Home | Databases | WorldLII | Search | Feedback EPIC Alert

EPIC Alert 14.14 [2007] EPICAlert 15

E P I C A l e r t

On June 28, the European Union and the United States reached agreements on two forms of data sharing - that of passenger travel records and that of consumers' financial data.

The first agreement concerns the transfer of passenger name record (PNR) information for travelers on all flights originating in the EU and landing in the US. A 2004 agreement on the same subject was declared invalid by the European Court of Justice in 2006. Although the Court's decision did not address the privacy issues of PNR data transfer, EU officials have expressed concern during agreement negotiations over the amount of data collected, the length of time for which the data is retained, and the lack of access and redress for EU citizens.

In March 2007, EPIC Executive Director Marc Rotenberg testified before the Committee on Civil Liberties, Justice and Home Affairs of the European Parliament regarding the interim PNR arrangement. Mr. Rotenberg said that there were too few safeguards in place to prevent the use of European data by the US government for purposes unrelated to preventing future terrorist acts.

The new agreement reduces the 34 pieces of data on passengers now collected by US law enforcement authorities to 19 data fields, including name, contact data, payment details, and itinerary information. The agreement also extends access to PNR information to EU citizens consistent with the provisions in the US Privacy Act and the Freedom of Information Act. The agreement does not, however, go so far as to extend the full protections of the Privacy Act. In a letter attached to the agreement, the US states that the Department of Homeland Security “had made a policy decision to extend administrative Privacy Act protections to PNR data” of non-US citizens and that all individuals have access to the DHS' redress system developed for travelers. Finally, the US letter states that PNR data will be retained for a minimum of 15 years.

In his letter to the EU's Minister of the Interior, European Data Protection Supervisor Peter Hustinx outlined four areas of “grave concern” with the new agreement: the lengthened retention period for PNRs, the US' use of letters to avoid a binding agreement, the lack of a “robust” system of redress, and the possibility of US data sharing between an undisclosed number of agencies.

The second agreement concerns the US' acquisition and use of financial data from an EU-based banking consortium. Last June, it was revealed that the US used broad, secret administrative subpoenas to review vast amounts of information from Belgium-based SWIFT, which routes financial data among 7,800 financial institutions in more than 200 countries. In this new agreement between the US and the EU, the US will restrict its use of any data received from SWIFT to being exclusively for counter-terrorism purposes. The US plans to retain the data for up to five years. In addition, the European Commission will appoint an "eminent European" who will conduct oversight of US use of SWIFT data.

Europa, Passenger Name Record FAQ:

http://www.epic.org/redirect/PNRFAQ.html

EU-US Agreement on Passenger Name Records (June 28, 2007) (pdf):

http://www.epic.org/privacy/pdf/pnr-agmt-2007.pdf

Letter from European Data Protection Supervisor, Peter Hustinx, to the German Council Presidency on Proposed PNR Data Sharing Agreement (June 27, 2007) (pdf):

http://www.epic.org/privacy/pdf/hustinx-letter.pdf

EU-US SWIFT Agreement (June 28, 2007) (pdf):

http://www.epic.org/privacy/pdf/swift-agmt-2007.pdf

EPIC's page on EU-US Airline Passenger Data Disclosure:

http://www.epic.org/privacy/intl/passenger_data.html

Spotlight on Surveillance on the SWIFT program:

http://www.epic.org/privacy/surveillance/spotlight/0606/

European Parliament, PNR/SWIFT/ Safe Harbour Are Transatlantic Data Protected? (March 26, 2007) (pdf)

http://www.epic.org/redirect/EP-0307.html

This week EPIC joined nine other privacy and consumer in submitting comments to the Federal Communications Commission (FCC) calling for stronger safeguards for customers' telephone records. The Consumer Coalition recommended that the FCC establish comprehensive privacy rules that would require telephone companies to limit access to and retention of consumer call data, implement audit trails to track access to data, and curtail delays of law enforcement to customer notification in the event of a security breach.

Last month, in response to a 2005 EPIC petition, the FCC adopted new rules to strengthen the security of consumers' phone records and requested comments on additional security proposals. The new rules relate to the treatment of customer proprietary network information (CPNI), which includes time, date, duration and destination number of each call, type of network a consumer subscribes to, and any other data that appears on the consumer's telephone bill.

The new rules also include a requirement that carriers notify customers of unauthorized disclosures of telephone records; however, law enforcement agencies can delay notifying an individual of a breach for up to 14 days. Such a period may be extended “as long as reasonably necessary in the judgment of the agency,” according to the rules. FCC Commissioners Jonathan Adelstein and Michael Copps, among others, have criticized this provision, and the Consumer Coalition urged the FCC to restrict such delays. As Commissioner Adelstein noted, “Under these rules, the Commission gives the Federal Bureau of Investigation a potentially open-ended ability to delay customer notification of security breaches . . . automatic delays coupled with unlimited extensions are not appropriate.”

In its comments, the Consumer Coalition emphasized the vulnerability of personal information on mobile devices, particularly when the devices are lost or stolen. This information could include personal and business correspondence, tax and bank records, and corporate client data. The Consumer Coalition requested that the FCC provide consumers with a feasible method of easily and permanently removing personal information from mobile devices. As it stands, no federal rules regulate the security or use of personal information on mobile devices.

The Consumer Coalition also urged the FCC to adopt a comprehensive opt-in policy before customer information is disclosed to carriers' agents or affiliates, because such a policy is “the only truly effective means to provide privacy protection to those consumers who desire it.” Because the current opt-out policy provides inadequate coverage and notice, carriers must be required provide customers with clear and conspicuous notice of their right to opt in.

The Consumer Coalition also commended the FCC for extending CPNI rules to VoIP providers. “Even though there may be technical differences between telecommunications carriers and VoIP providers, both types of companies are dealing with consumers' personal information. Even though VoIP providers may collect less information, they should still be held to CPNI regulations for the information they do collect,” the Consumer Coalition said.

The Consumer Coalition is: Consumer Action, Consumer Federation of America, Consumers Union, Electronic Privacy Information Center, National Consumers League, Privacy Activism, Privacy Journal, Privacy Rights Clearinghouse, U.S. Public Interest Research Groups, Utility Consumers' Action Network.

EPIC's Comments to the FCC (pdf):

http://www.epic.org/privacy/cpni/cpni_070607.pdf

EPIC's page on CPNI:

http://www.epic.org/privacy/cpni

FCC's Report and Order and Further Notice of Proposed Rulemaking (pdf):

http://hraunfoss.fcc.gov/edocs_public/attachmatch/FCC-07-22A1.pdf

EPIC's 2005 Petition to the FCC on CPNI:

http://www.epic.org/privacy/iei/cpnipet.html

The European Commission Directorate on Competition recently announced that it would review Google's $3.1 billion merger with Internet advertising company DoubleClick. The decision to review was made shortly after European consumer group BEUC sent a letter urging the Commission to investigate the merger.

BEUC reminded the Commission that it has publicly defined its role as preventing mergers that would deprive consumers of “high quality products, a wide selection of goods and services, and innovation.” BEUC also noted that the European Commission has considered consumer choice as an element in its review of past mergers.

Furthermore, BEUC explained that Google could establish a monopoly in the online advertising industry, effectively reducing its competition and raising privacy concerns about the massive quantities of user data retained. By combining DoubleClick's databases and customer profiles with its own, Google will be able to track its users' online activities almost continuously. When they offered their private information to either company, most consumers did not know that in the future there would be a merger that would give the companies a more complete profile of individuals' behavior, stated BEUC. The monopoly resulting from this merger would give Google little incentive to provide its users with improved service and adequate privacy protections.

The European Commission Directorate on Competition is not the only agency currently reviewing the proposed Google and DoubleClick merger. The Article 29 Data Protection Working Party also recently expanded an investigation of Google's data retention policies after receiving Google's response to their initial inquiry. The initial review focused on Google's storage periods of server logs, whereas the Working Party has indicated that its new investigation will evaluate the previous analysis in addition to the data protection issues at stake with other search engines. The U.S. Federal Trade Commission is also reviewing the proposed merger.

The European Commission Directorate on Competition:

http://ec.europa.eu/comm/competition/index_en.html

BEUC's letter on Proposed Acquisition of DoubleClick by Google (pdf):

http://www.epic.org/privacy/ftc/google/beuc_062707.pdf

Article 29 Data Protection Working Party Press Release (pdf):

http://www.epic.org/redirect/a29_press.html

EPIC's page on Proposed Google/DoubleClick Merger:

http://www.epic.org/privacy/ftc/google/

On July 6, the Sixth U.S. Circuit of Appeals ordered the dismissal of a lawsuit challenging President Bush's domestic spying program, saying the plaintiffs lacked the standing to sue because they could not prove the government had monitored their communications. The court did not rule on the issue of whether warrantless wiretapping is legal. The 2-1 ruling vacated a 2006 order by a district court in Detroit, which found that the warrantless surveillance program violated constitutional rights to privacy and free speech and the separation of powers. The case, ACLU v. NSA, will either be appealed to the Supreme Court or remanded to the District Court in Detroit for dismissal.

Many of the specifics of this surveillance program remain undisclosed, but the Bush administration has publicly acknowledged that the program includes the warrantless wiretapping of telephone and email communications where one party is located outside the United States. The plaintiffs in ACLU v. NSA included journalists, academics and lawyers all of whom alleged that they have a “well-founded belief” that their communications were tapped. The District Court held that the plaintiff had standing based on the three publicly acknowledged facts about the programs. The Appellate Court rejected this reasoning stating, “the plaintiffs have failed to meet this burden because there is no evidence in the record that any of the plaintiffs are personally subject to the TSP [Terrorist Surveillance Program].”

This case is separate from, but related to, Hepting v. AT&T, a class action lawsuit filed in January 2006 by the Electronic Frontier Foundation (EFF) against telecommunications company AT&T. EFF alleges that AT&T permitted and assisted the U.S. government in unlawfully monitoring the communications of a large part of the United States, including AT&T customers, businesses and third parties whose communications were routed through AT&T's network, as well as Voice over IP (VoIP) telephone calls routed via the Internet. In July 2006, the U.S. District Court for the Northern District of California, where the suit was filed, rejected a U.S. government motion to dismiss the case.

In May, EPIC, in cooperation with the Stanford Constitutional Law Center, filed an amicus brief in Hepting v. AT&T, arguing that the “plaintiffs have alleged direct personal injury, namely that their own communications were diverted by AT&T to the government in violation of federal statutes and the Constitution.” This case is now on appeal before the Ninth Circuit.

Sixth Circuit Appeals Court Decision in ACLU v. NSA (pdf):

http://www.ca6.uscourts.gov/opinions.pdf/07a0253p-06.pdf

EPIC's Spotlight on Surveillance on Warrantless Surveillance (Jan. 2006):

http://www.epic.org/privacy/surveillance/spotlight/0106/

EPIC's Page on Hepting v. AT&T Corp.:

http://www.epic.org/privacy/hepting/

On July 9, FBI Director Robert S. Mueller III met with EPIC and several other privacy groups to discuss the FBI's new internal guidelines for the use of national security letters (NSLs). NSLs are an extraordinary search procedure by which the FBI can compel disclosure of data from telephone companies, financial institutions, Internet service providers and consumer credit agencies without judicial approval. In March, the Department of Justice's Office of the Inspector General (OIG) issued a report detailing significant abuse of the FBI's NSL powers. On March 29, 2005, EPIC sent a Freedom of Information Act request seeking records on the FBI's use of its expanded Patriot Act powers. The documents obtained by this request describe 13 cases of possible FBI misconduct in intelligence investigations. In response to these reports, the FBI issued new internal guidelines to all of its agents in June on the “use, requirements, and reporting of National Security Letters.”

The guidelines fail to address the concerns EPIC has expressed in its letters to the Senate Judiciary Committee. Based on EPIC's Freedom of Information Act request, and the OIG's report, EPIC has called for a repeal of Section 505 of the Patriot Act, which expanded the NSL power. The FBI's new guidelines continue to allow NSLs to be issued under the lower standard, and continue the practice of allowing field offices to issue NSLs, rather than the pre-Patriot Act requirement of FBI headquarters approval. The guidelines do not mandate that information obtained through an NSL be labeled as such before being uploaded into the FBI's database, making tracking of how NSLs are used difficult. There continues to be no independent judicial oversight of NSL requests. Additionally, the guidelines offer no guidance on when a “less intrusive means of obtaining the information are feasible,” nor is there any guidance on when non-disclosure, or gag orders, should be included with an NSL.

In a letter to the Senate Judiciary Committee in October 2005, as Congress was considering whether to renew provisions of the Patriot Act that would otherwise sunset, EPIC first brought attention to the internal documents that revealed that there were abuses of the Patriot Act by the FBI. The 2005 EPIC letter to the Senate Judiciary Committee noted that Attorney General Gonzalez had testified during the Patriot Act reathorization that "there has not been one verified case of civil liberties abuse" resulting from Patriot Act authority and that FBI Director Mueller has similarly testified "I as well am unaware of any substantial allegation that the government has abused its authority under the Patriot Act."

FBI Press Release on July 9 Meeting With Privacy Groups:

http://www.fbi.gov/pressrel/pressrel07/privacygroups070907.htm

Revised NSL Guidelines (pdf):

http://www.epic.org/privacy/nsl/New_NSL_Guidelines.pdf

EPIC's Letter to Senators Specter and Leahy (March 21, 2007) (pdf):

http://www.epic.org/privacy/pdf/nsl_letter.pdf

EPIC's Letter to Senators Specter and Leahy (June 16, 2006)

http://www.epic.org/privacy/surveillance/sen_iob_letter.pdf

EPIC's Letter to Senators Specter and Leahy (Oct. 24, 2005) (pdf):

http://www.epic.org/redirect/epic_letter.html

EPIC's Page on NSL:

http://www.epic.org/privacy/nsl/

EPIC Urges Protection of Internet Subscriber Data

On July 9, EPIC joined five groups in filing a "friend of the court" brief in New Jersey v. Reid, an appeal to the state Supreme Court regarding an illegal subpoena to an Internet service provider demanding data on a subscriber. The lower court held that subscribers have a reasonable expectation of "informational privacy," defined as "the ability to control the acquisition or release of information about oneself." In their brief, the groups explained, "This case raises far-reaching questions about the scope of privacy protection in the electronic environment," especially because subscriber information "can reveal substantially more about an individual than, for example, the phone numbers she dials." The groups urged the NJ Supreme Court to uphold the ruling: "Like the ability to engage in phone calls confidentially from one's home, so too is the right to make confidential electronic communications from one's home computer deserving of protection."

Brief of EPIC and Five Groups (pdf):

http://www.epic.org/privacy/nj_reid/amicus_reid.pdf

Lower Court Decision in New Jersey v. Reid (pdf):

http://www.epic.org/privacy/nj_reid/reid_superior_ct.pdf

CRS Publishes Report on Fusion Centers

The Congressional Research Center (CRS) has published a new report entitled, "Fusion Centers: Issues and Options for Congress." The report offers insight on the deployment of over 40 law enforcement fusion centers throughout the nation. The goal of fusion centers is to bring together information from distributed sources for the purpose of risk assessment and “preventive action.” The CRS report states that officials justifying the development of fusion centers use a number of presumptions, and that the goals of the centers seem to be unfocused with wide-ranging explanations on what they are intended to accomplish. The report outlined threats to civil liberties and privacy posed by the deployment of fusion centers, because of the scope and volume of personally identifiable information that could be collected on entire populations within the jurisdiction of a fusion center. The report states that there are no federal laws that provide oversight for the work of fusion centers.

CRS Report: "Fusion Centers: Issues and Options for Congress" (July 6, 2007) (pdf):

http://www.epic.org/privacy/fusion/crs_fusionrpt.pdf

EPIC's Page on Fusion Centers:

http://www.epic.org/privacy/fusion/

GAO Releases Faulty Report on Identity Theft and Data Breaches

The Government Accountability Office (GAO) released a report titled “Personal Information: Data Breaches Are Frequent, but Evidence of Resulting Identity Theft Is Limited; However, the Full Extent Is Unknown.” The GAO found that, of the 24 breaches it studied from 2000-2005, only three included clear evidence that the breach resulted in fraud on existing accounts. Based on this data, the GAO suggested that Congresional enactment of a risk-based federal notification system could avoid posing undue burden on orgnanizations who may otherwise have to provide notification for breaches that pose little risk.

suggested that if Congress were to enact a federal notification requirement, a system whereby consumers are notified only when a predetermined level of risk is present might enable businesses to the cost of 'counterproductive' notifications.

Despite appearing to diminish the statistical likelihood of identity theft, the GAO report repeatedly states that the extent to which breaches result in theft are unknown. Often, neither law enforcement nor identity theft victims are aware that personal information had been compromised. The GAO's law enforcement sources also reported that stolen data may be held for years before fraudulent use, and then such use may continue for years thereafter.

Moreover, the GAO's report only covers a fraction of data breach incidents. From 2005-2006 alone, the news media identified more than 570 data breaches. Financial institutions have also reported several hundred breaches in the past two years, including the July 2007 revelation that the senior database administrator for a Fidelity National Information Services subsidiary stole and sold the personal information of 2.3 million customers. The GAO report likewise failed to emphasize that the 2005 ChoicePoint breach of more than 163,000 sensitive consumer records lead to at least 2,900 cases of identity theft. In that case, ChoicePoint learned of the data breach in September 2004 and contacted police, but did not inform the individuals whose data was leaked until February 2005. Choicepoint was ultimately fined $15 million for the incident.

GAO Report (pdf):

http://www.gao.gov/new.items/d07737.pdf

EPIC's Page on Identity Theft:

http://www.epic.org/privacy/idtheft/

EPIC's Page on ChoicePoint:

http://www.epic.org/privacy/choicepoint/

Senate Includes EPIC Recommendation in Caller ID Spoofing Bill

The Senate Commerce Committee amended the Truth in Caller ID Act of 2007, S.704, to include an intent requirement that would protect legitimate uses of caller ID spoofing. EPIC testified before the Committee on the bill last month, and the Committee followed EPIC's recommendation that any ban on caller ID spoofing contain an intent requirement, so that spoofing is only prohibited where a person “intends to defraud or cause harm.” Caller ID spoofing occurs when a caller conceals his or her phone number and causes another number to appear on the call recipient's caller identification system. An intent requirement protects legitimate uses of the technology, allowing callers to limit the disclosure of their phone numbers in order to protect their privacy and in some cases their safety. The bill now focuses on punishing harmful uses of caller ID spoofing, rather than the technology itself. The Committee has now reported the bill to the full Senate.

EPIC's Testimony before the Senate Commerce Committee on the Truth in Caller ID Act of 2007, S.704 (pdf):

http://www.epic.org/privacy/iei/s704test.pdf

The Truth in Caller ID Act of 2007, S.704:

http://thomas.loc.gov/cgi-bin/bdquery/z?d110:s.00704:

New Reports on Data Mining, Intelligence and Information Sharing

A recent Congressional Research Service (CRS) report examined the Department of Homeland Security's utilization of data mining techniques to identify potential terrorist activities. The report found that while data mining can be effective, it also has limited capabilities for two reasons. First, data mining cannot identify causal relationships, merely connections between variables. Second, although data mining reveals patterns, it does not show the significance of the pattern. The GAO report suggests that Congress may wish to consider data mining implementation and oversight issues in the future, because of the potential for mission creep, data inaccuracies, and privacy abuses.

The CRS report comes as both the FBI and the Department of Homeland Security released new reports on datamining that reveal increased secret profiling of American citizens with few privacy protections and unrelated to terrorism investigations. The FBI's System to Assess Risk assigns numeric ratings to individuals based on the FBI's assessed probability that the subject will commit a terrorist act.

CRS Report. "Data Mining and Homeland Security: An Overview" (pdf)

http://www.fas.org/sgp/crs/homesec/RL31798.pdf

Comment of Senator Patrick Leahy on Dept. of Justice Data Mining Report

http://leahy.senate.gov/press/200707/071007c.html

NY Plans Extensive Camera Surveillance

Recently, New York City Police officials announced the "Lower Manhattan Security Initiative," which would greatly enhance the surveillance of downtown streets. By the end of 2007, approximately 115 surveillance cameras will have begun monitoring traffic moving through parts of lower Manhattan. If the surveillance system, modeled after London's "ring of steel," becomes fully operational by the estimated year 2010, the number of cameras in the Manhattan area would expand to 3,000, and license plate scanners would be used to track drivers, and the program might use face recognition technology. The city estimates the new surveillance system would cost $90 million, $15 million of which would come from Homeland Security grants and $10 million from NYC. The city also is seeking to charge drivers a fee for entering lower Manhattan; the fees would go toward the surveillance project. EPIC has repeatedly explained that camera surveillance systems do not deter crime; in fact, no studies have shown that camera surveillance systems significantly reduce crime, though several have been conducted by police departments in the U.S. and U.K.

EPIC's Spotlight on Surveillance "D.C.'s Camera System Should Focus on Emergencies, Not Daily Life" (Dec. 2005):

http://www.epic.org/privacy/surveillance/spotlight/1105/

EPIC's Page on Video Surveillance:

http://www.epic.org/privacy/surveillance/

Survey Finds Information Requests Can Take Years

On July 2, the National Security Archive posted on its Web site the latest Knight Open Government Survey, entitled “40 Years of FOIA, 20 Years of Delay: Oldest Pending Freedom of Information Requests Date Back to the 1980s.” The survey once again highlighted the prolonged problem of undue delays and extensive backlogs accumulating under the FOIA request for information mechanism. The survey found FOIA requests in the federal government dating back to the 1980s. Five agencies have pending requests older then 15 years, and 10 agencies misreported their oldest pending FOIA requests to Congress in their Financial Year 2006 Annual FOIA Reports.

The National Security Archive, Knight Open Government Survey (pdf):

http://www.gwu.edu/~nsarchiv/NSAEBB/NSAEBB224/ten_oldest_report.pdf

EPIC's Page on Open Government:

http://www.epic.org/open_gov/

Computer Crimes and Digital Investigations by Ian Walden (Oxford, 2007)

http://www.powells.com/partner/24075/biblio/9780199290987

Walden's Computer Crimes and Digital Investigations is a comprehensive treatment of computers and the criminal justice system. The book surveys various ideas of "computer crime," relevant laws, the interaction between technology and criminal procedure, international developments regarding jurisdiction and harmonization, and the presentation of evidence at trial. Walden develops a taxonomy of computer crimes: crimes committed with the computer; crimes of content, such as pornography, or intellectual property offenses; and crimes against computer integrity such as unauthorized access, interception and data modification. Walden explains the substantive issue of each element of these crimes, including addressing major legislation in each.

The text is particularly useful for legal practitioners and well as law enforcement, security professionals and private investigators. The reader at each step will gain an understanding of the major principles and legal questions at play. The appendix includes the helpful Association of Chief of Police Officers Good Practice Guide for Computer based Electronic Evidence with lists of what should be seized, and some practical advice.

Walden, a professor of information and communications law at Queen Mary, University of London, has a generally UK-focus, with the occasional example from the US and other countries. Promising more, Walden concludes the book: "Computer crimes and digital investigations will comprise a substantial part of criminal policy, law and practice over the coming years, as information becomes the cornerstone to the global economy. To examine such developments and the evolving legal framework will surely require a second edition."

-- Guilherme Roschke

EPIC Publications:

"Information Privacy Law: Cases and Materials, Second Edition" Daniel J. Solove, Marc Rotenberg, and Paul Schwartz. (Aspen 2005). Price: $98.
http://www.epic.org/redirect/aspen_ipl_casebook.html

This clear, comprehensive introduction to the field of information privacy law allows instructors to enliven their teaching of fundamental concepts by addressing both enduring and emerging controversies. The Second Edition addresses numerous rapidly developing areas of privacy law, including: identity theft, government data mining and electronic surveillance law, the Foreign Intelligence Surveillance Act, intelligence sharing, RFID tags, GPS, spyware, web bugs, and more. Information Privacy Law, Second Edition, builds a cohesive foundation for an exciting course in this rapidly evolving area of law.

"Privacy & Human Rights 2005: An International Survey of Privacy Laws and Developments" (EPIC 2006). Price: $60.
http://www.epic.org/bookstore/phr2005/phr2005.html

This annual report by EPIC and Privacy International provides an overview of key privacy topics and reviews the state of privacy in over 70 countries around the world. The report outlines legal protections, new challenges, and important issues and events relating to privacy. Privacy & Human Rights 2005 is the most comprehensive report on privacy and data protection ever published.

"FOIA 2004: Litigation Under the Federal Open Government Laws," Harry Hammitt, David Sobel and Tiffany Stedman, editors (EPIC 2004). Price: $40.
http://www.epic.org/bookstore/foia2004

This is the standard reference work covering all aspects of the Freedom of Information Act, the Privacy Act, the Government in the Sunshine Act, and the Federal Advisory Committee Act. The 22nd edition fully updates the manual that lawyers, journalists and researchers have relied on for more than 25 years. For those who litigate open government cases (or need to learn how to litigate them), this is an essential reference manual.

"The Public Voice WSIS Sourcebook: Perspectives on the World Summit on the Information Society" (EPIC 2004). Price: $40.
http://www.epic.org/bookstore/pvsourcebook

This resource promotes a dialogue on the issues, the outcomes, and the process of the World Summit on the Information Society (WSIS). This reference guide provides the official UN documents, regional and issue-oriented perspectives, and recommendations and proposals for future action, as well as a useful list of resources and contacts for individuals and organizations that wish to become more involved in the WSIS process.

"The Privacy Law Sourcebook 2004: United States Law, International Law, and Recent Developments," Marc Rotenberg, editor (EPIC 2005). Price: $40.
http://www.epic.org/bookstore/pls2004/

The Privacy Law Sourcebook, which has been called the "Physician's Desk Reference" of the privacy world, is the leading resource for students, attorneys, researchers, and journalists interested in pursuing privacy law in the United States and around the world. It includes the full texts of major privacy laws and directives such as the Fair Credit Reporting Act, the Privacy Act, and the OECD Privacy Guidelines, as well as an up-to-date section on recent developments. New materials include the APEC Privacy Framework, the Video Voyeurism Prevention Act, and the CAN-SPAM Act.

"Filters and Freedom 2.0: Free Speech Perspectives on Internet Content Controls" (EPIC 2001). Price: $20.
http://www.epic.org/bookstore/filters2.0

A collection of essays, studies, and critiques of Internet content filtering. These papers are instrumental in explaining why filtering threatens free expression.

EPIC publications and other books on privacy, open government, free expression, crypto and governance can be ordered at:

EPIC Bookstore http://www.epic.org/bookstore

"EPIC Bookshelf" at Powell's Books
http://www.powells.com/features/epic/epic.html

EPIC also publishes EPIC FOIA Notes, which provides brief summaries of interesting documents obtained from government agencies under the Freedom of Information Act.

Subscribe to EPIC FOIA Notes at:
https://mailman.epic.org/cgi-bin/control/foia_notes

AEI-Brookings Joint Center: The Economics of Internet Advertising: Implications for the Google-DoubleClick Merger. July 18th, 2007. Washington DC. For more information:
http://www.aei.org/events/eventID.1539/event_detail.asp

Harvard University Privacy Symposium. August 21-24, 2007. Cambridge, MA. For more information http://www.privacysummersymposium.com

7th Annual Future of Music Policy Summit. September 17-18, 2007. Washington, DC. For more information
http://www.futureofmusic.org/events/summit07/

PIPA Conference: Private Sector Privacy in a Changing World. September 20-21, 2007. Vancouver, Canada. For more information:
http://www.verney.ca/pipa2007/

Civil Society Privacy Conference: Privacy Rights in a World Under Surveillance. September 25, 2007. Montreal, Canada. For more information:
http://www.thepublicvoice.org/events/montreal07/default.html

29th International Conference of Data Protection and Privacy Commissioners. September 25-28, 2007. Montreal, Canada. For more information:
http://www.privacyconference2007.gc.ca/Terra_Incognita_home_E.html

OECD and Industry Canada: Shaping Policies for Creativity, Confidence and Convergence in the Digital World. October 3, 2007. Ottawa, Canada. For more information:
http://www.oecd.org/futureinternet/participativeweb

University of Ottawa Faculty of Law: The Revealed "I". October 25-27, 2007. Ottawa, Canada. For more information:
http://www.idtrail.org/content/section/11/95/

Future of the Internet Economy - OECD Ministerial Meeting. June 14-18, 2008. Seoul, Korea. For more information:
http://www.oecd.org/document/19/0,2340,en_2649_37441_38051667 _1_1_1_37441,00.html

Subscribe/unsubscribe via web interface:

https://mailman.epic.org/cgi-bin/mailman/listinfo/epic_news

Back issues are available at:

http://www.epic.org/alert

The EPIC Alert displays best in a fixed-width font, such as Courier.

The EPIC Alert mailing list is used only to mail the EPIC Alert and to send notices about EPIC activities. We do not sell, rent or share our mailing list. We also intend to challenge any subpoena or other legal process seeking access to our mailing list. We do not enhance (link to other databases) our mailing list or require your actual name.

In the event you wish to subscribe or unsubscribe your e-mail address from this list, please follow the above instructions under "subscription information."

The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, see http://www.epic.org or write EPIC, 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. +1 202 483 1140 (tel), +1 202 483 1248 (fax).

If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "EPIC" and sent to 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. Or you can contribute online at:

http://www.epic.org/donate

Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and expanding wiretapping powers.

Thank you for your support.

.