Privacy News Highlights
27 January—02
February 2006
Contents:
EU
– Biometric Passport Cracked: Face and Fingerprints Swiped. 2
WW
– Mapping Veins as a Human ‘Bar Code’ 2
BC
– Chilliwack Proposes Controversial Bylaw to Report Shoppers to Police. 2
ON
– Privacy Commissioner Concerned by Oshawa Bylaw.. 2
WW
– Survey: Online Consumers Participate In Surveys, Promotions. 3
US
– House Chair Calls for Empowered Federal CIO.. 3
UK
– ASA Slams Anonymous ‘Tell a Friend’ E-Mail 3
US
– EPIC Urges Center for Disease Control to Limit Passenger Data Collection. 3
US
– Acxiom Proposed Massive Web Monitoring Plan. 3
EU
– EU Privacy Chief Wants Tweaks to Anti-Terror Database Plan. 3
EU
– Industry Groups Concerned About Divergent Retention Requirements. 4
EU
– Commission Refuses to do Impact Assessment on the Data Retention
Directive. 4
US
– DNA Bill Clears Tough Committee Hurdle. 4
US
– Survey: Americans Value Health Privacy, Have Security Concerns. 4
US
– NYC Diabetes Program Faces Privacy Criticisms. 4
US
– Trial Continues Over Teenage Sexual Privacy. 5
US
– Credit Card Numbers Stolen From Rhode Island State Government Web Site. 5
US
– 240,000 Newspaper Subscriber Credit Data Distributed by Mistake. 5
US
– Hackers Get Honeywell Worker Info, Post Online. 5
US
– Faculty Info Potentially Exposed in Server Hack. 5
US
– Northwest Hospital Chain Loses Data on 365,000 Patients. 5
AU
– Survey: Most Support Australian ID Card Idea. 6
US
– Report: Incidences of ID Theft Down, Losses Up. Online Fraud Not Big
Factor 6
UK
– Identity Fraud is Costing the UK Economy over £1.7bn a year 6
US
– Court Upholds Air Travel ID Requirement 6
US
– Date Set for Google Court Appearance Over Search Privacy. 6
CA
– Police Critic Finds 20 Queries on CPIC. 6
US
– Feds Say Cell Phone Tracking Won’t Breach Privacy. 7
UK
– Mobile Phone Tracking, Girlfriend Stalking and the Law. 7
UK
– ISPs Ordered to Reveal Software File-Sharers. 7
AU
– Australian Privacy Laws to be Reviewed. 7
US
– ACLU Says President Ignored State of Civil Liberties in Address. 7
US
– CDT, Others Call for Delay of FCC Wiretapping Rules. 7
US
– Senators Question Legality of U.S. Domestic Surveillance Program.. 8
US
– Negotiations Under Way On California’s RFID Bill 8
UK
– ID Cards Will be “Snooper’s Paradise” Say Critics. 8
CA
– Survey Shows Private Data at Risk of Attack. 8
US
– Study: Data Theft Hits Many Universities. 8
WW
– Computer Worm That Destroys Files Set to Attack. 9
US
– Creation of National ID Card Will Be a Nightmare, AAMVA Report Shows. 9
US
– Survey: Most Virginians Want Cars’ Black Boxes Kept Private. 9
US
– FCC Subpoenas 30 Phone Record Dealers. 9
US
– Momentum Builds In Washington to Ban Sale of Private Telephone Records. 9
US
– FCC Proposes Fines on AT&T, Alltel Over Privacy. 9
US
– Sprint Nextel Files Lawsuit to Halt Fraudulent Pursuit of Confidential
Customer Info. 9
US
– EFF Sues AT&T for Helping NSA Spy Without Warrants. 10
US
– FTC Offers New Content to Educate Consumers on ID Theft Prevention. 10
US
– Congress Gives Patriot Act Another Month. 10
US
– Attorney-General Rob McKenna Pushes Identity Theft Solutions. 10
US
– Survey: Most Employers Monitor Employees’ Calls, Web Use. 10
US
– Employers Often Notify Workers About Monitoring. 10
Chip-based passports can be forced to reveal all their
content after just a couple of hours of number crunching, despite standards
governing their introduction specifying strong counter measures, according to
the findings of a Dutch smart card security firm. According to the company, the
problem of potential eavesdropping attacks will still exist when the
A small medical supply company called Luminetx has
developed a new method of palm-reading that it hopes will rival fingerprinting
or retinal scans as a way to perfectly identify individuals. The technology is
based on an infrared scan of the blood cells running through veins, which is
then analyzed by a computer. Luminetx originally developed the technique as a
way to help doctors and nurses find veins in patients needing injections. But
now, the company is marketing it to banks, credit card companies and even
homeland-security officials as a high-tech biometric identification tool. “Our
vein structures are completely different, especially when you look at the palm,”
said Luminetx Chief Executive Officer. “In a way, it’s like looking at a bar
code. We convert your veins to a bar code.” [Source]
A controversial
A Forrester Research survey of
5,257 consumers in the
Karen Evans, the Office of
Management and Budget’s administrator for E-government and IT, is doing “a good
job” as the de facto federal CIO, but she doesn’t have the power that a
designated federal CIO might wield when implementing government wide IT policy,
according to House Government Reform Committee chairman Tom Davis (R-Va.).
Viral marketing is open to
abuse. So when a website that emulates Friends Reunited offered a ‘tell a
friend’ service, the UK’s advertising watchdog decided it was too great a risk
to allow emails to be sent to strangers without naming the friend. [Source]
US –
EPIC said in comments to the Center for Disease Control and
Prevention that it should limit a proposed rule that would
require airline and shipping industries to gather passenger information,
maintain it electronically for at least 60 days, and release it to the CDC
within 12 hours of a request. EPIC urged the CDC to narrow the scope of data
collected to that which is necessary and set strict security standards to keep
passenger data secure from unauthorized access and misuse. The CDC also should
require the clear and open disclosure that travelers can refuse to submit their
information without facing penalties. [source]
Documents (pdf)
obtained by EPIC under the Freedom of Information Act show that commercial data
broker Acxiom proposed a system to automatically scan the Internet and identify
websites “belonging to advocates of extremist views and actions...” The plan
proposed to extract personal information from websites and use it for
“cross-reference analysis to establish possible connections between extremist
groups” and to collect data for an “Identity Verification System to be used by
airlines, rental car agencies, and other business and government agencies.” [Source]
The European Data Protection
Supervisor has welcomed the inclusion of data protection requirements in EU
proposals to improve access to a forthcoming EU-wide database known as
The new Data Retention
Directive will allow governments of individual member states to impose longer
retention periods. Under the terms of the new directive, service providers can
be ordered to retain data between six and 24 months. Industry groups are
concerned that member states will adopt different retention periods, which will
make compliance difficult. [Source]
In
a public answer to a written question by an MEP on timeframe of the impact
assessment of the Data Retention Directive, the European Commission has stated
that such an assessment will not take place because “it will not provide any
added value”. The Commission considers that “an impact assessment cannot, at
this stage, have an influence on the content of the legal instrument, given the
fact that an agreement on the Directive has just been reached between the
Council and the Parliament. This means that the legislative process at the
European level is completed, and that an additional assessment of the impact of
the instrument at the European level will not provide new elements.” However,
the Commission is considering the set-up of a working group on this matter. [Source]
[Background]
[Background]
[Background]
A New Mexican bill (SB216)
that would require anyone arrested on a felony charge to submit DNA samples
squeaked through a state Senate Committee after a three hour hearing this week.
The Senate Judiciary Committee was considered the biggest legislative hurdle for
what has been dubbed “Katie’s Law.” The name comes from Katie Sepich, a
Survey results released on
January 17 indicate that Americans are deeply concerned about the vulnerability
of their medical records online. A third of all respondents indicated that the
fear of their medical information being revealed on the Internet was a reason
they felt less comfortable sharing information with primary care physicians.
Nearly half (47%) who felt uncomfortable sharing information with their primary
care doctors wanted control over who accesses their information. These results
reinforce the need for privacy to be built into any health information
technology system, such as the proposed national health IT network. EPIC and
Patient Privacy Rights are asking concerned citizens to sign an electronic
petition demanding that privacy rights be put back into healthcare law. [“I Want My Medical Privacy”
Petition] [Patient Privacy
Rights] [EPIC’s Medical
Privacy Page]
The New York City Board of
Health’s program to monitor blood sugar levels is under way without patients’
knowledge and informed consent, according to some critics. Other complaints
about the program include the unavailability of an opt-out for patients. At the
time their blood is drawn, patients are not told that the results will be sent
and stored in a NYC Department of Health database. [Source]
Without privacy, medical
research shows that teens won’t quit having sex, they’ll just stop talking about
it. The chairman of adolescence committee for the
Credit
and bank card numbers of as many as 240,000 subscribers of The Boston Globe and
Worcester Telegram & Gazette were inadvertently distributed with bundles of
T&G newspapers, officials of the newspapers said. The confidential
information was on the back of paper used in wrapping newspaper bundles for
distribution to carriers and retailers. As many as 9,000 bundles of the T&G,
wrapped in paper containing subscribers’ names and their confidential
information, were distributed Sunday to 2,000 retailers and 390 carriers in the
Honeywell International vowed
Tuesday to “aggressively pursue” the unidentified hackers who broke into the
company’s computers and posted the Social Security numbers and bank account
information of about 19,000 current and former employees on the Internet. [Source]
The personal information of
about 2,300 current and former
A laptop containing the
medical and personal records of 365,000 patients of the Providence Health Care
system was stolen from the van of an information services analyst who worked for
A Majority of Australians now
support a national identity card, two decades after the concept was dumped
following a popular revolt in 1987. The ID card now under consideration by the
Federal Government is supported by 53% of the electorate. A recent Newspoll
found that 31% of voters were opposed to the ID card, compared with 57% against
19 years ago, when it could only muster the support of 39% of the electorate.
Support for the card was strongest among those aged over 50, at 63%, and
Coalition supporters, 60%. [Source]
According to official figures
published this week, the Home Office figures show a marked increase in the cost
of preventing and dealing with identity fraud since 2002, when the figure stood
at £1.3bn a year. The figures include losses recorded by a number of bodies,
including credit card providers, government departments and the police force,
and the cost of fraud prevention to agencies such as the DVLA and UK Passport
Service. Since the last figures were published, the level of fraud in some areas
has fallen as new measures have been introduced to combat the problem. [Source]
[See also ID fraud
figures 'inflated to play on public fears']
US – Court Upholds Air Travel
ID Requirement
The Ninth Circuit Court of Appeals recently ruled for the government in Gilmore v.
Gonzales, a case that challenged an unpublished federal rule requiring
passengers to show ID before boarding commercial airplanes. EPIC filed a “friend of the court” brief in the case,
stating that secret law violates constitutional due process rights. [Source].
A Feb. 27 court hearing has
been scheduled for arguments over Google’s refusal to comply with the
The head of a police watchdog
group is accusing
Federal prosecutors have
contended that they want to know only the general location of a criminal suspect
when they seek information about the whereabouts of the individual’s cell
telephone. The federal government is not seeking information so specific that it
would breach a person’s privacy rights, Assistant U.S. Attorney Martin
Littlefield said in a hearing this week. Federal authorities are asking the
court to approve an order allowing them to get information about which cell
tower an individual’s telephone made contact with. They insist that they do not
have to show there is probable cause that the suspect committed a crime — a
legal threshold necessary for a search warrant, for instance. Authorities didn’t
reveal the nature of the criminal probe at the hearing. [Source]
A service has launched in the
The English High Court has
ordered 10 ISPs, including BT, Tiscali and Telewest, to reveal the identities of
150 file-swappers accused by the Federation Against Software Theft (FAST) of
illegally uploading software to networks like Kazaa. [Source]
The Australian Federal
Government has announced a review of the Privacy Act. Attorney-General Philip
Ruddock says the Australian Law Reform Commission will look at existing laws and
practices across the country and consider changes in technology since the Act was introduced in 1988. “What you
see with areas like the Internet, it’s a form of technology in which people
still have a need for their privacy to be protected,” he said. Mr Ruddock says
the review is not linked to the separate issue of a national identity card.
“Quite frankly the privacy issues operate quite separately from that,” he said.
[Source]
“Bush Failed to Answer
Questions on Patriot Act, NSA Spying.” The American Civil Liberties Union has
strongly rebuked President Bush for failing to adequately address serious civil
liberties concerns about his administration’s actions since 9/11 in his State of
the Union address delivered Tuesday. Specifically, the president failed to
answer questions raised - from all points of the political spectrum - on his
warrantless domestic spying program conducted by the National Security Agency
and the over intrusive powers in the Patriot Act. [Source]
[See also Barr Responds
to State of the Union Address]
CDT joined with a coalition of
industry and public interest groups this week to urge the FCC to delay its
controversial Internet wiretapping rules. In comments filed with the FCC, the
groups requested that the commission push back the effective date of the rule
requiring that that broadband Internet and interconnected voice-over Internet
Protocol (VOIP) services be designed to make government wiretapping easier. CDT,
which is also involved in a court challenge against the ruling, supports the
delay because the FCC set a deadline for VoIP and broadband providers to modify
their networks but failed to specify what modifications were required. [Source]
Senator Chuck Hagel, a Republican
member of the
Industry concerns over a bill
that would impose a three-year moratorium on chip-based wireless technology to
allow for more study before it is used in government ID cards are having a
significant impact on the bill’s revisions. The bill has undergone numerous
amendments since it was delayed last August. [Source]
ID card critics have slammed
government plans to include RFID-style tracking tags on the controversial cards,
saying they will be a “snooper’s paradise”. Home Office minister Andy Burnham
told parliament just before Christmas that ID cards will not contain RFID chips
but will contain radio frequency contactless chips. The paper-thin RFID-style
chip is already set to be embedded in the new ePassports, in compliance with
ICAO guidelines for international travel documents, and can be read by a scanner
without the need for the document to be swiped through a reader. But a row has
now broken out over how far chips need to be from scanners for their data to be
read. ID card critics have dismissed Burnham’s claim that chips can only be read
if they are a few inches away from scanners, arguing that signal boosters enable
data to be accessed from much further away. Phil Booth, national co-ordinator
for the No2ID campaign group, said in a
statement: “The chips will broadcast actual personal details held on the card,
not just a number. This technology will make the cards a snooper’s paradise.”
[Source]
[See also Dutch passport Cracked [Source]
[Source]
The Fusepoint/Sun
Microsystems/Leger Marketing survey has found that 55% of Canadian companies say
their confidential and private data is at risk of an attack. However, 98% of the
Canadian business leaders said that it is important for companies to safeguard
private data. [Source]
Since February 2005, the
personal data of more than 52 million Americans has been compromised, in many
cases through breaches of computer systems at colleges and universities, Privacy
Rights Clearinghouse reported this week. Of 113 data breaches reported, 55 took
place at colleges, universities and university-affiliated medical centers.
Stolen data included Social Security numbers, account numbers and driver’s
license numbers, according to the Privacy Rights Clearinghouse Web site. [Source]
A computer worm that
infiltrated hundreds of thousands of PCs last month is expected to awaken,
destroying documents and files on infected machines and networks, Microsoft and
computer security experts warn. The worm, variously named “Nyxem.D,” “MyWife.E,”
“Blackmal.E,” and the “Kama Sutra worm” by different antivirus companies, is a
ticking time bomb that on the third day of each month will seek out and delete a
wide range of file types found on infected Windows computers, including any
Adobe PDF files and Microsoft Word, Excel and Powerpoint documents, among
others. [Source]
State motor vehicle officials
across the nation say it will be a nightmare to implement the REAL ID Act, a law
passed in May that will turn driver’s licenses into national ID cards. A
comprehensive survey concluded last August but recently obtained by the
Associated Press revealed the costs of implementation have been vastly
underestimated by the government, which initially put the total price at $100
million. According to the survey,
67% of Virginians believe no
one should have access to data collected by their car’s computer without the
owner’s permission, according to a poll by AAA Mid-Atlantic. Event data
recorders, commonly referred to as the car’s “black box,” have become
increasingly part of new vehicles’ performance, air bag deployment and occupant
information systems. [Source]
The Federal Communications
Commission has subpoenaed more than 30 information brokers to learn how they
obtain customers’ calling records from telephone companies, according to
testimony Wednesday before Congress. In a hearing before the House Energy and
Commerce Committee, the heads of the FCC and the Federal Trade Commission
endorsed making the sale of phone records illegal. [Source]
The House and Senate will each
hold hearings on the controversy over the online sale of private telephone
records. In other developments, Sprint Nextel Corp. joined the list of companies
suing data brokers that sell the records. The FTC also has determined that the
practice of impersonating a customer to fraudulently obtain private records is
illegal. [Source]
Sprint Nextel announced that
it has filed a lawsuit against All Star Investigations Inc. (“ASI”), a company
believed to own and/or operate several web sites that fraudulently obtain and
sell wireless customer call detail records. Sprint Nextel states in its
complaint that ASI unlawfully obtains customers’ wireless phone records through
flagrant misrepresentation and deceitful practices. Sprint Nextel’s latest legal
effort aimed at protecting customer privacy immediately follows its lawsuit
filed against First Source Information Specialists Inc. announced on Jan. 27.
Similar to the earlier suit, Sprint Nextel has requested both temporary and
permanent injunctions against ASI. [Source]
[See also Second
Suit Filed]
A civil liberties group sued
AT&T Inc. for its alleged role in helping the National Security Agency spy
on the phone calls and other communications of
The FTC is offering users new tools to help them learn
more about ID theft prevention. An 8-question online quiz is available to raise
awareness about ID theft. This spring, the FTC plans to add more information on
ID theft to the new site at www.onguardonline.gov. [Source]
The Patriot Act is set to be
extended for another month while conservative Republicans and the White House
work out changes they say would protect people from government intrusion without
weakening the war on terror. A day after President Bush insisted that Congress
renew 16 provisions set to expire Friday, the House was set to extend the act
until March 10 to give negotiators more time to come up with a deal. The Senate
was expected to follow before the deadline. [Source]
A consumer who fears imminent
identity theft - possibly due to a stolen wallet - would be able to freeze his
credit under a measure proposed by Attorney General Rob McKenna. A credit freeze
prohibits credit from being issued in the consumer’s name and restricts access
to a credit history. Under current law, the concerned consumer can’t freeze his
credit until a thief actually uses the information to commit a crime, McKenna
said. His proposal was offered a day after Providence Health System, a regional
medical services provider, revealed
that a thief had walked off with the medical records of 365,000 patients.
Along with sensitive health information, those records contained names,
addresses and SSNs. [Source]
A 2005 survey done by ePolicy Institute in
Workers
using company computers and telephones have no reasonable expectation of privacy
– especially if the company has warned employees in advance that they could be
monitored.