Privacy News Highlights
23 December 2005—10
January 2006
Contents:
US – Reports:
Biometrics Can Be Useful In Databases Without Sacrificing Privacy
US – U.S. Considering Fingerprinting European Visitors
US – Minnesota to Use Biometrics on IDs
CA – Federal Privacy Commissioner Awards
$148,850 for Research on Privacy Issues
CA – Privacy Commissioner Inquires into
Privacy Allegations Involving Ottawa-Area MP
CA – More Fret Over Edmonton Cop Database
Usage
WW – Retailers Increasingly Ask for Personal Information
CA – Edmonton Shop Owner Ready to Fight
Computer Tracking System
US – Poll Shows Young Americans Possess ‘Healthy Attitude
Toward Privacy’
US – CNET News.com Investigation: U.S. Agencies Tracking
Online Users
US – ISP Receives $11.2 Billion Judgment Against Spammer
WW – Survey: EBay, PayPal Top List of Phishing Targets in
2005
US – Online Public Records Stir Fears About Privacy and
Safety
US – Survey Results Show Companies Shun Encryption
UK – Privacy Commissioner Approves First Overseas
Employee Data Transfer
JP – Voters Evenly Split on Impact of New Privacy Law
US – 6 Months After Deadline, Many e-Retailers Lag in
Card Data Security
UK – World’s Largest DNA Database Will Include One in 14
Britons
CA – Health Researcher to Track Residents
US – President Bush to Push Medical Record
Computerization
US – Michigan Leaders Collaborate on New Health
Information Network
US – VISA Deals with Possible Security Breach
US – Marriot Loses Data on 200,000 Customers
US – H&R Block Error Exposes Consumer SSN Data
UK – Confusion Swirls Over Whether New UK Identity Cards
Are Voluntary
CA – Sony Hit With Canadian Rootkit Class
Actions
WW – Sony Reaches Settlement of U.S. Rootkit Class
Actions
WW – ‘Fingerprinting’ to Unmask Anonymous Web surfers
US – Posner Argues Electronic Surveillance Not Privacy
Invasion
US – Anti-Offshoring Movement Builds
WW – Companies Feeling the Effects of Spyware
FR – French Parliament OKs Anti-Terror Measures
JP – Privacy Concerns Reduce Responses to Census
US – 2005 Was The Worst Year For Computer Security
Breaches
WW – Top 10 Privacy Stories of 2005 from the Electronic
Privacy Information Center
WW – EPIC’s Top Ten Privacy Issues to Watch in 2006
WW – Pfizer Fights Fake Pills With RFID
EU – German Privacy Hackers Develop RFID Zapper to
Destroy Passive RFID tags
JP – RFID Tracking Chips for Japanese Students
WW – Study: Data Loss, Network Vulnerabilities Top
Security Issues
US – Spy Agency Mined Vast Data Trove, Officials Report
US – Judge Posner Argues Electronic Surveillance Not
Privacy Invasion
US – 3 Judges On Special U.S. Spy Court Upset By Wiretaps
US – Illinois Governor Announces Phone Records Privacy
Legislation
US – U.S. Opening Some Private Mail in Terror Fight
US – Americans Worry About Government Abuses Of Privacy
US – Minnesota A-G Seeks Legislation to Ban Bulk Sale of
Driver’s License Information
US – CDC Passenger Database Hits Turbulence
US – Data Security Movement Backburnered By Lawmakers
US – New State Laws Seek to Halt Identity Theft
UK – Employees Have Right In Most Cases to View
References
US – Las Vegas Cocktail Waitresses Monitored For Beverage
Service Using RFID
The National
Biometric Security Project, a research and analysis organization, has
issued reports that analyze the impact of biometrics on
Homeland Security officials are considering requiring
European travelers to keep their fingerprints on file with the
The Privacy Commissioner of
Several constituents have expressed concerns about
whether Ottawa-area Tory MP Cheryl Gallant has used their personal information,
submitted on a passport application, for political purposes. The Office of
Privacy Commissioner Jennifer Stoddart is inquiring about a complaint of
possible misuse of personal information after people received birthday cards
from Gallant’s office. The MP’s spokeswoman says that MPs are not covered by
the Privacy Act. The official’s
campaign spokeswoman said constituents’ birth dates are not gleaned from
passport applications and stored in a database. [Source]
[Source]
The number of people demanding to know whether city
cops have run their names through criminal databases has shot through the roof.
And one expert says that’s because of public suspicion of what cops are up to. “There’s
evidence members of the (Edmonton Police Service) are accessing information
without good reason,” said a
Retail businesses value their customers’ telephone
numbers and frequently have sales clerks request them at the register. But
privacy experts warn consumers to value their personal privacy by refusing to
give their telephone numbers. Merchants say they do not sell the information to
third parties, but instead use the data to target customers with special
offers. Privacy advocates contend that it is difficult for consumers to
ascertain what the company does with telephone numbers, especially if it is
joined with other personal information. [Source]
[Source]
A city pawnshop owner says he’s ready to fight for his
customers’ privacy rights - even if the battle lands him in court. Kelly
Buryniuk said he will defy a city bylaw that kicks in Jan. 1 forcing secondhand
dealers to use a computer system that tracks detailed personal information on
customers. Buryniuk said he’ll continue to keep detailed customer records and
make them available to police. Pawnshops have been doing that for decades. Buryniuk
said his concern is the new law requires secondhand dealers to electronically
transfer that information to a company contracted by the city. The company,
Saskatchewan-based Business Watch International, will process the data and send
it to cops. Buryniuk said he’s concerned the customer files could get into the
wrong hands, leading to problems such as identity theft. [Source]
A recent poll to gauge attitudes about revelations
that President Bush had authorized secret spying on Americans shows that young
adults between the ages of 18 and 29 disapprove of the once-secret electronic
monitoring program. The poll, according to The Decatur Daily editorial,
indicates that young adults want the government to “do the right thing, follow
the law, and safeguard individual privacy.” [Source]
Government agencies and dozens of
Yes, billion.
A Midwest internet service provider was awarded an $11.2 billion judgment
against a
According to year-end 2005 data from research firm
Netcraft, eBay and PayPal were the top phishing targets representing 62% of
attacks. [Source]
The balance between open government and the right to
privacy is proving difficult for some public-sector officials who had not
anticipated the complexities of providing online access to public records. Laws
about posting personal information on the Internet vary from state to state.
While public officials in
The Ponemon Institute’s 2005 National Encryption
Survey shows that only 4.2% of companies said their organizations have an
encryption plan. While the U.S.-based study shows that many IT professionals
view encryption as an important security tool, respondents cited concern about
system performance, complexity and cost as the reasons for not encrypting
sensitive or confidential information. PGP sponsored the survey. [Source]
In the first authorized transfer outside the European
Economic Area, the
A survey of Japanese voters has found that nearly 60%
of people surveyed are concerned that “overprotection” of their personal
information could make pose an inconvenience while 61% of the 3,000 respondents
said they fear their information could be exposed or misused. In April, the
country’s Personal Information Protection Law took effect. [Source]
Six months after deadline for compliance, a large
percentage of online merchants still haven’t complied with the data protection
rules of MasterCard International, Visa
The Home Office has predicted that by April 2008 one
in 14 people will be recorded on a Government DNA database. It is expected that
there will be 4,250,000 DNA samples on the national database at the end of
2007-08, which amounts to roughly 7% of the population. In March 2005 the
figure stood at just over three million people, or 5% of the population. The
world’s second-largest DNA database is in
A researcher at
President Bush is readying a major push to computerize
the nation’s medical records, including what is expected to be between $100
million and $200 million in funding for the program in the federal budget he
will propose next month. [Source]
Michigan Gov. Jennifer M. Granholm has announced that
a group of 300 healthcare and information technology experts will work to
establish the Michigan Health Information Network. Eventually, the network
would enable e-medical records to move with patients statewide, in an effort to
improve quality of care. Protecting patient privacy will remain paramount in
the effort, the participants said. [Source]
Visa
Marriott International’s time-share division said that
it is missing backup computer tapes containing credit card account information
and the Social Security numbers of about 206,000 time-share owners and customers,
as well as employees of the company. [Source]
[Source]
Some consumers may be dismayed to find their Social
Security numbers printed on unsolicited packages from H&R Block, the result
of a recent labelling blunder at the company. The packages, which H&R Block
mailed in December, contained free copies of the company’s tax preparation
software, TaxCut. By mistake, some of the packages also displayed recipients’ Social
Security numbers, which were embedded in 47-digit tracking codes above mailing
labels. [Source]
A new government document suggests that local
officials will be asked to check the Electoral Register to determine who has
failed to register or keep their address information accurate after they move.
The plan is causing some opponents to bristle because they expected that card
registration would be voluntary. [Source]
[No
identity card? You could be fined £2,500] [A
tax on being alive]
Echoing the U.S. lawsuit, a $100-million class action
was launched in Ottawa against Sony BMG Music (Canada) Inc. over allegations the
company damaged Canadians’ computers with software designed to thwart online
piracy. [Source]
A proposed settlement of lawsuits against Sony BMG
Music Entertainment would let consumers receive free music downloads to
compensate them for Sony including flawed software on millions of CDs. Lawyers
said the deal requires the world’s second-largest music label to stop
manufacturing compact discs with MediaMax software or with extended copy protection
or XCP software that could leave computers vulnerable to hackers. [Source] [Source] [Source] [Michael
Geist commentary] [Proposed
settlement]
Extract: “One could also use our techniques to help
track laptops as they move, perhaps as part of a Carnivore-like project. A
fingerprinter can use the information contained within the TCP headers to
estimate a device’s clock skew and thereby fingerprint a physical device.
...Our techniques report consistent measurements when the measurer is thousands
of miles, multiple hops, and tens of milliseconds away from the fingerprinted
device, and when the fingerprinted device is connected to the Internet from
different locations and via different access technologies.” [Source]
Judge Richard Posner has written an op-ed in which he
argues that machine collection and processing of data cannot, as such, invade
privacy. He states that because of their volume, the data are first sifted by
computers, which search for names, addresses, phone numbers, etc., that may
have intelligence value. Posner believes that this initial sifting, far from
invading privacy, keeps most private data from being read by any intelligence
officer. [Source] [Commentary:
Judge Posner's Troubling Call for Massive Surveillance] [Commentary]
Pressure will continue for passage of bills at the
state and national level to stop jobs from moving overseas. Forrester Research
has estimated that 3.3 million
IDC, a global provider of market intelligence,
estimated that spyware problems represent 30% of all helpdesk calls. According
to Webroot, about 87% of all computers scanned by the company had some type of
spyware. Governments are stepping in with enforcement and legislation. [Source]
The number of people who refused to respond in the
national census carried out in October for fear that their personal information
could be misused increased compared with the census taken five years ago,
according to a recent survey. [Source]
At least 130 security breaches in 2005 exposed more
than 55 million Americans to the risk of identity theft. Despite the
record-setting number of breaches, ID theft bills remain stalled in Congress. [Source]
§
§
Security Breaches on the Rise (more than 130 in
2005)
§
Defense Department Ignores Privacy Laws (Student
recruitment database)
§
In Federal Court, a Good E-mail Privacy Decision
(intercepting e-mails violates the Wiretap Act)
§
Privacy for Voters (guidelines for electronic
voting, voter ID requirements struck down)
§
State Department Drops Hi-Tech Passport Plan
(RFID = bullseye on US citizens)
§
NSA Domestic Spying Disclosed (lack of judicial
review for eavesdropping)
§
Problems Remain with Travel Screening Plans
(Problematic no-fly lists)
§
Credit Freeze Laws on the Rise (identity theft a
result of creditors not verifying thieves identities)
§
Surveillance of Activists Revealed (increasing
role of military in domestic policing and surveillance)
The
USA PATRIOT Act is yet again up for renewal, biometric technologies are on the
rise, and students are being used as the guinea pigs for the next generation of
privacy-invading policies. Issues both new and familiar will be making their
way into the privacy debate in 2006:
§
Nomination of Samuel Alito to the Supreme Court
§
Future of REAL ID Act
§
Expansion of US VISIT Program and collection and
use of fingerprints
§
Workplace Privacy (surveillance)
§
Student Privacy (spychip IDs, marketing)
§
Location Tracking (vehicle, cell phone and
mission creep)
§
New Revelations About Government Datamining (Son
of TIA)
§
Wiretapping the Internet (expansion of CALEA,
lawful access)
§
DNA Databases and Genetic Privacy Legislation
§
Data Broker Regulation (Congress likely to act)
Pfizer, the maker of Viagra, is now fighting back
against counterfeit pills with technology. The company began on Dec. 15 to
affix RFID tags to all
A group of German privacy hackers have come up with a
portable device that can wipe a passive RFID-Tag permanently. While it is known
that RFID tags could be wiped, it usually took some fairly cumbersome microwave
gear to get the job done, and the result could damage whatever the tag was installed
on. But, according to the group’s website,
two developers have managed to make a functioning prototype and produce plans
that everyone can use to build their own RFID-Zapper. [Source]
Electronic giant Fujitsu collaborated with a suburban
Phoenix Technologies conducted a survey of industry
experts, analysts and technology and government leaders during its recent
conference on the state of digital information security. The respondents said
the “greatest concern” about endpoint security was unauthorized access to
network data. Half of the respondents said endpoint security is very likely or
likely to solve many of the current security problems. [Source]
The National Security Agency has traced and analyzed large
volumes of telephone and Internet communications flowing into and out of the
Judge Richard Posner has written an op-ed in which he
argues that machine collection and processing of data cannot, as such, invade
privacy. He states that because of their volume, the data are first sifted by
computers, which search for names, addresses, phone numbers, etc., that may
have intelligence value. Posner believes that this initial sifting, far from
invading privacy (a computer is not a sentient being), keeps most private data
from being read by any intelligence officer. [Source] [Daniel
Solove commentary: Judge Posner’s Troubling Call for Massive Surveillance]
[Commentary]
Three
Gov. Rod R. Blagojevich has proposed legislation to
crack down on the unauthorized release or sale of telephone records and other
private information. The
Dr. Larry Ponemon, founder and president of the
Ponemon Institute, did a survey recently that found increasing concern about
the government’s secret surveillance of Americans. While many Americans seem
less fazed by commercial data breaches, Ponemon’s study suggests that Americans
harbor serious concerns about government privacy issues. [Source]
AG Mike Hatch announced that the Department of Public
Safety has sold state driver’s license data to about 5,000 outside groups.
Hatch is seeking legislation that would restrict the state from selling driver’s
license data in bulk to commercial companies. Under Hatch’s plan, anyone who
wants the information would have to pay $5 per name and also notify the driver
of the data request. [Source]
The Centers for Disease Control’s (CDC) recent
proposal to set up a new passenger database to track possible disease vectors
and bioterrorism outbreaks may overlap with other databases, as well as raise
privacy concerns, according to public comments submitted on the plan. The new
database, which covers both airline and cruise ship passengers, will cost the
travel industry $117 million to $425 million, according to a CDC regulatory
impact analysis of the new program. Most of that expense, from $5 million to
$316 million, will pay for data collection, while about $108 million will go to
computer reprogramming costs for airlines, cruise ships and travel agencies,
the CDC analysis said. [Source]
Once a hot-button item, data and identity theft
protection has stalled in Congress, a Gartner research analyst said Thursday,
pushed aside by bigger political fish, ranging from
Multiple states enacted laws on January 1st
designed to help prevent identity theft. New and existing state laws require
timely notification of information breaches to affected customers, and related
legislation allows consumers to freeze their credit reports as a means of
identity-theft prevention and protection. 12 states have credit-freeze legislation,
which allows residents to block new creditors from accessing their credit
reports and helps prevent identity thieves from opening spending accounts using
a stolen name. Credit-freeze laws in
The UK Information Commissioner has found that the Data Protection Act, in most cases,
allows workers to review information received from references. The commissioner
has provided guidance on the issue following several inquiries from employers
and employees. Employers may lawfully refuse an employee’s request to see a
copy of some references under certain circumstances, according to the Information
Commissioner. [Source] [Data
Protection Good Practices Note]
Harrah’s Entertainment has unveiled a pilot RFID
program to monitor how long it takes waitresses to serve drinks to casino
customers. Waitresses at the