Children aged 11 to 16 are to have their fingerprints taken and stored on a secret database, internal Whitehall documents reveal. The leaked Home Office plans show that the mass fingerprinting will start in 2010, with a batch of 295,000 youngsters who apply for passports. The Home Office expects 545,000 children aged 11 and over to have their prints taken in 2011, with the figure settling at an annual 495,000 from 2014. Their fingerprints will be held on a database also used by the Immigration and Nationality Directorate to store the fingerprints of hundreds of thousands of asylum seekers. The plans are outlined in a series of “restricted” documents circulating among officials in the Identity and Passport Service. They form part of the programme for the introduction of new biometric passports and ID cards. Opposition politicians and privacy campaigners warn that the plans show ministers are turning Britain into a “surveillance society”. [Source] [Source] [Source]

UK – DNA Info Will Be Stolen if Included in ID Cards

Former Home Secretary Charles Clarke has called for DNA details to be put on the identity cards database – despite warnings it will be accessed by crooks. Mr Clarke argues that current Government plans for ID cards are too timid and that the more information placed on them, the safer they will be from abuse. But this week the Home Office admitted fraudsters can already scan biometric passports without our knowledge. And campaigners warned that putting DNA on the database would take Britain’s £1.7billion annual identity fraud crisis to dangerous new levels. “If your credit card gets stolen, the card can be stopped with relative ease. What are you going to do if someone steals all your personal details and your DNA profile?” [Source] See also: [New ‘chip’ passports are copied in transit]

CA – Canadian Privacy Officials Collaborate on Efforts to Combat Identity Theft

Federal, provincial and other Canadian privacy officials met recently to assess ways to address the escalating ID theft problem in the name of Fraud Prevention Month. They agreed that law enforcement agencies, governments and businesses must work together to find solutions to overcome identity theft. The group also agreed that action is needed to halt the increase in spam. The officials also noted that “Canada is now the only G-8 country without anti-spam legislation.” Ann Cavoukian, the Information and Privacy Commissioner of Ontario, says that technology needs to be changed in order to combat the problem of fraud and identity theft. “We need fundamental change in the way the Internet works and that of the existing identity infrastructure. In my view it’s no longer sustainable,” says Cavoukian. [Source] [Source] [Source] [Source] [Source]

US – Bill Gates Calls For New Consumer Privacy Law

Microsoft Chairman Bill Gates asked Congress to pass a comprehensive privacy law this year, allowing consumers to control how their personal information is used. Gates repeated past Microsoft calls for a wide-ranging privacy law during a speech at advocacy group the Center for Democracy and Technology’s (CDT) annual gala dinner Wednesday. A comprehensive privacy bill should allow consumers to control their personal data, should provide transparency about what their data is used for, and should notify them when their data has been compromised, Gates said. [Source] [Press release]

US – Woman Accuses Yahoo of Stealing Her Image

An Ohio woman is demanding $20 million from Yahoo for allegedly using a photo of her without her permission for a welcome e-mail sent to new users. According to a court complaint filed with the U.S. District Court for the Northern District of Ohio, Shannon Stovall discovered upon signing up for Yahoo’s Web-based e-mail service last October that a picture taken of her appeared in a note sent to new users. The complaint charges that the image has been sent to millions of users around the world without Stovall’s authorization, violating her right to privacy and right to publicity. [Source]

CA – Privacy Sings Two Tunes: Consent Stifles Service Innovations

Don Lenihan (Crossing Boundaries) has written an opinion piece looking at the challenges of governmental handling of privacy. The article discusses how societal views of consent have limited e-government and how we need to be aware of differences to the private sector. Lenihan’s opinion is that the public is more lenient with the private sector’s access to their personal information than they are with the government. [Source]

CA – Canada.com Pawns Webmail to US Provider; Says PIPEDA No Longer Applies

Apparently, CanWestGlobalAsperOmniMedia has outsourced the Canada.com e-mail service to an American company, Velocity Services, Inc. This is the blurb from the Canada.com website: “canada.com e-mail (the “Service”) is provided by Velocity Services, Inc. (“VSI”), a company located in and conducting its business from the United States. By registering for and/or logging on to the Service, you accept and acknowledge that the information processed or stored outside of Canada may be available to the foreign government of the country in which the information or the entity controlling it, is situated under a lawful order made in that jurisdiction and no longer falls under the jurisdiction of Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) nor be subject to canada.com’s Privacy Statement.” [Source] [Source] See also: [Lawson v. Accusearch Inc., 2007 FC 125 (CanLII)]

WW – Spam on The Rise Worldwide

Messaging security firms are reporting that spam is on the rise, according to this ConsumerAffairs.com article. One such firm, MessageLabs, reported that “77.8%of all sent emails for the month of February from ‘new and unknown bad sources’ were spam, or 1 in every 1.29 e-mails” —a 2% increase from January. The company attributes the increase to spammers using the Valentine’s Day holiday as an opportunity to step up traffic. Another firm, Kapersky Lab, published a 2006 report indicating that China, Russia and the United States are the largest producers of spam, with the majority originating in the U.S. [Source] See also: [Denmark - Opinion poll puts snail mail in the lead]

US – Microsoft & DOD Sign Deal to Develop EHR Data-Mining Tool

Microsoft is partnering with the Department of Defense (DOD) to develop tools for analyzing the health records of 9.1 million DOD beneficiaries. Together, Microsoft and the Army’s Telemedicine and Advanced Technology Research Center plan to develop a clinical data warehouse that will allow healthcare providers and analysts to run predefined queries of interest, and will also support data-mining. In Government Health IT, Dr. William Winkenwerder Jr., Assistant Secretary of Defense for Health Affairs, said, “This project has the potential to vastly improve our ability to provide both force health protection and population health improvement activities for every soldier, sailor, airman and Marine.” [Source]

EU – Art. 29 Working Party Issues Opinion on Transfer of PNR to U.S. Authorities

The Art. 29 Working Party has issued its opinion aimed at travel agents/airlines that provide travel services to passengers flying to and from the United States. Here is the executive summary: This opinion and its annexes (frequently asked questions and model notices) are aimed at travel agents, airlines, and any other organisations providing travel services to passengers flying to and from the United States of America. This opinion and the annexes update and replace the previous opinion of 30 September 2004 (WP97).The current legal framework for transferring PNR information to the US authorities is covered by the interim agreement of 16 October 2006. Negotiations for a new agreement are expected to start in 2007.There remain obligations on travel agents, airlines and other organisations to provide information to passengers about the processing of their personal information, and this opinion aims to give advice and guidance on who needs to provide what information, how and when. Information should be provided to passengers when they agree to buy a flight ticket, and when they receive confirmation of this ticket. The opinion gives advice on providing information by phone, in person and on the internet. The Art. 29 WP has established the model information notices (the annexes to this opinion) to make providing this information easier for organisations, and to make sure the information provided is consistent across the European Union. The shorter information notice gives passengers summary information about transfers of their data to the US authorities, and how to find out more information. The longer notice is in the form of frequently asked questions and has more details about the processing. It explains passenger data more widely, before focusing on PNR data. It also includes links to the interim agreement and other relevant documents. [Source] [Art. 29 Working Party: Opinion on Transfer of PNR to US Authorities]

EU – Anti-Terror Data Law Takes Effect In Germany

Protection against possible terrorist attacks is the motivator behind Germany’s new anti-terror data law. The law allows German security officials to create the largest and most comprehensive pool of personal data ever to be amassed in the country. The databases of nearly 40 different agencies, including the Federal Criminal Police Office (BKA) and the Federal Intelligence Service (BND), will be linked to allow authorities to run searches on suspected individuals and retrieve information within minutes. Support for the security measure has grown in Germany and many other E.U. member states that worry about their national security being increasingly threatened by international terrorism, organized crime and illegal immigration. To what extent the numerous databases are already linked - BKA alone has more than 100 - and how access to data will be controlled are details the German government isn’t prepared to disclose. [Source]

EU – EU Warns Microsoft of Possible Further Fines

The European Commission warned Microsoft last week it faced further fines in its antitrust case for seeking unreasonable prices from software makers for interoperability information. The latest formal charges could lead to new fines against the U.S. software giant, the Commission said in a statement. [Source] See also: [DOT CIO Places “Indefinite Moratorium” on Vista, IE 7 and Office 2007]

WW – Study Forecasts 988 Billion Gigabytes of Digital Information in 2010

In 2006, 161 exabytes of digital information were created and copied, continuing an unprecedented period of information growth, according to a new report by IDC researchers. This digital universe equals approximately three million times the information in all the books ever written. The previous best estimate came from researchers at the University of California, Berkeley, who totaled the globe’s information production at 5 exabytes in 2003. But that report followed a different trail. It included non-electronic information, such as analog radio broadcasts or printed office memos, and tallied how much space that would consume if digitized. And it counted original data only, not all the times things got copied. [Source] [Digital data explosion 'will test IT departments'][Source]

UK – Banks Unleash Paper Tigers Over Terror Data Probe

British banks have responded to European privacy watchdogs, who claim they broke the law by letting US anti-terror investigators have access to the details of their customers’ international financial transactions. The banks have written letters to their customers, and claim this should be enough to put them in the clear. The Article 29 group, though it has no actual power to enforce its demands, said in November that Europe’s financial institutions, all of which conduct their international business through the Society for Worldwide Interbank Financial Telecommunication (Swift), must get this “illegal state of affairs” corrected “immediately”.That’s just what the authorities fear - that a transatlantic agreement between Swift and the US becomes a precedent for other agreements which subvert the broader legal principles the data protection wonks are fighting to protect. [Source]

AU – Debt Companies Target ‘Good’ Shoppers

Australian and New Zealand credit information companies will have the power to sell detailed records about responsible borrowers, not just those in serious debt, as part of a current review of privacy laws in New Zealand and Australia. Veda Advantage chief executive Andrew Want said today a sweeping review of privacy laws could see the company introduce a service by 2009 providing information about consumers who are a good credit risk. Currently, it is illegal to sell such information. But work by the Privacy Commission in Australia to streamline privacy rules between Federal and State Governments, and to bring them in line with the current developments with technology, could change that. Similar reviews are underway with the Law Commission in New Zealand. [Source] See also: [Solove et alia The Rise of Customer Blacklists]

CA – Toronto Police Urged to Make Grow-Op List Public

CTV News has obtained a list of the more than 1,000 homes in Toronto that have been used as marijuana grow-operations since 2003, but there are calls to make the information available to the public. Police Chief Bill Blair says the force is considering posting the addresses on its website, but he said there are some legal and privacy issues involved. CTV obtained the list after filing a Freedom of Information request. Some city councillors said it was material even they couldn’t get their hands on. [Source]

US – HHS’s Kolodner Addresses Trials, Privacy

Robert Kolodner, interim national coordinator for health information technology, announced that his office is poised to request proposals for contracts that would fund trial implementations of state, regional and local health information exchanges. Kolodner made the announcement during a keynote address this week at the Healthcare Information and Management Systems Society conference in New Orleans, and-in his presentation-he also talked about how consumers should have significant control over who has access to their healthcare information. “Privacy is not just a federal issue,” Kolodner said, adding how a successful privacy and security strategy has to be “resilient” in order to address emerging technology. But this strategy would involve allowing individuals to decide “whom they trust” to gather and store their personal information, Kolodner said, as well as allowing them to decide:

· If they want their information to automatically flow to their primary-care physician and personal health record.

· If they want to prevent the flow of information to certain providers or payers.

· If they want to block all flow of their personal information.

Kolodner also discussed allowing consumers to be able to make corrections to their medical record. [Source] [Patient control of EHR data on network gets mixed reaction] [Health Care Pros Debate Interoperability Standards] [Privacy Concerns Abound With Commercial Databases of Medical Data]

CA – Toronto’s SickKids Notifies Study Participants of Stolen Laptop

The Hospital for Sick Children (SickKids) is notifying patients that have participated in 10 different research studies about a stolen laptop that contained their personal health information. The laptop was stolen on January 4, 2007 from the car of a physician who was doing data analysis. SickKids reported the incident to Ontario’s Information and Privacy Commissioner (IPC) and is working in full cooperation with the IPC in an independent review of this incident. [Source] [Stolen laptop sparks Order by Commissioner Cavoukian requiring encryption of identifiable data: Identity Must be Protected]

UK – Laptop Theft Exposes Information on County Council Staff — Bank and national insurance information of more than 16,000 staff is at risk for identity theft since a laptop was stolen from an employee of the UK council’s IT supplier. The council has notified the affected staff and has offered a hotline for callers seeking more information on how to protect themselves from fraud. [Source]

US – FBI Investigates Security Breach Involving Patient Information — Westerly Hospital in Rhode Island is notifying 2,246 patients that their personal information, including SSNs, was found on a Web site not connected to the hospital. Local and federal law enforcement officials are trying to determine how the information made its way to the Web site, which was discovered by a user who had Googled her own name. Initial investigation indicates that the hospital’s computer system was not breached, leading investigators to surmise that the breach may have been connected to a hospital contractor that had access to the data. The hospital will pay for credit monitoring services and is in the process of setting up a hotline to assist patients. [Source]

US – State Health Officials Issue Apology for HIV Patient Information Breach — The identities of at least 53 patients in California who have been infected with HIV were exposed after a mistake by an employee working for the state’s AIDS Drug Assistance Program. The employee mistakenly put letters containing names and addresses of patients into the wrong envelopes. The director of the California Department of Health Services said the agency has reassigned the employee and will take additional precautions to make sure there are no more patient information breaches. [Source] [Source]

IR – Stolen Computers Raise Data Theft Fears in Northern Ireland — 55 computers have been stolen from Northern Ireland civil servants over a nine-year period. The value of the stolen equipment is 90,900 Euros. A Northern Ireland Office spokesperson said “We need to know what information was there. ... We need an assurance that personal information was not on these computers.” A Department of Finance and Personnel spokesperson said the computers did not hold confidential information. [Source]

US – Texas A&M System Breach Forces Password Changes — All users of Texas A&M University computer systems are being forced to change their passwords following an attempted breach of files that contain encrypted passwords. All 96,000 students, faculty and staff are being told to change their NetID passwords. Financial, payroll and student administrative systems were not affected by the breach. [Source] [Source]

JP – Missing Hard Disk Holds Student and Alumni Data — An external hard disk containing PII of approximately 8,800 students and graduates of Tokyo University of Science was stolen on February 24. A professor had taken the device home with him, but the bag it was in was stolen while he was on a train home. The professor will face punishment. [Source]

US – Stolen Computers Hold Child Patient Data — Two laptop computers stolen from a locked vehicle in the parking lot of Seton Highland Lakes Hospital near Austin, TX hold PII of approximately 2,500 juvenile patients treated by the hospital’s mobile medical unit. The data include names, medical information and SSNs. [Source]

US – Thief Stole Credit Card Numbers from Seed Site — A cyber thief broke into the web site of Johnny’s Selected Seeds and stole sensitive customer data, including credit card numbers; in all, 11,500 accounts were compromised. Approximately 20 of the stolen card numbers have been used fraudulently. The site is now under 24-hour monitoring to prevent a recurrence; other security measures have also been implemented. Johnny’s has notified all people whose account information was stolen. The initial intrusion occurred on 07 February. A company official said “criminals gained access to our internal systems and gathered enough information to allow then to gain access to our web site.” [Source]

US – Stolen Metro State Computer Holds Student Data — A laptop computer stolen from a faculty member’s office at a Denver State College held names and SSNs of students who took courses from a professor from fall 1999 through fall 2002. The professor may face disciplinary action. In addition, Metro State is in the midst of a project that requires all college-owned laptops to be submitted to the IT department so the data they hold can be reviewed. The school is attempting to notify all affected students by mail. [Source] See also: [Source] and [Source]

UK – “Nothing to Fear over ID Cards Privacy,” Says UK Passport Chief

The man in charge of the government’s national ID cards scheme has dismissed claims the cards will lead to a personal audit trail of each citizen’s movements and transactions. Privacy groups have claimed records of each time an ID card is used, where and what it is used for will create a vast personal tracking database of every individual on the National Identity Register. But James Hall, CEO of the Identity and Passport Service (IPS), said in an online webchat on the Downing Street website that most uses of the ID card will probably not involve accessing the NIR and would therefore not create an audit trail. He said: “I sort of feel ‘damned if you do, damned if you don’t’ with this. The audit trail is an important protection so that citizens can see who has accessed their record and when. But on the other hand, I understand there is also a concern that it could be used to infer something about a pattern of activities. “However, the Identity Cards Act forbids the provision of the audit log to private sector organisations and it could only be seen by the police or security services in the case of serious crimes.” [Source] See also: [Data sharing powers questioned in Lords] See also: [The truth about Charles Clarke’s ID card claims]

CA – Ontario to Get Toughest ID Check System in Canada

The Ontario Convenience Store Association (OCSA) has unveiled what is the toughest system of ID checks for age restricted products in the country. The ‘We Expect ID’ program is a rigorous age verification system to prevent youth from getting access to restricted products sold through convenience stores, including: alcohol, tobacco, movies, adult-themed magazines, lottery tickets, fireworks and other combustibles. “‘We Expect ID’ has been under development by the convenience store industry for over two years and takes a zero-tolerance approach to keeping restricted products away from youth,” said Dave Bryans, President of the OCSA. “With this system, anyone that appears under the age of 25 who intends to purchase a restricted product must present their driver’s license and have it swiped as proof of age.” In each and every case, store employees must swipe customers’ licenses through the lottery terminal. The terminal reads the age information from the magnetic stripe on the back of each license and presents the person’s age prominently on the terminal’s display. [Source] [Press Release] [OCSA Presentation] Coverage: [New ID checks could violate privacy: Minister]

CA – Airports Give Thumbs-Up to ID System

Security is soaring at Canadian airports with the rollout of a dual biometric-based airport identification card program by the Canadian Air Transport Security Authority (CATSA). The Restricted Area Identity Card (RAIC) program, implemented across 29 Canadian airports, was an initiative by the Ministry of Transport that began in 2002 in a bid to beef up security at Canada’s airports. To date, some 100,000 Canadian airport workers are enrolled in the RAIC program, which involves a two-factor biometric-based authentication system. The program uses chip-based smart cards, issued to all airport personnel, and biometric readers for fingerprint or iris verification, according to Peter Burden, RAIC program manager at CATSA in Ottawa. [Source]

CA – 1 in 6 Canadians Hit by Identity Theft, Survey Suggests

Identity theft has hit one out of every six adult Canadians - more than 4.2 million people - either directly or within their immediate households, a survey suggests. The poll, conducted in 2006 by the Strategic Counsel for the Competition Bureau of Canada, suggests that 17% of Canadians aged 18 or older have either been victimized themselves or had an incident affect someone in their homes. Even more people have been hit by marketing fraud, according to the survey: 31% or about one in three adults. Yet Canadians are not likely to complain to the authorities when they are victimized in marketing frauds, according to the survey. “It remains the case that few people make a significant effort to report or resolve an incident of marketing fraud,” the report said, with 43 per cent saying that they “did nothing.” [Source] [Source]

US – Research Firm Gartner Says ID Theft Continues to Rise

Stamford, Conn.-based research firm Gartner released a report on Tuesday that states that about 15 million Americans were victims of identity theft between mid-2005 and mid-2006. This is more than a 50 percent increase from the Federal Trade Commission’s estimate of 9.9 million in 2003. According to Gartner, the amount of money that victims are losing also is increasing and they are recovering less of it. The report comes in contrast to a study released by Javelin Strategy and Research last month that showed identity theft on the decline. [Source] [Source] See also: [New twist on ID theft: 7 admit they sold theirs] [Password problems lead to ID theft, report] and also: [Tennessee Lawmaker Pushes Identity Theft Bill] [Tougher ID Theft Penalties Headed to Oklahoma House Floor] [Mississippi Identity-theft protection bill moving forward] and, generally: [Developing Best Practices to Combat ID Theft, Part 1, Part II]

CA – ID Analytics Announces Breach Analysis Services

ID Analytics, an Identity Risk Management company, has announced the availability of Breach Analysis Services for enterprises. This intent of this service is to determine whether a data breach is truly a source of identity theft or related harm. [Source]

WW – New Certification Makes It Harder for Phishers to Create Counterfeit Web sites

Microsoft has developed a new seal of approval for Web sites, called an Extended Validation Secure Sockets Layer (EV SSL) certificate, which is intended to reassure consumers that they are dealing with secure Web sites. The certification process will require third party certifiers, such as VeriSign and Entrust, to implement more rigorous guidelines for Web sites seeking approval. Sites that have an EV SSL authentication will display a green address bar and users will be able to see the country in which the site is based. [Source] [Source]

WW – New Online Data Privacy Computer Based Training Program Offered

Watchfire announced a new Computer Based Training curriculum tailored specifically for privacy professionals. Organizations understand the importance of data privacy but need help educating employees to ensure proper protection. Watchfire is now offering WebXM Privacy training curriculum to meet the specific needs of our privacy and compliance customers. This extends the Company's recently announced Fanatical Success Program-a program which not only provides companies with the best technology, but is dedicated to closing the knowledge gap amongst user groups, building out sustainable processes, and supporting customers 100 percent along the way. [Source]

US – Man Sues Microsoft for Failing to Protect his Privacy

A man in jail “awaiting trial for alleged gun crimes is suing Microsoft for privacy violations.” Michael Alan Crooker says when he bought his computer at Circuit City, he was assured that the security features he purchased at the same time would protect his privacy. Instead, when his computer was seized as part of the investigation, it was sent to the FBI’s Cryptologic and Electronic Analysis Unit, where agents uncovered personal files, some embarrassing. Crooker maintains he had set Internet Explorer to purge his history every five days, but agents were able to discover evidence of his Internet activity on earlier dates. He also said that the Compaq DriveLock security system should have prevented access to his hard drive. Crooker is seeking US $200,000 from Microsoft and says he has already reached settlements with Hewlett-Packard and Circuit City. Hewlett-Packard owns the Compaq brand. [Source] [Source] [Source] See also: [Seven ways to keep your search history private]

WW – Wikipedia Wants ID from Self-Proclaimed Experts

Following revelations that a high-ranking member of Wikipedia's bureaucracy used his cloak of anonymity to lie about being a professor of religion, the free Internet encyclopaedia plans to ask contributors who claim such credentials to identify themselves. Wikipedia founder Jimmy Wales said that contributors still would be able to remain anonymous. However, he said they should only be allowed to cite some professional expertise in a subject if those credentials have been verified. [Source]

US – DOJ Takes Aim at Image-Sharing Sites

The Bush administration has accelerated its Internet surveillance push by proposing that Web sites must keep records of who uploads photographs or videos in case police determine the content is illegal and choose to investigate. That proposal surfaced Wednesday in a private meeting during which U.S. Department of Justice officials, including Assistant Attorney General Rachel Brand, tried to convince industry representatives such as AOL and Comcast that data retention would be valuable in investigating terrorism, child pornography and other crimes. [Source]

HK – Trans-Border Data-Transfer Privacy Under Study in Hong Kong

The Hong Kong Government will map out the best way forward on privacy issues relating to trans-border data transfer, taking into account the interests of relevant stakeholders, Secretary for the Civil Service Denise Yue says. She told lawmakers today the Personal Data (Privacy) Ordinance is under review, which covers Section 33 which is not yet in operation. The section prohibits the transfer of personal data from Hong Kong to places that do not have adequate data-protection legislation. Miss Yue pointed out the commencement of the operation of Section 33 will have significant implications on trans-border data-transfer activities of various business sectors, notably the banking and telecommunications sectors. Miss Yue said the Privacy Commissioner will put forward recommendations after the review. [Source]

UK – UK’s RFID-Equipped Passports Readable Through Envelope

Using equipment readily available on the Internet, the Daily Mail was able to construct a device that can read information from an RFID-equipped passport. Within four hours, the Mail managed to download enough information to create a phony passport without opening the envelope in which the new passport was delivered. The RFID chip holds an electronic copy of the photo page from the passport, an electronic photo and a device that ensures the other two files have not been altered. To access these files, the computer needs the key that is printed in the last line of the passport’s machine-readable zone on the photo page. The Mail was able to determine the code relatively easily because it virtually always includes the holder’s birth date and the passport’s expiration date. Furthermore, attackers are not locked out after any number of incorrect attempts. [Source] [Source] [Source]

US – Senate RFID Caucus Holds First 2007 Meeting

The US Senate RFID Caucus held its first event of 2007 on Capitol Hill thsi week called “RFID and Innovation: America’s Competitive Edge”. RFID industry experts held a general discussion on what RFID is and how it is currently being used. The event marked the first of four planned Senate RFID Caucus events for the calendar year 2007. Based on conversations with Senate staff, the next event will likely pertain to issues with RFID in the Healthcare sector. [Source] See also [Lawmakers working to ban hacked RFID door cards] and [Castrated RFID Talk at Black Hat]

US – Activists Claim Success: No RFID Chips Required in Driver’s License Regulations

Citizens Against Government Waste (CAGW) declared a victory for taxpayers and drivers after the Department of Homeland Security (DHS) released proposed regulations for personal identification that do not mandate the use of RFID technology. CAGW has released two reports, “Real ID: Big Brother Could Cost Big Money“ and “Border Security: PASS Card Fails on Cost, Privacy“ criticizing RFID-based identification. The group claims the total cost of issuing new licenses with RFID chips could reach $17.4 billion and the average cost of a license would shoot from between $10 to $20 to more than $93. In contrast, the National Conference of State Legislatures estimated that it would cost $9 to $13 billion to implement REAL ID Act regulations based on current licensing techniques. RFID also threatens privacy, said CAGW in a release, raising the possibility of identity thieves remotely accessing their victims’ personal information with a hand-held scanner. [Source]

EU – European Retailer Embeds RFID Chips in Shoes

One of Europe’s largest shoe companies plans to embed wireless chips in shoes sold at hundreds of stores across the continent. Under a deal announced Friday, Checkpoint Systems Inc. will provide Reno GmbH with RFID (radio frequency identification) tags and store tagging systems. The tagging specialist will deliver wafer-thin RFID chips designed especially for shoes from its Asian production facilities, in addition to systems that allow check-out clerks to quickly and easily deactivate tagged products. By having the tags integrated into it shoes, Reno aims to curb theft for both boxed products and those on display, as well as shoes customers try on in the stores. Reno has been using RFID technology to track product shipments from its factories to its stores for several years but has not yet used the technology to track individual products inside each store. [Source]

WW – Tizor Launches First Data Auditing & Protection Blog

Tizor Systems, a provider of enterprise data auditing and protection solutions for the data center, has announced the launch of the DataAuditingBlog, the first blog about data auditing and its related subjects, targeted at professionals charged with security, IT and compliance for their companies as well as IT auditors, database practitioners, customers and partners focused on the data security industry. “There are a lot of terms including data auditing, protection, leakage and encryption being thrown around right now and recent data breaches as well as an expanding roster of compliance regulations have led to heightened awareness and confusion for both the public and enterprises responsible for critical data. My hope is that by blogging weekly about data auditing and related topics that I will provide a collaborative setting to start collectively clarifying the issues around auditing for compliance and data protection.” [Source] [Blog] See also: [Security alerts often go unnoticed by IT pros. Why?]

WW – Security Tip of the Day: USB Drives

Tip: Don’t plug in USB drives that you find lying around. Criminals can use them to steal your data – People’s natural curiosity and desire to help were exploited by consultant Steve Stasiukonis, who was hired to check security awareness at a credit union. He loaded malicious software on old thumbnail drives and left the drives on the ground and tables in the parking lot and smoking areas. Each time a curious, helpful person plugged any of the thumb drives into his computer, it loaded software and reported who had taken the bait. His test was harmless, but criminals can use the same technique to take control of our computers. [Source]

AU – Australian Government Defends Access Card as Criticisms Grow

At the first day of Australian Senate committee hearings into the access card system, which will hold 16 million photographs, the Government dismissed the idea the store would be linked to closed circuit television systems, but has admitted police and security agencies will be able to use the system to identify suspect individuals. The Government has fought claims that the Access Card will develop into an identity card and is proposing heavy penalties against non-government bodies who demand it for identification purposes. Opponents have suggested that the Access Card scheme is a taxpayer subsidy for banks to adopt smartcard technology, No ID Card campaign director Anna Johnston has told a Senate inquiry: “The Bill is silent on how the smartcard infrastructure may be used by business, yet the chief technology architect is due to tell an industry summit how the card could become the ‘common railroad’ for retail,” she said. “Australians deserve to know whether the scheme is effectively a taxpayer subsidy for banks and retailers, which have not otherwise seen the business case for adopting smartcards.” Ms Johnston said it was outrageous to expect the public or parliament to agree to spending $1.1 billion on the scheme “without the Government first showing us all the details”. [Source] [Source] [Access card laws may be tightened] [Australia Govt ‘Misled’ Card Inquiry: Greenleaf]

US – White House Board OKs Eavesdropping Program

A White House privacy board has determined that two of the Bush administration’s controversial surveillance programs, electronic eavesdropping and financial tracking, do not violate citizens’ civil liberties. After operating mostly in secret for a year, the five-member Privacy and Civil Liberties Board is preparing to release its first report to Congress next week. [Source] [Source] See also: [Top Secret: We’re Wiretapping You] and [West Virginia warrantless surveillance in homes struck down by court] and [DHS Profiling Program Raises Privacy Flags]

EU – Italy Tops Global Wiretap League: Report

Britain may have more CCTV cameras per head than anywhere else in the world but when it comes to electronic surveillance the country is way behind Italy, the Netherlands and even Sweden. Official figures have revealed UK law enforcement agencies and other government bodies made 439,000 requests to monitor telephones and email addresses in a 15 month period between 2005 and 2006, leading to comments that Britain led the world in spying on its citizens. A report from the UK Interception of Communications Commissioner reports that 4,000 "errors" were made over the report period. Most concerned less serious slip-ups involving requests to obtain lists of telephone calls and individual email addresses, but 67 involved errors that led to the direct interception of communications. The UK figures might sound high but are dwarfed by interception statistics from other countries. According to figures from German scientific think-tank the Max Planck Society, Italy leads the world with 76 intercepts per 100,000 head of population, shortly ahead of the Netherlands (62), and with third-placed Sweden some way back (33). Germany comes in fourth with 23.5 intercepts per 100,000 head of population with England and Wales trailing on six intercepts per head of population. [Source] See also: ['Big brother' surveillance makes waves in Sweden]

UK – Road Tolls as Privacy Friendly Dismissed As “Nonsense”

UK government claims that a fresh plan for road pricing will allay motorists’ fears about invasions of privacy were dismissed as “nonsense” by an anti-tolls group. Ministers are considering dividing up Britain into a network of road-pricing zones, charging drivers varying prices depending on how busy they are. Roads Minister Stephen Ladyman said the scheme would get round the concerns of motorists who object to the tracking of their movements by a satellite positioning device placed in their cars, as the Government is currently proposing. The National Alliance Against Tolls (NAAT) said: “This is nonsense. Whatever system they use they can still record this (movement of drivers) information, whether it is based on ‘black boxes’ or cameras.” Mr Ladyman’s comments follow the signing by 1.8 million people of a petition on the Downing Street website opposing the idea of road pricing. NAAT said: “The Government and its supporters are pretending that privacy concerns was the main reason that people signed the petition. If that was so, why did the petition get 1.8 million signatures while the petition against ID cards got only 28,000 signatures? “Various surveys, including two carried out for the Government last year, have shown that drivers are very strongly opposed to road pricing. Those who know more about road pricing are also horrified by the billions that would be wasted in setting up and running such a system.” [Source] [Source] [Source] [Source] [Source] SEE ALSO: [RFID to help European Commission cars communicate] and [Cameras in cars keep watch on teen driving] and [Japan’s National Institute of Information and Communication Technology (NICT) is conducting an experiment with RFID to reduce traffic accidents near intersections]

US – NYC Council Passes Nightclub Videosurveillance Security Law

Invoking the name of the 24-year-old woman who was raped and killed after leaving a Manhattan bar last year, the NY City Council passed a package of legislation this week aimed at changing the way nightclubs operate. Pending the mayor’s signature, which is expected, all clubs where dancing is permitted will be required to install surveillance cameras at entrances and exits. While some council members raised privacy concerns, the overwhelming majority agreed the surveillance tapes would be an invaluable crime deterrent and aid police if a crimse is committed. All surveillance tapes must be securely stored, and clubs could be fined $50,000 if the footage makes its way onto TV or gossip Web sites. Industry representatives welcomed the surveillance camera vote, but pointed out that 90% of clubs with dancing already have such cameras installed. [Source]

US – House Moves to Outlaw Phone Number Spoofing

Congress is considering a bill to outlaw fraud and harassment through spoofing -- altering phone numbers that appear on caller ID -- after a similar measure died last year. A bill to outlaw spoofing to defraud or cause harm is headed to the House Committee on Energy and Commerce. The Subcommittee on Telecommunications and the Internet approved the bill after a hearing Wednesday. The bill, H.R. 251, would allow victims of domestic violence, crime tipsters, and others with legitimate reasons to conceal their numbers while providing an alternative on caller ID. That distinction clarifies language in the bill that was offered up last year. [Source]

US – ISPs fear SAFETY Act Retention Requirements

Privacy advocates aren’t the only ones up in arms over a bill currently being debated in Congress that would require Internet service providers (ISP) to retain records on subscribers. ISPs themselves are saying the bill contains no clear guidelines for records retention methods or archiving periods for data, and said they are growing nervous about the storage and data management costs that might result if the bill becomes law. The passage prompting debate in the industry is Sec. 6 of the Internet Stopping Adults Facilitating the Exploitation of Today’s Youth Act of 2007 (SAFETY), the newest of several versions of Internet records.retention measures introduced to Congress Feb. 5 by Rep. Lamar Smith, R-Tex. So far, previous versions of the legislation have all died in committee. The bill, which is still being debated in the House, is the first formal bill to be introduced to Congress on this issue. [Source]

UK – Customer Respect Group: Telcos Need to Boost Consumer Privacy Online

The Customer Respect Group, a research and consulting firm that researches how corporations treat their online customers, this week released findings from its First Quarter 2007 Online Customer Respect Study of the Telecommunications Industry. The study’s findings indicate that telecommunications companies are not addressing consumers’ privacy concerns to the extent found in other high-tech industries and the retail sector. The study found that telcom firms collect more personal data than other companies. Oftentimes, the data the company seeks is not related to the customer’s request. The study analyzed 54 Web sites in the U.S., Canada and the United Kingdom. According to the survey, 64 percent of companies ask for too much personal information, compared with 43% in other industries, the group found. [Source]

[Customer Respect Group] [Study]

US – DHS Issues REAL ID Act Guidelines

The Department of Homeland Security (DHS) has issued guidelines to instruct states how to implement new driver’s licenses. DHS also has agreed to extend the implementation deadline past the initial May 2008 deadline. States that are unable to meet the deadline will have until Dec. 31, 2009, to launch the program, which requires states to introduce physical and electronic safeguards for the cards and at the registry locations. In the 162-page “Notice of Proposed Rulemaking,” DHS states that “any system developed for purposes of the REAL ID Act will build in appropriate privacy and security mechanisms to reduce the risk of unauthorized access, misuse, fraud, and identity theft.” [Source] [Source] [Source] See also: [Opponents Of REAL ID Act Issue New Call For Repeal Of Federal Law] [Draft Proposed Regulations] [Coverage] [ACLU Slams Draft DHS Regulations on Real ID, Says Delay Fails to Address Privacy and Civil Liberties Concerns]

US – FTC Seeks to Stop “Demand Side” of Spyware

The Federal Trade Commission plans to escalate its attack against what is called adware or spyware by going after some of the big-name Internet advertisers that hire the online distributors. “We need to stop the demand side of spyware,” said Jon Leibowitz, one of the five commission members and a Democrat. The FTC is sending letters to up to 200 major corporations to warn them to monitor how their ad dollars are used online. Said Leibowitz: “This is a wake-up call to put them on notice. That would be a good way to choke off the money.” The FTC move follows New York State’s actions against Travelocity, Priceline and Cingular. [Source] See also: [New York attorney general recently announced separate settlements

with three major online advertisers] and [Best Practices: Factors for Use in the Evaluation of Potentially Unwanted Technologies] and [Malware Increased 172 Percent in 2006, According to Report]

US – Senators Introduce Amendment to Delay Implementation of REAL ID Act

Senate debate on anti-terrorism legislation heated up over national standards for driver’s licenses. The opening debate in the Senate on The Improving America’s Security Act of 2007 – which would implement the Sept. 11 bipartisan commission’s recommendations – included a flare-up over implementation of the REAL ID Act. Sen. Susan Collins, R-Maine, introduced a REAL ID amendment to postpone the law’s implementation date until May 2010. The amendment also called for technology experts and privacy advocates to weigh in on the standards. The overall bill includes provisions to improve privacy protections, including more independence for a board that monitors whether anti-terrorism programs violate civil liberties and annual reports from federal agencies on data-mining technology. [Source] [REAL ID Deadline Evaporates Under Pressure ] [A brief history of Real ID] [Highlights of Proposed Rulemaking] [Cost and Privacy Concerns Cited In New Rules for Driver’s Licenses] [ACLU Praises Akaka-Sununu Real ID Repair Proposal]

US – Washington State Senate Delays Adopting National ID Standards

Washington lawmakers want specific guidelines to be met before the state starts implementing the federal Real ID Act, a 2005 law signed by President Bush requiring strict national standards for state-issued driver’s licenses. The state Senate passed a measure today that directs the state not to spend money to implement the act unless privacy and security protections have been met, the implementation doesn’t place unreasonable costs or record-keeping burdens on citizens, and the state has received federal money to put the act’s requirements into effect. The measure, Senate Bill 5087, passed 41-4, with one senator absent and three excused. [Source] See also: [Hawaii Lawmakers Fight REAL ID Act] and [Massachusetts Card makers blast State’s Real ID opposition] [Wisconsin’s Doyle attacks driver ID rules] [Lawmakers call Real ID Act an 'unfunded federal mandate']

US – Colorado and Montana Drop Do-Not-Mail Bills

Colorado Rep. Sara Gagliardi tabled a do-not-mail bill on March 1. A week earlier, Montana Rep. Franke Wilmer killed a do-not-mail bill. Both had received opposition from retailers, unions, and other associations, including the National Letter Carriers Association. Both bills would create a do-not-mail registry similar to the do-not-call registry. Gagliardi said she plans to reintroduce a revised version of her bill next year. Similar bills are pending in Connecticut, Colorado, Hawaii, New York, Maryland, Michigan, Missouri, Texas and Washington. New York, Virginia, New Jersey and Washington also have introduced measures to create registries prohibiting certain types of mailings to certain senior citizens, those with mental illness and people under 21. [Source]

US – New York Taxi Drivers May Strike Over GPS Requirement

New York Taxi drivers are threatening to strike over the new tracking technology and credit card payment systems the Taxi & Limousine Commission is requiring them to install in their vehicles. More than 100 drivers and medallion owners bundled up in scarves and ski caps for a rally in front of the Commission headquarters on Rector Street this week, protesting the global positioning systems they say will infringe on their privacy rights. Holding up signs reading "Stop GPS" and "Ready to Strike," taxi drivers called the new technology an expensive "snake oil scam" that they will be forced to pay for. [Source]

--------