CA – University Of Ottawa Issues Privacy Warning to (Law) Students

The University of Ottawa is concerned that the Law School admission test administered by a U.S. company that requires students to provide a thumbprint before taking the exam is violating the test-takers’ privacy. The legal experts are concerned that the USA Patriot Act could lead to the release of the personal information collected by the company that administers the Law School Admission Test. [Source]

CA – Canada Privacy Commissioner Denies Complaint on Port 25 Blocking

Canada’s privacy commissioner has denied a complaint over ISP’s practice of blocking port 25 in order to reduce outgoing spam. The Commissioner concluded that the customer’s IP address constituted personal information but that the user agreement gave the ISP the right to collect information necessary to provide the service. [Finding]

AB – Alberta Privacy Commissioner Rules Pharmacists Can Demand Personal Info

Alberta’s privacy commission has ruled that pharmacists can demand personal information from a customer before selling them insulin or other behind-the-counter drugs. Its 10-page decision, released this week, stems from a complaint by a man who asked for insulin at an Edmonton Wal-Mart. When he refused to give his name, address, date of birth and phone number, the pharmacist refused to sell him the insulin. Insulin is classified as a category 2 drug, so it doesn’t need a prescription, but is kept behind the pharmacist’s counter. [Source]

CA – Peter Cullen of Microsoft Pitches Privacy as a Valuable Customer Asset

Peter Cullen, Microsoft’s Chief Privacy Strategist, spoke in Toronto last week about cybercrime. Cullen said Microsoft is urging the U.S. Congress to look to Canada’s privacy law as it considers the software’s giant call to create federal privacy legislation in the U.S. Cullen encouraged business leaders to view privacy as an asset that adds value to the customer relationship. [Source]

WW – Online Dating Service Boosts Subscriptions With Privacy Tool

A new report by Jupiter Research has found that fewer people are subscribing to online dating services, but Private Date Finders is bucking that trend with proprietary technology that responds to needs identified from research showing that 35% of people using dating sites are married or in a relationship. Many of those people were reluctant to pay for subscriptions because they feared being caught – either because they were in a relationship or because they browse on work time. The site uses a proprietary service called EverPrivate. A Web-based anonymous browser and a Web-based eraser promise to erase all traces of user activity, including: cookies, cache, history, temporary Internet files and transactions without installation or downloads. The site also provides private log-ins and a “virtual” MasterCard, a Debit card issued online and replenished at retail stores. [Source]

US – Verizon Wireless Sues Telemarketers

Verizon Wireless has sued two telemarketing firms that allegedly used autodialers and prerecorded messages that directed wireless customers to call a toll-free number to claim their prize. The suits allege that the companies violated the federal Telephone Consumer Protection Act, as well as state fraud and privacy laws. [Source]

US – Lawsuit Challenges Law Against “Annoying” E-mail Messages

A new law targeting “annoying” e-mail messages and Web posts is being challenged in federal court. The plaintiff, a Web site that lets people send anonymous e-mail for a fee, said the suit was necessary because the law is so broad it makes providing the service a crime. [Source]

UK – U.K. Spam Watchdog Calls for More Powers

According to reports in the UK, government inaction is hampering attempts to prosecute people who send spam e-mails. The Information Commissioner’s Office, an independent body that is meant to regulate and protect information and electronic communication, says it has not yet got the powers it needs to prosecute those who bombard Web surfers with unwanted e-mail. [Source]

US – Patient Prescription Drug Records Going Digital

Doctors in some U.S. states will be able to view a comprehensive electronic history of a patient’s medication use, pharmacy officials announced this week. With a patient’s permission, a physician will have online access to all the medicines he or she has been prescribed, dosages and whether prescriptions are being filled and refilled. The information will be supplied to doctors from pharmacies via the SureScripts network, founded in 2001 by two pharmacy industry associations. SureScripts plans to launch the new service starting April 1 in Rhode Island, Massachusetts, Nevada, Tennessee, New Jersey and Florida, and to have it running in at least 10 states by year end. It will be free for doctors and pharmacies. [Source]

US – Health IT Privacy Efforts to Launch in April

The privacy element of the Health and Human Services Department’s health IT efforts will launch in late April with the award of contracts to study the variations in state privacy and security policies and regulations that may hinder electronic exchange of information. The Research Triangle Institute International of Durham, N.C., which is leading HHS’ privacy effort under a contract it won in October, will announce subcontracts to organizations in up to 40 states April 28 designed to identify barriers to electronic exchange of medical information. [Source]

US – Judge: Firm Not Negligent in Failure to Encrypt Data

A federal court has thrown out a lawsuit that accused a student-loan provider of negligence in failing to encrypt a customer database that was subsequently stolen. A customer of Brazos Higher Education Service, sued the corporation on the grounds that encryption should be used as a routine security precaution. But a U.S. District Judge in Minnesota dismissed the case last week, saying Brazos had a written security policy and other “proper safeguards” for customers’ information and that it acted “with reasonable care” even without encrypting the database. [Source]

GR – Communications Privacy Protection Authority Investigates Phone-Tapping Case

Vodafone managing director Giorgos Koronias and other company officials testified before the Greek Communications Privacy Protection Authority on the mobile phone-tapping case. Over a 100 phone numbers of Greek Government officials were illegally wiretapped for 11 months, during and after the 2004 Olympic games. The illegal wiretaps were discovered in March 2005 during a routine control at Vodafone, one of the main mobile providers in Greece. Those under surveillance included the Prime Minister, many ministers, the police, army and intelligence heads and headquarters, along with left wing political activists, journalists, and lawyers. The system was deactivated by the mobile operator too soon to trace the perpetrators, yet their approximate location was interpreted by some in the media as being suspiciously close to the US embassy in Athens. [Source]

EU – EU Data Protection Supervisor Gives Opinion on VIS

Peter Hustinx, the European Data Protection Supervisor has issued an opinion on the proposal for a Council decision on access to the VIS (Visa Information System) database. In his opinion, Mr Hustinx drew attention to the need for greater consideration of data protection measures to be addressed in the Commission proposal. While he recognized that progress had been made in terms of restricted access to VIS and the development of strict safeguards to control access, he called on the Commission to further improve the proposal. With regard to additional safeguard measures, Mr Hustinx suggested:

· The conditions for access must be read cumulatively and access should only be granted if it would 'substantially' contribute in a specific case;

· Equivalent data protection must be granted if an authority of a member state that does not apply the VIS regulation accesses the database.

· The 'purpose of travel' and the photograph of the visa holder or applicant should only be made available as supplementary information;

· Data protection requirements should be supervised in a coordinated way and self-auditing provisions should be introduced. [Source] [Opinion]

FR – French Big Brother Awards 2006

The 6^th French Big Brother Awards took place on 3 February. The Orwell Award for State official winner was the Director of the Electronically Secured National Identity card project, (card will include two biometric identifiers on a RFID chip) which created a direct link to the Ministry of Interior Affairs ignoring the separation between population statistics and police administration. The local Orwell Award went to a college director who enforced a rule to obtain fingerprints of all students, to put student grades online, and for implementing a SMS system to inform students they were late for classes. The award of lifetime achievement was unanimously awarded to minister Nicolas Sarkozy for having created an environment of fear, for having weakened the justice’s power while increasing that of the police, for having violated the information law and freedom with the spam for UMP, for having extended video-surveillance and cyber-surveillance and police access to administrative files with his third anti-terrorist law, for asking for the expel of people with no papers including minors, for having encouraged the fear of police forces. Press Release Big Brother Awards France

WW – Ponemon Survey: Banks Among the Most Trusted in Nation

For the 4^th year straight, California-based Ponemon Institute surveyed more than 7,700 people in a study, which came out last week and found that out of the 25 largest U.S. banks, consumers trusted their personal information with National City and U.S. Bank the most. Overall, the Ponemon survey found the percent of consumers who said their level of confidence in their banks was “very high” or “high” has dropped 8 percentage points from 2003 to 2005. Two things seemed to have affected consumers perception of how trustworthy their bank was with their private information: phishing and security breach notifications. In the survey, 12% of respondents reported getting a notification from their bank within the past 12 months, up from 5% in 2004. “Most people don’t leave, but they incrementally use less services,” Ponemon said. [Source] [See also Feb 2006 Nymity Interview with Ponemon on 2006 Canada’s Most Trusted Companies for Privacy]

CA – Scaling the Firewall of Digital Censorship

A University of Toronto-designed computer program, called Psiphon, is preparing to break through what activists call the great firewall of China. The program is designed to help those trapped behind the blocking and filtering systems set up by restrictive governments. If successful, it will equip volunteers in more open countries to help those on the other side of digital barriers, allowing a free flow of information and news into and out of even the most closed societies. The program is part of a quiet war over freedom of information. Even as countries considered repressive, such as China, North Korea, Iran and Saudi Arabia, pour money into stopping the free exchange of data, small groups of activists keep looking for ways around the technological barriers. [Source]

US – Security Breach Prompts Bank of American to Cancel Cards

A security breach involving an undisclosed company has prompted Bank of America to cancel the debit cards of numerous customers, a spokesman for the country’s largest bank said. Bank of America refused to release the name of the company involved, the exact number of customers affected or whether the company in question was online or a traditional brick-and-mortar establishment. [Source]

EU – Report: Worldwide Overview of Freedom of Information Laws

Roger Vleugels, an independent Netherlands-based legal consultant, with help from the Freedom of Information Advocates Network (FOIA Network), has published a very comprehensive overview of the situation of freedom of information laws all over the world. The document offers a complete image of the adoption of FOI laws in the world and is structured into 5 lists of countries. [Source]

EU – Introduction to Openness and Access to Information

The Danish Human Rights Institute has launched in cooperation with a number of national and international partners a new Handbook: Introduction to Openness and Access to Information. The Handbook elaborates on four different areas of access to information: the public administration, Ombudsman and National Human Rights Institutions, the judiciary and NGOs. The book is meant to serve as a basis for debate and dialogue and as background material for training and education. [Handbook]

US – Utah House OKs Limits on Records Access

Utah House members approved legislation that would limit public access to Utahns’ addresses and phone numbers on government documents – unless the record is classified as public, such as voter registration forms. It also would allow government records managers to refuse to compile or format records for the public and let them send requestors elsewhere to get information. Sponsors insists the bill is meant to keep government efficient and to protect the public’s right to privacy. Critics are worried the bill would give government workers the excuse they need to turn records requests away. [Source]

US – Bush Signs DNA Fingerprint Act of 2005 Into Law

The DNA Fingerprint Act of 2005 was signed by President Bush into law on January 5, 2006. The legislation expands federal DNA collection efforts to include some legal and illegal immigrants, and allows states to contribute DNA collected for any reason listed under state laws to the federal DNA database. See also the summary here. This post discusses (1) how the media missed this issue, (2) related state and international developments, (3) the large role individual states’ policies will have on deciding just how ‘invasive’ this database is, and (4) some current ‘DNA criminology’ shortcomings that this bill may make even worse. [Source]

UK – Innocent People’s DNA ‘Should be Kept on File’

A Scottish MSP said that the DNA of innocent people should be kept on a police database, and has tabled an amendment to legislation in the Scottish Parliament this week to give additional powers to the police. The MSP wants to replicate what already happens in England and Wales where DNA profiles of people arrested have been retained on a database since 2003. He says the Police, Public Order and Criminal Justice (Scotland) Bill should be toughened up despite a warning from the Scottish Information Commissioner that the plans could breach data protection laws. At present DNA samples can be kept in Scotland only if a suspect is subsequently convicted. The MSP said: “If a person is arrested and is innocent, they should not be concerned about either giving a sample or having it retained in perpetuity. “If we are serious about tackling crime, we have got to move away from these concerns. A database like this is an important part of the toolkit needed to fight crime.” GeneWatch UK claimed the database in England and Wales had already been misused. The Scottish Human Rights Centre warned the proposed policy would breach the European Convention on Human Rights, saying it “may fringe an individual’s right to privacy and the right to be presumed innocent until proven guilty”. [Source]

CA – Health-Care Experts Call for Patient Record Check-up

A B.C.-based physician and IT consultant is calling on the vendor community and the health-care industry in general to put the patient at the centre of e-health record development. Dr. Jonathan Burns, an emergency physician at MSA Hospital in Abbotsford, B.C., and president of WebMed Technology, said all industry participants have to work together better to address the challenges of implementing electronic health record (EHR) systems. “Getting everyone to play by the same rules is going to be a very big one, probably the biggest,” said Burns. “The problem is going to be we have the standard but who’s going to pay for us to take the data and manipulate it in a way that everyone else can use it.” [Source]

UK – Government Sells Patient Data

The U.K. government has launched a commercial patient data database to deliver operational intelligence to health providers. The new NHS information service draws on a database containing details of every contact a patient has had with their healthcare providers. The service is a joint venture between the Health and Social Care Information Centre government agency and private firm Dr Foster. The initiative is designed to improve the use and accessibility of data across health and social care services, and the paid-for information will be marketed as Dr Foster Intelligence. The first database released contains anonymous GP and hospital data from 439,000 people who were admitted to hospital as emergency cases at least three times in one year. These so-called “frequent fliers” are said to represent a quarter of the total annual emergency admissions to NHS hospitals. The database helps providers build a picture of how many people regularly go to hospital and how much is spent on their care. [Source]

US – Probe Continues in Debit Card Theft Case

An investigation into thousands of compromised debit cards appears to involve two of the largest retailers in the US. In letters to affected customers, Bank of America and Washington Mutual said they were cancelling debit cards because of a security breach at a “third-party” location. Officials from both banks and law enforcement agencies have refused to identify the location. [Source] [Banks Scrambling for Cover] [Debit Breach Clouds Privacy Law Outlook]

UK – UK Votes for Compulsory ID Cards for UK Citizens Within Five Years

UK citizens will be forced to register for biometric ID cards when applying for a new passport within two years after MPs voted this week to make the controversial scheme compulsory and to not put the costs under independent scrutiny. The government comfortably defeated a threatened backbench Labour rebellion, albeit with a reduced majority. A late round of lobbying by the government ensured a win in the crucial votes in the House of Commons, overturning amendments made to the ID cards bill last month by peers in the House of Lords. A halved majority of 31 saw MPs narrowly vote to reject a wrecking amendment that would have made it completely voluntary for citizens to register for an ID card when applying for a passport. [Source] [See also British national ID card project draws U.S. firms

More than a dozen U.S. IT companies, such as EDS Corp., Iridian Technologies Inc. and Unisys Corp., are interested in bidding on the United Kingdom’s proposed biometric national identity card scheme, according to a new report by a U.K. non-profit environmental advocacy group.

WW – Gates Unveils InfoCard: “We’ll Be Your Wallet, Again”

Bill Gates has showed off new software aimed at being a virtual wallet to store information, picking up where its Passport service left off. As part of that effort, the virtual personal information wallet, code-named “InfoCard,” would allow consumers to manage their identities online. It seeks to provide better security by reducing reliance on usernames and passwords which are often the target of computer criminals. Microsoft first offered identification and authentication with its Passport service, but that technology failed to win wide acceptance because consumers did not embrace the idea of having the software maker manage their information. Microsoft said because InfoCard would run isolated from other programs on the desktop, it would be harder for hackers to install malicious software on the system. [Source]

WW – SanDisk and VeriSign Partner to Extend Consumer Authentication Capabilities

VeriSign, a provider of intelligent infrastructure services for Internet and telecommunications networks, and SanDisk Corp. have announced a strategic partnership that calls for the two companies to collaborate on providing a “non-intrusive”, “easy to use” solution to protect consumers against online identity theft. SanDisk will embed VeriSign Identity Protection (VIP) Service capability and Open Authentication (OATH) compliant One-Time-Password (OTP) algorithms into their main suite of USB flash device products. The combination will enable consumer-friendly two-factor authentication for end users who purchase SanDisk mass-storage devices at retail outlets and then use them at VIP-enabled web sites. With VeriSign Identity Protection (VIP), the same authentication device will work across any network member sites, leveraging a shared infrastructure and enabling everyday devices in consumer hands to become authentication devices. [Source]

WW – New Google Search Feature Allows Multi-PC Search, Invasion of Privacy

Google is offering a new tool that will automatically transfer information from one personal computer to another. However, anyone wanting that convenience must authorize the Internet search leader to store the material for up to 30 days. The company says it will not peruse any of the transferred information. [Source] Update: The EFF is warning consumers about a new feature in Google Desktop 3 that allows people to search for documents across multiple computers, saying it poses privacy risks and should not be used. The threat is underscored by the recent Justice Department request to Google, Microsoft, Yahoo and America Online for random Web search records. [Source]

EU – European Commission Launches IPv6 Consultation

The current generation of the internet will “run out of space” because of its lack of addresses. IPv6 –the sixth version of the Internet Protocol– will provide a wider range of addresses and services, underpinning the convergence process between fixed and mobile, as well as between data, voice and video. With IPv6, addresses can be assigned to a new breed of internet-capable devices –mobile phones, car navigation systems, home appliances, industrial equipment and much more. All of these devices can be linked together, constantly communicating wirelessly. The first IPv6 deployments are happening in Europe and globally. The European Commission is engaging in a process of identifying the hurdles and triggers for IPv6 deployment and ultimately to define policies moving forward its wide adoption. As part of this process, a consultation on IPv6 evolution is now launched (closing date: 24 February 2006). [Source]

EU – EU Grapples With Freedom of the Press and Personal Privacy

The EU is having difficulty sorting out which law and jurisdiction should handle disputes arising from media coverage that generates claims of privacy invasions. The EU Commission has suggested that cases be heard where the person claimed that harm resulted from damage to his or her reputation, But media companies oppose that approach because they would then have to recognize privacy laws in all EU countries. Uncertainty will remain until a compromise can be reached. [Source]

US – Protesters Say Police Invading Privacy

The police videotaped the protesters. The protesters photographed the police. During a protest last week of what participants called the Greensboro Police Department’s “domestic spying,” it almost seemed that everyone was watching – and filming – everyone else. The event followed the arrest of seven protesters last week at a rally demanding that President Bush step down. The arrests took place after a confrontation with a plainclothes detective who was videotaping license plates near where protesters had gathered. This week’s rally was designed as both a show of support for those who were arrested and a protest of the department’s videotaping tactic. Some protesters said the practice amounts to intimidation and serves to dampen free speech. [Source]

US – Missouri Police Say Loosen HIPAA Patient Privacy Rules

When Missouri health care providers were required to comply with HIPAA in 2003, they were forced to act conservatively when disclosing patient health information to law enforcement. Since then, the Missouri Police Chiefs’ Association has worked to propose revisions to Missouri law to give police more access to information about patients associated with crimes. [Source]

US – New Firm Sells Vehicle-Tracking Devices

A U.S. business is selling a GPS tracking device for vehicles called Millennium Plus. “Most GPS systems you buy are navigational units; this is a tracking unit,” the inventor said. Rather than using GPS to give a route from point A to point B, the firm believed another market existed that wants to know where a car or truck is and how fast it is going when someone else is driving it. “If you have student or elderly drivers in your family or businesses with a fleet of vehicles, you can keep your eye on them”. Using several satellites and “microburst” technology, an owner can interface with his or her vehicle via the Internet and get reports by e-mail, cell phone or pager. About the size of a pack of cigarettes, the Millennium GPS device takes about one hour to install. [Source]

WW – Outsourcing Vendor Standards Released

A consortium of financial institutions and auditors has released “standards for assessing the security practices of outsourcing vendors that work with financial services firms.” The standards were created with the goal of having consistent expectations for “evaluating the controls that outsourcing vendors use to protect sensitive data.” The standards, dubbed the Financial Institution Shared Assessments Program, were tested on five vendors before being released. [Source] [Source]

US – FTC Plans Hearings on How to Address Online Risks, Hi-Tech Security

The Internet industry needs to create “self-regulatory regimes” and come up with new technologies to battle online dangers such as spyware, said the chairwoman of the U.S. Federal Trade Commission, who also called for “appropriate” law enforcement actions and better consumer education efforts to deal with online risks. [Source] [Source] [Source]

UK – Spyware Warriors Call for Action

Computer users whose machines have been hijacked by potentially dangerous software are being asked to add their tales of woe to an online campaign. Security experts say that growing numbers are being conned into paying for fake anti-spyware programs. Now grassroots online security activists in the UK hope testimonies can raise awareness of the problem. The number of malicious infections worldwide soared in 2005, said security firm Webroot. [Source]

US – Police Examining Social Websites in Numerous Crimes

Police across the country are examining social websites, including 55-million-member MySpace, in investigations of crimes ranging from statutory rape and molestation to murder. Their concern: Teens who have been warned all their lives to beware of strangers online are now regularly posting their cellphone numbers, school names and other personal information, as well as sexy pictures of themselves, on these sites. [Source]

JP – Court Rejects Privacy Lawsuit Challenging National Resident Registry

The Osaka District Court has rejected the arguments of 153 residents who claimed that the Juki Net national resident registry network violates their privacy. The plaintiffs wanted their personal information removed from the controversial database, which went online in Aug/03, and compensation from the government and other parties. Opponents also have argued that the system’s security is inadequate. [Source]

US – Stanford University Signs R&D Pact for Data Privacy

Stanford University has announced that it has entered into a 5-year Research and Development collaboration with Tata Consultancy Services, an Indian global technology services organization, for research in critical areas of data privacy. The Computer Science department at Stanford University plays a key role in National Science Foundation-led initiatives to accelerate research into security and data privacy. It is part of TRUST -- Team for Research in Ubiquitous Secure Technology – a multi-university initiative that includes UC Berkeley, Cornell University and Carnegie Mellon University as well as industrial partners like Cisco Systems, HP, IBM, Intel, Microsoft, Qualcomm, Sun and Symantec. In addition to TRUST, the Stanford Security Lab leads the NSF-sponsored Privacy, Obligations, and Rights in Technologies of Information Assessment (PORTIA) project on privacy and computer security. [Source]

US – Nigerian National Sentenced To 10 Years In ChoicePoint ID Theft Case

A 42-year-old man who pleaded guilty to ID theft charges related to consumer data taken from ChoicePoint Inc. faces a 10-year prison sentence. The judge also ordered the man to pay $6.5 million in restitution. Prosecutors allege that the man created a fake business to set up a ChoicePoint account. [Source]

WW – IBM and the Future of Privacy

IBM Investor Relations offers an audio series entitled “IBM and the Future of...” on key business and technology topics that reflect thought leaders’ visions. The current topic deals with the future of privacy: 19-min audio interview with Harriet Pearson, IBM Chief Privacy Officer and Jeff Jonas, Distinguished IBM Engineer and Chief Scientist for IBM Entity Analytics Solutions. [Source]

WW – Verichip RFID Implant Chips Cloned

Programmer Jonathan Westhues has recently proved that the Verichip implantable RFID chip can be easily copied. Anybody capable of purchasing off the shelf electronics equipment and reading the description below can now impersonate the bearer of the chip and gain access to their medical records, among other things. As Verichip has marketed their chip as a means of managing access control to buildings and medical records, this represents a significant threat to their bearer’s privacy and security. [Source] [Source]

US – Workers Have RFID Chips Implanted for Access Control

RFID chips were embedded this week into two workers who volunteered to help test the tagging technology at a surveillance equipment company. Implanting them in the workers at CityWatcher.com is believed to be the first use of the technology in living humans in the United States. Sean Darks, the company’s CEO, also had one of the chips embedded. “I have one,” he said. “I’m not going to ask somebody to do something I wouldn’t do myself. None of my employees are forced to get the chip to keep their job.” The chips are the size of a grain of rice and a doctor embedded them in the forearm just under the surface of the skin, Darks said. They work “like an access card. There’s a reader outside the door; you walk up to the reader, put your arm under it, and it opens the door,” Darks said. [Source]

AU – Australian Minister Provides Details of e-Passport

Information about the implementation of chips in Australian ePassports has recently been provided by the Aust. Minister for Foreign Affairs. It address concerns about whether chips emit a random or fixed UID and whether in fact any chip manufacturers implement random UIDs. The Aust. Minister has stated that the chip in the ePassport emits a random UID and that the UID does not contain any data that might allow identification of the issuing authority (Aust. Gov) or that the chip is in an ePassport. Obviously that info only applies to the Aust. ePassport - the U.S. and some other countries might be implementing fixed UIDs. However, if they are not intending to implement random UIDs, one might ask why not given such chips are apparently available. [Source]

US – Gates, Mcnealy: Simplify Security

Software companies must make it easier for everyone to use the security features in software, Microsoft’s founder and chief software architect said this week at the RSA Conference 2006. “If there’s an area where we absolutely have to do better, it’s this,” said Gates. The current situation for users, IT managers and software developers is too complex, he said. Security must be something that users can trust companies to provide. Software providers must make it easier for IT professionals to manage security enterprisewide and for software developers to write secure code. “If we don’t do this right, we won’t get the result we need,” Gates said. Simplifying security is part of Microsoft’s strategy to increase the public’s trust in computing, Gates said. Another element is selling fundamentally secure products that are built from the outset with security in mind. [Source] [McNealy to tech firms: Clean up your security act] [Panel Assesses ‘State Of Security’ During Conference]

WW – Smart Cards to Tighten Security on Internet Sales

Web companies including eBay and Yahoo have joined a new initiative to reduce Internet fraud. Under the plans, millions of Internet users will be sent battery-operated “smart cards” which generate ever-changing pin numbers. Users will have to enter the current pin number before a transaction is authorized. Motorola will incorporate the technology into its mobile handsets, allowing payments to be made by phone. VeriSign, which is setting up the scheme, says it gives online customers an extra layer of protection. It is expected to roll out later this year. [Source]

CH – New ID Card Ensures Privacy in Shenzhen

According to the Shenzhen public security bureau, their next-generation ID card cannot be duplicated, and decrypting its contents could take 10 million years. Such security ensures against misuse of the cardholder’s information, even if the ID card is lost. The new ID card, first launched in Shenzhen in early 2004, has adopted many new technologies. It shows the citizen’s identification information on the card, with the same information stored in an embedded chip. The embedded information can only be read on a special card reader. So far many organizations in Shenzhen have installed these readers, including the labor and social security bureau, banks, telecom operators, customs, and the airport. [Source]

US – Congressional Probe of NSA Spying Is in Doubt

Congress appeared ready to launch an investigation into the Bush administration’s warrantless domestic surveillance program last week, but an all-out White House lobbying campaign has dramatically slowed the effort and may kill it. The Senate intelligence committee was scheduled to vote on a Democratic-sponsored motion to start an inquiry into the recently revealed program in which the National Security Agency eavesdrops on an undisclosed number of phone calls and e-mails involving U.S. residents without obtaining warrants from a secret court. Two committee Democrats said the panel -- made up of eight Republicans and seven Democrats -- was clearly leaning in favor of the motion last week but now is closely divided and possibly inclined against it. [Source]

US – EPIC Seeks Spy Documents in Federal Court

This week, the Senate Judiciary Committee heard a full day of testimony from Attorney General Alberto Gonzales on the NSA’s warrantless surveillance program. The A-G reiterated earlier Administration arguments about the purported legality of the program, but would not discuss operational details. Despite repeated requests, the Administration has refused to provide Congress or the public with legal opinions or other documents concerning the controversial program. The House Judiciary Committee is scheduled to vote on resolutions that would direct the A-G to turn over materials related to the program to the House of Representatives. [Source] [Source] [Source] [Source] [Source]

US – Federal Budget Pumps Money Into Surveillance Projects

President Bush’s proposed $2.77 trillion budget for FY2007 increases spending on surveillance projects while making substantial cuts in education, housing, and farm programs. The Department of Homeland Security has requested $42.7 billion, a 6% increase from last year. Of this, the US-VISIT border program would receive $399.5 million, an increase of $62.9 million. Most of the increase will go toward the expansion of US-VISIT’s fingerprint system; it will now capture all 10 fingerprints instead of two. DHS’s budget request also includes $3.96 million for the Office of Screening Coordination and Operations. This amount is significantly lower than its $847 million request last year, reflecting the decision not to combine eight different screening programs under the office, instead funding each program separately. The current budget request states that the money will be used to set common standards for government screening as well as for Registered Traveler screening programs run by private companies. Participants in the programs must provide iris scans and fingerprints and pass a background check by the Transportation Security Administration. It is unknown what percentage of TSA’s $6.3 billion request would pay for these background checks, which each cost $30 to $50. EPIC’s Oct 2005 Spotlight on Surveillance report found that Registered Traveler had significant security & privacy problems. [Source] [Source] [Source] [Source]

JP – Privacy Law Hampering Cancer Research

The Japanese regional cancer registration system has hit a roadblock as medical institutions refuse to provide information to local governments as they stick to the letter of the privacy law. The Health, Labor and Welfare Ministry has told medical institutions the Personal Information Protection Law did not apply to the regional cancer registration system. However, 10 of the 35 prefectures and major cities that introduced the system said medical institutions had refused to provide the cancer patients’ personal data. [Source]

US – Feingold, Kennedy Ask AT&T and Others if They’re in Bed with NSA

U.S. Communications carriers face increasing scrutiny over their role in the NSA wiretap scandal.

The letter the two senators sent to AT&T, Sprint Nextel, and Verizon. Wall Street Journal: More Surveillance Puts Strain on Carriers: Third Parties Help Telecom, Internet Firms Fill Law Enforcement’s Increasing Data Requests. See A survey of telecommunications and Internet firms about NSA participation:

US – FCC Grants EPIC Petition on Protecting Telephone Records

On Feb. 10, the Federal Communications Commission announced a formal rulemaking to create rules strengthening the security of consumers’ phone records. This action grants EPIC’s August 2005 petition, which was filed out of concerns that consumer records were too easily being acquired and sold online. Data brokers are thought to obtain the information either by taking advantage of lax authentication methods (otherwise known as “pretexting”) or by bribing insiders for information. [Source] [Source] [Source]

US – Phone Privacy Bid May Fail, Firms Warn

Telephone companies said a federal move to tighten safeguards over customers’ cell phone records may backfire if it imposes rigid requirements on corporations such as Cingular Wireless LLC and Verizon Wireless. The FCC chairman has said the agency doesn’t know how many records have been exposed. There are 203 million U.S. cell phone accounts. Most large cell phone companies have sued data brokers, claiming they posed as customers to obtain private calling records and then sold the data. [Source]

WW – How Secure is VoIP, Skype?

Like e-mail, calls via Internet can be hacked, spammed, saved on servers. The allure of Internet phone calling is understandable – dirt-cheap calls to anywhere in the world, sound quality that’s at times superior to the traditional land-line and the ability to take your phone number with you when you travel. But, buyer beware. These calls are just like any other form of digital communication, like e-mail, which can be hacked, spammed and saved on servers. While Internet calling programs from Skype and Vonage to Google and Yahoo are getting more and more popular, security experts warn that they’re not as secure as your traditional land-line.[Source]

US – Secure Flight Placed on Standby

TSA chief Kip Hawley told the Senate Commerce Committee that Secure Flight has been suspended for a comprehensive review of the program’s information security measures. After nearly four years and $150 million, TSA had approved Secure Flight to become operational in September, despite inconclusive risk assessments and 144 known security vulnerabilities. The Secure Flight program was introduced a successor to the now-abandoned second generation Computer Assisted Passenger Prescreening System (CAPPS II). Many of the problems with CAPPS II that led to its demise continued to plague Secure Flight in its test phase, notably problems with checking the names of all airline passengers against government terrorist watch lists. The controversial program has been criticized during its development by civil libertarians, privacy advocates and government auditors who took the TSA to task for secretly obtaining personal information about airline passengers. There is no deadline for the completion of the current (internal) audit. [Source] [GAO Report on Secure Flight] [Source] [Source] [Source] [Source]

US – Report: 325,000 Names on U.S. Terror Suspect List

A government database of alleged international terrorism suspects or associates includes 325,000 names, four times more than when the central list was created in 2003, The Washington Post reported this week, citing counterterrorism officials. The list maintained by the National Counterterrorism Center, or NCTC, contains far more names in a single government database than has previously been disclosed, the newspaper said. But the report cited NCTC officials as saying the true number of individuals listed is estimated to be more than 200,000 because the same person may show up under different spellings or aliases. A NCTC official, speaking on condition of anonymity told the newspaper that the vast majority of those listed are “non-U.S. persons and do not live in the U.S.” [Source]

US – Patriot Act Compromise Clears Way for U.S. Senate Vote

Efforts to extend the USA Patriot Act cleared a major hurdle when the White House and key senators agreed to revisions that are virtually certain to secure Senate passage and likely to win House approval. Several Democrats said the compromise announced lacks important civil liberties safeguards, and even the Republican negotiators said they had to yield to the administration on several points. [Source]

US – Arizona Senate Rejects ID Theft Bill

Arizona Law enforcement officials are backing a bill that called for mandatory jail time for defendants convicted of ID theft. The Senate rejected the measure despite pleas by the bill’s sponsor, who noted that the FTC has identified Arizona as the state with the highest rate of reported ID theft. [Source]

US – Colorado Lawmakers Seek Passage of ID Theft Law

A House Republican and Democrat have teamed up to introduce legislation that would make it illegal in Colorado for anyone to use or possess another person’s personal information for monetary gain. Colorado ranks fifth in the nation in reported incidents of ID theft, but is one of only two states that have yet to pass laws specific to ID theft, according to one of the legislation’s sponsors. [Source]

--------