Home | Databases | WorldLII | Search | Feedback EPIC Alert

EPIC Alert 13.15 [2006] EPICAlert 15

E P I C A l e r t

http://www.epic.org/alert/EPIC_Alert_13.15.html

The legal battles over two different warrantless surveillance programs conducted by the NSA continue, with a one private suit against AT&T continuing in California and another being dismissed in Illinois. The federal government has also sued the state of Missouri to prevent state officials from investigating one of the NSA programs.

A federal district court judge in California allowed a suit against AT&T to go forward, against the federal government's argument that the state secrets privilege prevented the suit from being brought in the first place. The lawsuit, brought on behalf of clients represented by the Electronic Frontier Foundation, alleges that AT&T gave the government access to its facilities to wiretap all of the calls and emails traveling over AT&T's network. The judge held that the suit could continue, noting that AT&T and the government had both disclosed involvement in the clandestine surveillance program.

A federal judge in Illinois, however, dismissed a lawsuit challenging AT&T's cooperation with the NSA in a related surveillance program. This program allegedly resulted in the phone records of millions of Americans being delivered to the NSA for data mining. The suit, brought by private plaintiffs represented by the Illinois ACLU, was dismissed on the state secrets doctrine.

The federal government also continues to block state investigations into the NSA phone records program, with the Department of Justice suing the Missouri Public Service Commission from investigating whether telecommunications companies in their state turned over information to the federal government in violation of law. In June, the Justice Department sued the state of New Jersey to prevent the state attorney general fro conducting a similar investigation.

In May, EPIC wrote to Kevin Martin, chairman of the Federal Communications Commission, and urged the FCC to undertake an investigation into the various reports that customer information was improperly disclosed to the NSA. The EPIC letter stated, "If telecommunication carriers disclosed customer information to the NSA in the manner described in press reports, then violations of section 222 of the Communications Act have occurred."

However, if a law pending in Congress is enacted, all these various legal disputes may be rendered irrelevant. Senator Arlen Specter, Chairman of the Senate Judiciary Committee, has, with the backing of the White House, proposed a bill that would allow warrantless surveillance programs to continue subject to the approval of the secretive Foreign Intelligence Surveillance Court. Specter's bill would allow the court to approve entire surveillance programs. The court currently reviews applications for foreign surveillance and wiretaps. In the period from 2001 to 2005, the government has applied for 7,729 surveillance warrants from the court. Of these, only four were denied.

Specter's bill has been severely criticized by civil liberties groups, who say that it grants "Congressional authorization to the President's unconstitutional conduct" and that it makes compliance with well-established privacy safeguards "merely optional."

Order Denying the Government's Motion to Dismiss the EFF Suit (pdf):

http://www.eff.org/legal/cases/att/308_order_on_mtns_to_dismiss.pdf

Opinion Dismissing the Illinois Suit Against AT&T (pdf):

http://www.epic.org/privacy/surveillance/terkel_op.pdf

EPIC Letter to the FCC on Domestic Surveillance:

http://www.epic.org/privacy/phone/fcc-letter5-06.html

Senator Specter's Bill to Authorize Warrantless Domestic Surveillance:

http://thomas.loc.gov/cgi-bin/bdquery/z?d109:s.02453:

Statement by Civil Liberties Groups Citicizing Specter Bill (pdf):

http://www.cdt.org/security/20060719nsastatement.pdf

EPIC Resources on Domestic Surveillance:

http://www.epic.org/features/surveillance.html

EPIC Executive Director Marc Rotenberg testified in support of new privacy safeguards for the WHOIS database before a subcommittee of the House Financial Services Committee. Currently anyone with an Internet connection, including spammers, phishers, and stalkers, can access information in the WHOIS database. Citing the growing risk of identity theft, EPIC supported proposals to limit public access to personal information.

The WHOIS database contains the personal contact information of anyone who registers a domain name. When a user decides to register a domain name, he is usually asked for his name, address, email address, and phone and fax numbers. The user must also provide the complete contact information for a technical contact and an administrative contact. In the case of individuals or small organizations, the registrant himself is often the administrative contact, providing his own home address and telephone number. If a user does not provide his name or address, or complete contact information for the technical and administrative contacts, his domain name may be taken away. All of this information is then published in the WHOIS database for anyone to access.

Rotenberg said, "This means that both the law enforcement agent with legal authority to investigate crime and a person with the intent to commit crime has the same access to the WHOIS database. This represents a significant privacy and security risk for a domain name registrant."

While witnesses for the Department of Commerce and the financial services companies argued for continuing unrestricted access to WHOIS data, the witness for the Federal Trade Commission said that privacy protection was necessary to protect consumers. Eileen Harrington, Deputy Director of the Bureau of Consumer Protection, said, "The FTC, as the primary enforcement agency for U.S. consumer privacy and data security laws, is very concerned about protecting consumers' privacy. Thus, the Commission has always recognized that registrants engaged in non-commercial activity may require some privacy protection from public access to their contact information, without compromising appropriate real-time access by law enforcement agencies."

Rotenberg noted that the proposals to protect domain name owners' personal information would not affect the ability of law enforcement to access the database. There have been several cases of spammers and fraudsters using the WHOIS database to target victims, including one of the most prolific spammers in the United Kingdom.

A comprehensive review of privacy practices around the world, conducted by EPIC, found that the current ICANN WHOIS data policy has "failed to resolve the privacy risks faced by Internet users that result directly from ICANN’s own data practices."

House Financial Services Hearing on Phishing and the WHOIS Database:

http://www.epic.org/redirect/fs_whois.html

EPIC's Testimony on WHOIS (pdf):

http://www.epic.org/privacy/whois/phishing_test.pdf

EPIC's WHOIS Page:

http://www.epic.org/privacy/whois

EPIC's Privacy and Human Rights 2004 Report on WHOIS:

http://www.epic.org/redirect/phr2004_whois.html

Privacy and Human Rights 2005 Edition:

http://www.epic.org/bookstore/phr2005/phr2005.html

The House Committee on Science and the Committee on Administration held a joint hearing on the effectiveness of electronic voting machines. The hearing investigated the changes made in federal law by the Help America Vote Act (HAVA) to voting technology certification and voting technology guidance given to states.

Witnesses for the hearing included Mary Kiffmeyer, the Secretary of State of Minnesota and David Wagner, a computer science professor at the University of California, Berkeley who advised the state of California on securing electronic voting systems. These witnesses agreed that the current guidance to states recently released by the Election Assistance Commission is not sufficient and that more needs to be done to protect votes cast in public elections.

The National Committee for Voting Integrity also participated in the hearing by providing a written statement, which recommended greater security for e-voting systems. NCVI also criticized the guidelines' lack of focus on auditing, saying that the current review process for ensuring that e-voting systems properly count votes is insufficient. NCVI also noted that the Commission's guidelines, despite warning that the use of wireless technology is risky, still provide recommendations for implementing wireless technology in voting machines.

In related news, the National Research Council recently issued its "Letter Report on Electronic Voting." The report indicated that many jurisdictions may be unprepared for the 2006 general elections in November. The report also emphasized the need for improved security, transparency in vendor certification, and auditability of cast ballots.

Joint Hearing of the House Science and Administration Committees on Electronic Voting:

http://www.house.gov/science/hearings/full06/July%2019/index.htm

NCVI Statement for the Hearing (pdf):

http://www.epic.org/privacy/voting/pdf_files/ncvi_706.pdf

Text of the Help America Vote Act:

http://www.fec.gov/hava/law_ext.txt

National Research Council Report on Electronic Voting:

http://darwin.nap.edu/books/0309102790/html/1.html

EPIC Voting Page:

http://www.epic.org/privacy/voting/

The House Financial Services Committee is pressing for a floor vote on its version of a data breach bill, despite the concerns of state law enforcement and consumer groups. State attorneys general have urged Congress to pass a bill that preserves state protections and state enforcement, while the Financial Services bill preempts state law. The bill also drew harsh criticisms from a coalition of consumer groups, who said that existing state laws are more effective at protecting consumers.

In a letter to House leadership signed by 48 state attorneys general, the National Association of Attorneys General asked Congress to pass data breach bills that would allow for states to retain their own consumer protections and also let state law enforcement supplement federal enforcement efforts. The state officials also urged Congress to pass a law that required breached companies to notify users in all cases, not merely those that the company felt created a particular risk of identity theft. The bill, however, does not allow for state enforcement and requires that a breached entity find it "reasonably likely" that breached data could be used to commit identity theft.

Consumer groups have heavily criticized the Financial Services bill lacking, stating that it actually made it more likely that companies who have lost consumer data will be able to hide the breaches from consumers. A coalition of consumer groups has issued a statement calling the bill's notification policy a "don't know, don't tell" system. The groups also criticized the bill's preemption of state law, saying that it "does nothing for consumers and rolls back existing state consumer protection laws."

A number of federal data breach bills have been proposed in Congress this year, though few have implemented all of the proposals urged by state governments and consumer groups. At least 33 states already have data breach notification laws.

H.R. 3997, the Financial Data Protection Act:

http://thomas.loc.gov/cgi-bin/bdquery/z?d109:h.r.03997:

Statement by Consumer Groups on the Financial Services Bill (pdf):

http://www.epic.org/privacy/choicepoint/consumer_3997.pdf

Statement by State Attorneys General on Data Breach Bills (pdf):

http://www.epic.org/redirect/state_ag_breach.html

US PIRG's List of State Data Breach and Credit Freeze Laws:

http://www.pirg.org/consumer/credit/statelaws.htm

EPIC's Data Brokers Page:

http://www.epic.org/privacy/choicepoint

The D.C. Council agreed last week to install 23 surveillance cameras in residential neighborhoods for the first time. This action, along with an earlier curfew and police access to confidential juvenile information, was taken in response to a proposal from Mayor Anthony Williams for emergency legislation.

EPIC, the ACLU-National Capital Area and the Justice 4 D.C. Youth Coalition were among the groups that protested in front of D.C. Council headquarters against the measures. EPIC has repeatedly warned the Council that the use of closed circuit television systems (CCTV) are ineffective and prone to abuse. Studies have shown that it is more effective to place more officers on the streets and improve lighting in high-crime areas than to use CCTV, and that black males are disproportionately scrutinized when camera surveillance systems are used.

The D.C. Metropolitan Police Department (MPD) currently has a wireless network of 19 cameras mounted on the rooftops of various buildings throughout the city at strategic vantage points such as the Smithsonian Institution Castle, Dupont Circle, Union Station, and outside the city in Arlington, Va. The cameras feed into the MPD's Joint Operations Command Center, located at police headquarters.

The cameras are only turned on during major events and emergencies, which is an important limitation that many other cities do not have. Also important in protecting privacy are the city's policies governing the use of the camera systems. They limit the time the data can be retained. The new legislation changes this limited, specialized surveillance of major events and emergencies into 24-hour surveillance of daily life in D.C. neighborhoods. Cameras can range in price from $40,000 to $100,000 each, and D.C. will spend $2.3 million to buy 23 cameras.

Mayoral candidate and Ward 4 representative Adrian Fenty was the only Council member to vote against the bill. He pointed out that not one part of the emergency legislation was new; each proposal had been rejected by the Council in previous sessions. Mayor Williams had proposed an expansion of CCTV in April, but the Council did not approve it. The measures will be in force for 90 days. The Council has scheduled an October hearing to review use of surveillance cameras.

EPIC's Comments to the D.C. Council on the April CCTV proposal (pdf):

http://www.epic.org/privacy/surveillance/cctvcom062906.pdf

EPIC's December 2005 Spotlight on Surveillance about D.C.'s CCTV system:

http://www.epic.org/privacy/surveillance/spotlight/1205/

D.C. Council Home Page:

http://www.dccouncil.washington.dc.us/

The Observing Surveillance Project:

http://observingsurveillance.org/

EPIC's Video Surveillance page:

http://www.epic.org/privacy/surveillance/

Homeland Security Selects New Privacy Officer

The Department Homeland Security chose its associate general counsel, Hugo Teufel III, as its new chief privacy officer. He will replace acting privacy officer Maureen Cooney, who resigned on July 17th. Cooney had replaced Nuala O'Connor Kelly, who resigned from the position in September 2005 to become chief privacy officer at General Electric. Privacy advocates questioned the appointment, citing Teufel's lack of experience.

Homeland Security Press Release Announcing Teufel's Appointment:

http://www.dhs.gov/dhspublic/display?content=5752

House Bill Would Protect SSN Privacy

A bill giving the Federal Trade Commission the power to prohibit sales of Social Security Numbers was approved by the House Energy and Commerce Committee. The Social Security Number Protection Act, sponsored by Representative Ed Markey, was first introduced in 2000, in response to the stalking and murder of Amy Boyer, whose killer was able to locate a wider variety of information about her after first purchasing her Social Security number online. Social Security numbers, improperly misused as a means of identification by many businesses, also act as a key for identity thieves to access their victims' information.

Text of H.R. 1078, the Social Security Number Protection Act:

http://thomas.loc.gov/cgi-bin/bdquery/z?d109:h.r.01078:

Indian Authorities Censor Blogs

Thousands of blogs were rendered inaccessible in India for a period of several days. Entire domains, including blogspot.com and typepad.com, each of which hosts thousands of blogs, were rendered inaccessible. The Indian Department of Telecommunications issued a press release stating that the censorship was targeted only at 17 particular websites, and that the overblocking was the fault of Internet service providers.

Government Press Release on Blog Censorship:

http://pib.nic.in/release/release.asp?relid=18954

National Database to Track College Students Proposed

In June, the Department of Education released a draft report endorsing a controversial proposal to create a federal database of college student records. The proposal would, in contrast to existing systems, contain individually identifiable information on particular students. The proposal was heavily criticized by colleges and universities, who objected to the individualized tracking of their students. The Department of Education justified the proposal, saying it wished to have better statistics on part-time, transfer, or other nontraditional students.

Initial Version of the Department of Education's Draft Report (see pages 17 and 22) (pdf):

http://www.ed.gov/about/bdscomm/list/hiedfuture/reports/report.pdf

Latest Version of the Department of Education's Draft Report (see page 11) (pdf):

http://www.epic.org/redirect/ed_college_track.html

Amnesty International Releases Report on Tech Companies in China

Amnesty International has released a report condemning Internet companies for collaborating with the Chinese government in suppressing free speech. Focusing on the actions of Yahoo, Microsoft, and Google, the report makes specific recommendations as to how Internet companies operating in China might work to protect free speech and human rights while doing business in the country. Yahoo has reportedly turned over information on dissidents using its services to authorities, while Microsoft and Google have respectively censored blogs and search results that are critical of the Chinese government.

Amnesty Internationl Report on Tech Companies in China (pdf):

http://www.epic.org/redirect/amnesty_tech_china.html

The Wealth of Networks: How Social Production Transforms Markets and Freedom. Yochai Benkler. Yale University Press, 2006.

http://www.powells.com/partner/24075/biblio/4-0300110561-0

"With the radical changes in information production that the Internet has introduced, we stand at an important moment of transition, says Yochai Benkler in this thought-provoking book. The phenomenon he describes as social production is reshaping markets, while at the same time offering new opportunities to enhance individual freedom, cultural diversity, political discourse, and justice. But these results are by no means inevitable: a systematic campaign to protect the entrenched industrial information economy of the last century threatens the promise of today's emerging networked information environment.

In this comprehensive social theory of the Internet and the networked information economy, Benkler describes how patterns of information, knowledge, and cultural production are changing, and shows that the way information and knowledge are made available can either limit or enlarge the ways people can create and express themselves. He describes the range of legal and policy choices that confront us and maintains that there is much to be gained, or lost, by the decisions we make today."

EPIC Publications:

"Information Privacy Law: Cases and Materials, Second Edition" Daniel J. Solove, Marc Rotenberg, and Paul Schwartz. (Aspen 2005). Price: $98.
http://www.epic.org/redirect/aspen_ipl_casebook.html

This clear, comprehensive introduction to the field of information privacy law allows instructors to enliven their teaching of fundamental concepts by addressing both enduring and emerging controversies. The Second Edition addresses numerous rapidly developing areas of privacy law, including: identity theft, government data mining,and electronic surveillance law, the Foreign Intelligence Surveillance Act, intelligence sharing, RFID tags, GPS, sypware, web bugs, and more. Information Privacy Law, Second Edition, builds a cohesive foundation for an exciting course in this rapidly evolving area of law.

"Privacy & Human Rights 2005: An International Survey of Privacy Laws and Developments" (EPIC 2006). Price: $60.
http://www.epic.org/bookstore/phr2005/phr2005.html

This annual report by EPIC and Privacy International provides an overview of key privacy topics and reviews the state of privacy in over 70 countries around the world. The report outlines legal protections, new challenges, and important issues and events relating to privacy. Privacy & Human Rights 2005 is the most comprehensive report on privacy and data protection ever published.

"FOIA 2004: Litigation Under the Federal Open Government Laws," Harry Hammitt, David Sobel and Tiffany Stedman, editors (EPIC 2004). Price: $40.
http://www.epic.org/bookstore/foia2004

This is the standard reference work covering all aspects of the Freedom of Information Act, the Privacy Act, the Government in the Sunshine Act, and the Federal Advisory Committee Act. The 22nd edition fully updates the manual that lawyers, journalists and researchers have relied on for more than 25 years. For those who litigate open government cases (or need to learn how to litigate them), this is an essential reference manual.

"The Public Voice WSIS Sourcebook: Perspectives on the World Summit on the Information Society" (EPIC 2004). Price: $40.
http://www.epic.org/bookstore/pvsourcebook

This resource promotes a dialogue on the issues, the outcomes, and the process of the World Summit on the Information Society (WSIS). This reference guide provides the official UN documents, regional and issue-oriented perspectives, and recommendations and proposals for future action, as well as a useful list of resources and contacts for individuals and organizations that wish to become more involved in the WSIS process.

"The Privacy Law Sourcebook 2004: United States Law, International Law, and Recent Developments," Marc Rotenberg, editor (EPIC 2005). Price: $40.
http://www.epic.org/bookstore/pls2004/

The Privacy Law Sourcebook, which has been called the "Physician's Desk Reference" of the privacy world, is the leading resource for students, attorneys, researchers, and journalists interested in pursuing privacy law in the United States and around the world. It includes the full texts of major privacy laws and directives such as the Fair Credit Reporting Act, the Privacy Act, and the OECD Privacy Guidelines, as well as an up-to-date section on recent developments. New materials include the APEC Privacy Framework, the Video Voyeurism Prevention Act, and the CAN-SPAM Act.

"Filters and Freedom 2.0: Free Speech Perspectives on Internet Content Controls" (EPIC 2001). Price: $20.
http://www.epic.org/bookstore/filters2.0

A collection of essays, studies, and critiques of Internet content filtering. These papers are instrumental in explaining why filtering threatens free expression.

EPIC publications and other books on privacy, open government, free expression, crypto and governance can be ordered at:

EPIC Bookstore http://www.epic.org/bookstore

"EPIC Bookshelf" at Powell's Books
http://www.powells.com/features/epic/epic.html

EPIC also publishes EPIC FOIA Notes, which provides brief summaries of interesting documents obtained from government agencies under the Freedom of Information Act.

Subscribe to EPIC FOIA Notes at:
https://mailman.epic.org/cgi-bin/control/foia_notes

7th Annual Institute on Privacy Law: Evolving Laws and Practices in a Security-Driven World. Practising Law Institute. June 19-20, New York, New York. July 17-18, Chicago, Illinois. Live webcast available. For more information:
www.pli.edu

identitymashup: Who Controls and Protects the Digital Me? Berkman Center for Internet & Society, Harvard Law School. June 19-21, 2006. Cambridge, Massachusetts. For more information:
http://www.identitymash-up.org/

Call for papers for Identity and Identification in a Networked World. Submissions due by July 5. New York University. Symposium on September 29-30, 2006. New York, New York. For more information:
http://www.easst.net/node/976

Infosecurity New York. Reed Exhibitions. September 12-14, 2006. New York, New York. For more information:
http://www.infosecurityevent.com

34th Research Conference on Communication, Information, and Internet Policy. Telecommunications Policy Research Conference. September 29-October 1, 2006. Arlington, Virginia. For more information:
http://www.tprc.org/TPRC06/2006.htm

6th Annual Future of Music Policy Summit. Future of Music Coalition. October 5-7, 2006. Montreal, Canada. For more information:
http://www.futureofmusic.org/events/summit06/

The IAPP Privacy Academy 2006. International Association of Privacy Professionals. October 18-20, 2006. Toronto, Ontario, Canada. For more information:
www.privacyassociation.org

International Conference on Privacy, Security, and Trust (PST 2006). University of Ontario Institute of Technology. October 20-November 1, 2006. Markham, Ontario, Canada. For more information:
http://www.businessandit.uoit.ca/pst2006/

BSR 2006 Annual Conference. Business for Social Responsibility. November 7-10, 2006. New York, New York. For more information:
http://www.bsr.org/BSRConferences/index.cfm

CFP2007: Computers, Freedom, and Privacy Conference. Association for Computing Machinery. May 2007. Montreal, Canada. For more information:
http://www.cfp2007.org

Subscribe/unsubscribe via web interface:

https://mailman.epic.org/cgi-bin/mailman/listinfo/epic_news

Back issues are available at:

http://www.epic.org/alert

The EPIC Alert displays best in a fixed-width font, such as Courier.

The EPIC Alert mailing list is used only to mail the EPIC Alert and to send notices about EPIC activities. We do not sell, rent or share our mailing list. We also intend to challenge any subpoena or other legal process seeking access to our mailing list. We do not enhance (link to other databases) our mailing list or require your actual name.

In the event you wish to subscribe or unsubscribe your e-mail address from this list, please follow the above instructions under "subscription information."

The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, see http://www.epic.org or write EPIC, 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. +1 202 483 1140 (tel), +1 202 483 1248 (fax).

If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "EPIC" and sent to 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. Or you can contribute online at:

http://www.epic.org/donate

Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and expanding wiretapping powers.

Thank you for your support.

.