prior notice and DHS has “strongly urged the TSA to establish a more robust redress program.” [Source] [Source] [2004 DHS Privacy Report]

US – Privacy Oversight Board Receives Briefing on Eavesdropping Program

Members of the Privacy and Civil Liberties Oversight Board say they were impressed by privacy protections that the government has built into an eavesdropping program. The National Security Agency last week briefed the five members of the board, which was created by Congress. President Bush appointed the members of the group, which praised the government for the steps it has taken to protect Americans’ privacy in its electronic eavesdropping program. Several members of the group said they wished that the government could reveal details of how the government safeguards Americans’ privacy and civil liberties while fighting terrorism to inspire more trust by the public. [Source] [Source]

US – USDA Abandons Mandatory Animal ID Database

The Bush administration is abandoning plans to make farmers and ranchers register their cows, pigs and chickens in a nationwide database intended to help limit disease outbreaks. Faced with widespread opposition, the Agriculture Department said this week the animal tracking program should remain voluntary. Many cattle ranchers are wary of the program because they want records kept confidential and don’t want to pay for the system. The industry estimates it could cost more than $100 million annually to register and report the movements of livestock and poultry. So far, about 23% of the nation’s ranches, feed lots, livestock barns and other facilities have registered their premises. [Source]

US – New Jersey DL Scanning Illegal, Bar Must Delete Data

The head of the state Motor Vehicle Commission said this week the growing practice of scanning and retaining driver’s license data from customers at nightclubs is illegal, potentially criminal, and she is ordering it to be stopped. Reacting to a story that appeared in a local newspaper, MVC Chief Administrator Sharon Harrington had a letter hand-delivered last night to KatManDu, a nightclub mentioned in the story, demanding an immediate halt to its license-scanning operation. KatManDu, like many nightclubs in New Jersey and across the country, uses a small, hand-held computer at the door to ensure patrons are of drinking age. But club managers and bouncers are not informing their clientele that they are downloading all of the data found on the licenses into a computer, which the bar uses for in-house promotions. Harrington further ordered the club to delete its database of 15,000-plus customers within 15 days. Otherwise, the matter will be referred to the state Division of Criminal Justice for investigation and possible prosecution. The practice violates the state Digital Driver License Act, as well as the state and federal Drivers Privacy Protection Acts, she said. Violation can be a fourth-degree felony and also leaves club owners vulnerable to civil action from scanned customers, she added. The law, she said, “is clearly prohibitive.” The issue is also gaining bipartisan interest from the state Legislature. This week, two Republican Assemblyman announced they are drafting legislation to ban the capture and storage of data from drivers licenses. Assemblywoman Linda Greenstein, who chairs the Judiciary Committee, said she intends to hold a special hearing next month on personal privacy issues, focusing on “the disturbing, emerging trend of bars and nightclubs collecting patrons’ personal information encoded on driver’s licenses. “From video surveillance, to credit card and Social Security numbers, to the information encoded on a driver’s license, our law should protect the basic privacy rights of New Jersey residents,” she said. [Source]

--------