Privacy News Highlights
16–22 December
2005
Contents:
US – NIST Releases
Biometric Data Specifications
YK – Privacy Commissioner Calls on Yukon
Government to Act
MB – Proposed Law Forces Companies to
Report Information Leaks
US – Is Your Phone Number All They Get?
CA – U.S., Canadian Officials Target Spam
Operations
US – CAN-SPAM Act “Effective,” FTC Says in Report to
Congress
US – OMB Report on e-Gov Shows Mixed Progress on
Technology Initiatives
US – ABN Amro Eyes Electronic Data Transfers After Tape
Loss Incident
US – Draft Recommendation for Random Number Generation
EU – MEPs Approve Data Retention Directive
UK – Study: Mobile Telecoms Providers Still Breaking
Email Privacy Laws
CA – MasterCard to Introduce New,
High-Security Chip Cards
US – Survey: Government Tightens Access to Information
US – Bush Orders Easier Access to Records
US – Stakeholders Band to Create Statewide Health
Information Network
US – LaSalle Bank Hit with Security Breach
US – Hackers Break Into Computer-Security Firm’s Customer
Database
US – RSA Federated Identity Manager Win US Gov’t
E-Authentication Contract
US – RIAA Files File-Sharing Lawsuits Against 751 People
EU – BEUC in Defence of Consumer Rights Online
EU – Intellectual Property: Evaluation of EU Rules on
Databases
WW – OECD: Scoping Study for Measurement of Trust in the
Online Environment
AU – Anxiety Mounts Over Scope of New Police Laws
US – Anti-Offshoring Efforts on the Rise
UK – eBay Blames Users for Online Fraud
UK – Consultation on Secure Record of Electors Held
Centrally
US – EPIC FOIA Documents Reveal DHS Knew of High-Tech
Passport Flaws
WW – Gartner Study: RFID to Top $3 Billion by 2010
US – Cybercrime Treaty Before Senate
AU – Smartcard Framework Feedback Sought
US – Bush “SnoopGate” Eavesdropping Controversy Deepens
U.S. – FBI Targeting Rights Groups Activities as
‘Domestic Terrorism’
CA – Canadian Regulator Orders Number
Portability by 2007
US – Florida Seeks Huge Fines for DO NOT CALL Violations
US – FTC Says Federal Spam Law Has Worked
US – 30,000 Travelers Improperly Matched to Terrorist
Watch Lists
US – House Immigration Bill Includes National ID Plans
US – Senate Votes to Extend Patriot Act by Six-Months
US – Proposed ID Theft Bill Requires Strong Notification
Measures
US – Senate Panel Approves Bill Expanding FTC Powers
Online
The National Institute of Standards and Technology has
released long-awaited biometric data specifications for secure federal identity
cards. Agencies must begin issuing the secure cards to employees and
contractors by Oct. 27, 2006. The specifications NIST released this week include
an interoperable standard for storing fingerprint minutiae, or data extracted
from fingerprint images. Fingerprint-matching equipment must be interoperable
with fingerprint minutiae stored on the new cards. Traditional fingerprint
images will still be required during the registration process that employees
and contractors must undergo before they receive the new identity credentials. [Source]
The
of Privacy report to the government this week. His
report last year said there was a trend within government towards secrecy. He
also recommended the creation of an access to information and protection of
privacy manual for government employees, training for ATIPP co-ordinators and a
review of the Act. Moorlag is still
waiting for a reply from the Yukon Party government. “Well, I didn’t get a
response to the suggestions and recommendations I made in the report last year
and I expected to have one,” he says. “You know, that the recommendations would
be acknowledged and there would be some thought given to implementing them. I
didn’t hear that so I’m making that comment again.” Moorlag includes examples
in his report of how other jurisdictions have responded to recommendations from
their privacy commissioners. [Source]
Privacy advocates advise against revealing phone
numbers when asked at the checkout line – this innocent question may not be
innocent at all. Ponemon Institute founder Larry Ponemon offers that “some
stores are thinking there’s money in your data.” EPIC’s Chris Hoofnagle agrees,
“The various data companies are trying to acclimate people to invasions of
privacy. It started with the zip code and now it’s moved on to phone numbers.”
This article suggests that “phone numbers are used to organize much more than
just who gets the best coupons, and that’s what worries the privacy experts.” [Source]
About 70% of the world’s e-mail messages continue to
be spam. But the number is leveling off, which FTC officials cited as evidence
that a law enacted two years ago is working. The FTCs “Effectiveness
and Enforcement of the CAN-SPAM Act“ 116-page report released this week
cites their accomplishments over the past two years, identifies new challenges
and advocates for broader international authority. Three measures to further
improve the effectiveness of CAN-SPAM were highlighted: private-sector technology
is essential to combat spam; supporting efforts to make it harder for spammers
to hide their identity; and backing the U.S.
Safe Web Act of 2005 bill to “enhance the agency’s ability to combat
illegal spam sent from overseas.” [Source] [Source]
In the past year, the federal government met major
information technology milestones and saw increased use of e-government
services by citizens, businesses and agencies, according to a report released this
week by the Office of Management and Budget. Titled “Expanding E-Government:
Improved Service Delivery for the American People Using Information Technology,”
the report assessed progress in 2005 and set goals for the coming year. All 25
of the reviewed agencies had “effective” enterprise architectures, or systems designed
to eliminate redundancies in business functions, processes and technologies,
the report stated. OMB reported that 21 of the 25 agencies had acceptable
business cases for IT systems projects, exceeding the 2005 goal of having
passable cases at three-quarters of the agencies. The 2006 goal is to have
acceptable business cases at 90%. [Source] [Source]
ABN Amro Mortgage Group Inc. has decided it will no
longer send data tapes to its credit reporting bureaus after one of those tapes
– with the private information of more than 2 million customers on it – went missing
a month ago. Instead, according to ABN Amro CEO, the company will encrypt data
and send it over secure networks when possible. Otherwise, it will use special
couriers in an effort to avoid another tape loss. Those changes were announced
on the same day the company said it had located the missing tape containing
sensitive data about residential mortgage customers, which was lost Nov. 18
while being transported by a delivery service to a credit reporting company.
The tape was found yesterday, three days after the company began notifying
customers that it had been lost. [Source]
A draft NIST Special Publication (Draft SP 800-90,
Recommendation for Random Number Generation Using Deterministic Random Bit Generators)
is available for public comment. Comments should be submitted to Elaine Barker
by Wednesday, February 1, 2006. Please place “Comments on SP 800-90” in the
subject line. [Source]
[Source]
The European Parliament approved a draft Directive on
data retention that will see ISPs and telcos retain phone and internet records
for up to two years for use in investigation of criminal and terrorist offences.
MEPs voted to adopt the Directive with 378 votes in favour, 197 against and 30
abstentions. The Directive sets out an EU-wide system of retaining
communications data - data that identifies the caller, the time and the means
of communication (e.g. subscriber details, billing data, e-mail logs, personal
details of customers and records showing the location where mobile phone calls
were made). It does not allow for the retention of the content of the communications,
but will retain details of connected, but unanswered calls. The inclusion of
these so-called “los” calls is controversial, and had been one of the sticking
points between MEPs and Ministers. MEPs were concerned that telcos do not
currently register such calls, because no bills are issued in respect of them,
and it would be expensive for these firms to adapt their systems. The data will
be retained for a minimum of six months and a maximum of 24, and will be made
available to the police and judiciary in order to investigate terrorism and
serious crime. The data retained will only be disclosed in specific cases and will
be subject to strict data protection rules. Any abuse of the data will be
subject to sanctions. [Source] See
[Ireland to contest data retention
law at EU Court] [Background]
According to a new report by data and direct marketing
services company CDMS, a third of the UK’s top 200 companies (spanning thirteen
main consumer business sectors – Banking, General Insurance, Credit Card,
Building Societies, Publishing, Broadcasting, Retail, Fixed and Mobile
Telecoms, FMCG, Mail Order, Utilities and Travel) are not complying with email
marketing legislation that became effective in December 2003. This company’s
director warned that companies not in compliance “do not care about privacy
legislation.” [Source]
[Source]
MasterCard
Freedom of
Information Act
(FOIA) requests are being denied by the
President Bush directed federal agencies this week to ease
access to government records following years of criticism for withholding
public information. Bush signed an executive order that attempts to create a “citizen-centered
and results-orientated approach” to requests filed under the Freedom of Information
Act, according to the order. The administration has come under fire from open
government advocates and media organizations for failing to release public
records requested under the law; removing documents from Web sites; and allowing
requests for information to languish for years before rejecting them. The
president’s order requires each federal agency to designate a senior public
official-at least the level of assistant secretary – to preside over FOIA
requests and come up with a plan to speed up the release of records and reduce
chronic backlogs. In addition, Bush wants each federal agency to establish a
At the urging of Michigan Governor Jennifer Granholm
and federal health officials, healthcare providers and purchasers, employers,
health plans, patient advocacy groups, technology vendors, labor and government
officials have joined together towards the goal of creating an interoperable
Michigan Health Information Network in the state. [Source]
LaSalle Bank Corp. says a computer tape bearing
confidential information on about 2 million residential mortgage customers
disappeared last month as it was being transported to a consumer credit company
in
Guidance Software – a provider of software used to
diagnose hacker break-ins – has itself been hacked, resulting in the exposure
of financial and personal data connected to thousands of law enforcement officials
and network-security professionals. Guidance alerted customers to the incident
in a letter sent last week, saying it discovered on Dec. 7 that hackers had
broken into a company database and made off with approximately 3,800 customer
credit card numbers. The Pasadena, Calif.-based company said the incident
occurred sometime in November and that it is working with the U.S. Secret
Service on a more detailed investigation. [Source]
[Source]
RSA this week announced that the U.S. Treasury
Department Financial Management Service (FMS) and the U.S. Office of Personnel
Management (OPM) have selected RSA® Federated Identity Manager solution to help
meet requirements related to the federal government’s E-Authentication
Initiative. The E-Authentication Initiative supports the President’s
E-Government Management Agenda, and aims to provide a standardized process for
establishing and using electronic identities, eliminating the need for each
federal agency to develop a separate solution for verifying identities and
electronic signatures. [Source]
The Recording Industry Association of America said it
had filed a new round of lawsuits against 751 as-yet-unnamed people who are accused
of making copyright music available on file-trading networks. The suits are the
latest in a campaign that has now targeted more than 17,000 people. [Source]
BEUC, the European consumers’ organization, has
started a new campaign to combat overly restrictive digital rights management
and terms of use with digital content. Said the organisation’s senior legal advisor:
‘We fear and we observe that consumer’s rights, which they do have in other
areas, are more and more restricted in the digital environment’, naming digital
rights management (DRM) technologies and usage restrictions for content bought
as well on CDs as downloaded from online services as examples. [Source]
[Consumer’s
Digital Rights]
The European Commission has published an evaluation
of the protection EU law gives to databases. EU law protects databases by
copyright if they are sufficiently creative. Other databases may benefit from a
new form of protection introduced by the 1996 Database Directive, known as the ‘sui
generis’ database right. Stakeholders are invited to comment on the evaluation
by 12 March 2006. [Source]
[Evaluation]
A fundamental element in enabling the benefits ICT can
bring to economic and social development is the confidence users have in
platforms, applications and services. Creating an online environment which
builds trust amongst the users of ICT networks is an increasing priority for
business, industry and governments. The aim of this report is to undertake a
review of the data available from official, semi-official and private sources
which can assist in informing developments and progress in this area. There is
a need to be able to use relevant data to assess the effectiveness of public
and private initiatives aimed at building trust among users. OECD governments
have agreed on a number of initiatives aimed at building a culture of trust and
security. At the international level, examples include the OECD’s Security
Guidelines, OECD Policy and Practical Guidance for Online Privacy and the OECD
Guidelines for Consumer Protection in the Context of Electronic Commerce. The
private sector has also been active. Numerous initiatives have been put into
place from partnerships such as the Anti-Phishing Working Group through to the
implementation of tools that aim to build trust directly with users such as
privacy statements, trust marks and secure servers. [Source]
New laws giving police increased powers to handle
riots have gone too far, create the potential for abuse and intrude into
privacy, the NSW Council for Civil Liberties says. The council’s
vice-president, Pauline Wright, said one of the most disturbing features of
last week’s legislation was that police themselves could declare an emergency
situation and give themselves the additional powers. “In other situations like
a state of emergency, it is for the minister or Parliament itself to make the
decision, which then gives power to state agencies to do things that are extraordinary,”
she said. [Source]
As a response to increasing outsourcing and
offshoring, Rescue American Jobs states their mission is to build the “largest
American workforce mobilization in history.” This year, almost all 50 states
introduced strong legislative bills designed to severely limit offshoring. Most
of the bills that have become law seem to lack teeth and in some cases have had
negative consequences. Statistically, Forrester Research forecasts the number
of outsourced
The online auctioneer eBay has admitted an ‘extreme
growth’ in the number of personal accounts being hijacked by fraudsters.
Criminals are obtaining the secret passwords of eBay subscribers and using
their sites to conduct bogus auctions for non-existent goods. The hijacking of
sellers’ accounts is a particularly sensitive issue for the auction site, which
relies to a large degree on the level of trust between the buyer and seller of
goods for its success. eBay blames its account holders for not installing
proper security on their home computers and for replying to so-called “phishing”
emails. Viruses are also said to be infecting home computers by installing
themselves inside hard drives, where they monitor the keystrokes of eBay users,
make a record of passwords before sending them onto the fraudsters. [Source]
A secure centrally held record of electors is the
subject of a consultation launched this week. The Department for Constitutional
Affairs is seeking views on its proposals to establish a Co-ordinated Online Record
of Electors (CORE). CORE will allow national access to local electoral registration
data. Electoral registers are maintained locally by the 390 electoral
registration officers across the
According to documents obtained by EPIC under the Freedom of Information Act, the
Department of Homeland Security has found significant problems with new hi-tech
passports. Tests conducted last year revealed that “contactless” passports
embedded with RFID technology create difficulties for border inspectors. EPIC previously
has highlighted flaws in the E-Passport and, in light of these FOIA documents,
submitted comments urging the abandonment of the use of RFID technology in
E-Passports. [December
2005 Comments About Hi-Tech Passports] [Documents About
Hi-Tech Passports Obtained by EPIC Under FOIA] [April 2005
Comments About E-Passport Proposal]
Resistance to RFID tagging falls as companies learn
how to balance the technology with current bar coding practices. In a new
report, “RFID Enables Sensory Network Strategies to Transform Industries,” Gartner
analysts argue that managers should stop thinking of RFID tags as a replacement
for bar codes, but rather the two technologies should be seen as coexisting. In
other words, the right data collection technology should be matched to the
right situation. Said Jeff Woods of Gartner. “Businesses are beginning to discover
business value in places where they cannot use bar coding, which will be the
force that moves RFID forward.” He continued: “Contrary to the notion that
companies will need to ‘integrate’ RFID data into established transactional
applications, companies will likely need to develop new business applications
if they want to put RFID at the center of a process.” Although industries can
learn from each other, industry-specific development is expected to set the
pace for adoption. Gartner lists the industries with the greatest opportunities
to use RFID as retail and aerospace and defense, while the industries that will
adopt it the fastest are healthcare, logistics and pharmaceutical. [Source] [Source]
The Council of Europe’s Convention on Cybercrime is
still pending before the full U.S. Senate, which must ratify the treaty before
it takes effect in the
Special Minister of State, Senator Eric Abetz,
announced that the Australian Government is seeking feedback on the draft
Australian Government Smartcard Framework. “In October this year I announced
that the Government had commenced development of a Smartcard Framework. We have
now reached the point when a comprehensive consultation process should be
undertaken to ensure the views of stakeholders are taken into account” Minister
Abetz said. “The smartcard framework is about assisting government agencies to
better harness the technologies that will enable better service delivery to
citizens. Smartcard technology is an enabler, not a solution in itself. It will
help agencies and Australian citizens interact in a more streamlined and
efficient way” said Minister Abetz. “Most importantly, what we want is
consistency across government agencies in their work with smartcard technology”
[Source]
The U.S. Congress’ authorization of military force
after the September 11, 2001, attacks also gave President George W. Bush the
right to eavesdrop on people in the
According to new documents released by the ACLU, the
FBI is using counterterrorism resources to monitor and infiltrate domestic
political organizations that criticize business interests and government
policies, despite a lack of evidence that the groups are engaging in or
supporting violent action. The ACLU said that the documents released today on
Greenpeace, People for the Ethical Treatment of Animals and the American-Arab
Anti-Discrimination Committee show the FBI expanding the definition of “domestic
terrorism” to include citizens and groups that participate in lawful protests
or civil disobedience. “The FBI should use its resources to investigate
credible threats to national security instead of spending time tracking
Americans who criticize government policy, or monitoring groups that have not
broken the law,” said the ACLU. “Labeling law abiding groups and their members ‘domestic
terrorists’ is not only irresponsible, it has a chilling effect on the vibrant
tradition of political dissent in this country.” [Source]
The
Canadian Radiotelevision and Telecommunications Commission has ordered
Florida Agriculture and Consumer Services Commissioner
Charles Bronson’s has taken legal action against a Brevard Country telemarketer
for Do Not Call violations alleging that the company’s calls continued despite
numerous written warnings. [Source]
About 70% of the world’s e-mail messages continue to
be spam. But the number is leveling off, which federal officials this week
cited as evidence that a law enacted two years ago is working. [Source]
[Source]
At least 30,000 air passengers have been improperly
matched to names on federal watch lists since last November, according to Jim
Kennedy, head of the Transportation Security Administration redress office.
Each of the 30,000 individuals submitted personal information and identification
documents to the agency in hopes of resolving their misidentification problems,
and were issued letters to help them clear security more quickly. A few dozen
more people were unable to benefit from this redress process. Kennedy provided
the information at a meeting of the Department of Homeland Security’s Data
Privacy and Integrity Advisory Committee in
The House Judiciary Committee has approved immigration
reform bill, sponsored by REAL ID Act
architect Rep. James Sensenbrenner, which would require a study on creating a
machine-readable Social Security card and a Homeland Security database
containing information on the employment eligibility of all citizens and
non-citizens. EPIC testified earlier this year against the far-reaching plans.
EPIC said that the machine-readable card would become a de facto identification
card if, as the bill suggests, employers were forced to use the
machine-readable SSN card for employment verification. The SSN was never intended
to be a national identifier, and should not be used as such, EPIC said. [H.R. 4437: Border
Protection, Antiterrorism, and Illegal Immigration Control Act of 2005] [H.R. 98: The Illegal
Immigration Enforcement and Social Security Protection Act of 2005] [EPIC’s National ID and REAL ID Act
page]
With time running short on Capitol Hill, the Senate
breathed new life this week into the moribund USA Patriot Act, agreeing to
extend it by six months. President Bush said he appreciated the move, but it
was unclear if the House would approve it. [Source] Volatile issues that pit
anti-terrorism against civil liberties protections contributed to a Senate rejection
to renew the USA Patriot Act which expires on December 31. Among the provisions
scheduled to expire were those permitting “roving wiretaps” of suspects, FBI access
to business and library records of suspects, and the pursuit of “lone wolf”
suspects with no known ties to foreign powers or agents. [Source]
[Source]
[Patriot
provisions set to expire] [Source]
Under the Personal
Data Privacy and Security Act of 2005 (a.k.a. the Specter-Leahy bill),
companies will be required to implement technology and policies to enhance
their privacy protection systems and provide written notification if data is
breached. Additionally, they will have to assess and refine their technology
within one year of the law’s passing. This bill is still under review by
Congress. [Source]
The Federal Trade Commission would gain expanded
policing powers and could share information about spammers and other miscreants
with foreign governments under a bill approved by a U.S. Senate panel. Called
the Undertaking
Spam, Spyware, and Fraud Enforcement with Enforcers Beyond Borders Act
of 2005, the proposal is nearly identical to legislation
pushed by the FTC itself two years ago that drew concerns from civil liberties
groups and was never enacted. [Source]
--------