Home | Databases | WorldLII | Search | Feedback EPIC Alert

EPIC Alert 15.25 [2008] EPICAlert 25

E P I C A l e r t

http://www.epic.org/alert/EPIC_Alert_15.25.html

"Defend Privacy. Support EPIC." http://epic.org/donate

Thirty members of the Privacy Coalition sent a letter to President-elect Barack Obama on the importance of protecting privacy in the next administration. The Privacy Coalition is a nonpartisan coalition of consumer, civil liberties, educational, family, library, labor, and technology organizations that have agreed to the Privacy Pledge. The coalition provides an opportunity for advocacy organizations to share resources and collaborate on issues of mutual interest.

The organizations joining the letter included the Electronic Privacy Information Center, American Association of Law Libraries, American- Arab Anti-Discrimination Committee, American Policy Center, Bill of Rights Defense Committee, Center for American Progress Action Fund, Consumer Federation of America, Consumers Union, Electronic Frontier Foundation, Government Accountability Project, Liberty Coalition, Privacy Rights Clearinghouse, and US Bill of Rights Foundation.

The letter called for: protection of sensitive information; the privacy of personal information obtained by the government, health information, and consumer privacy; strengthening of the Federal Trade Commission; limiting the use of Homeland Security Databases; and allowing states to continue to innovate to create legislative solutions.

The organizations outlined their support for the incoming president's expressed positions on privacy, consumer rights, and civil liberties. President-elect Obama stated support for strengthening privacy protections by harnessing the power of technology to hold government and businesses accountable for violations of personal privacy. The coalition said that "[t]here is a clear need to address the spiraling problems of identity theft, security breaches, and the commercialization of personal information."

The President-elect's transition process has named the heads of each of the major Federal government agencies. Barack Obama will be sworn in as the 44th President of the United States on January 20, 2009.

Letter from Privacy Coalition to the President-elect: http://www.privacycoalition.org/obama-ftc-ltr.pdf

Privacy Coalition: http://privacycoalition.org

Barack Obama "Change That We Can Believe In: Technology:" http://epic.org/redirect/122208_Obama_TechStatement_0222.html

Privacy Coalition Members: http://privacycoalition.org/about.php

Privacy Coalition Pledge: http://privacycoalition.org/pledge.php

With the slogan "Internet for all," the third annual meeting of the Internet Governance Forum took place in Hyderabad, India on December 3-6, 2008. The IGF is a multi-stakeholder forum for policy dialogue on issues of Internet governance. The United Nations Secretary General established the IGF in July 2006 and since then three annual forums have been organized.

The third IGF, which was held in the aftermath of terrorist attacks in Mumbai, brought together governments, the private sector, civil society, and the academic and technical communities to debate Internet governance and related public policy issues, exchange information, and to share good practices. In all, close to 1,300 participants from 94 countries attended the meeting, which was webcast with video and audio streaming. The proceedings of the main sessions were transcribed and displayed in the main session hall in real time and streamed to the Web. Remote hubs held parallel meetings in Argentina, Brazil, India, Pakistan, Columbia, Serbia and Spain.

Ms. Marilia Maciel, Remote Participation Working Group coordinator stated:

"These hubs are local meetings which exhibit the Webcast of the IGF and also interact with people in the event, sending text as well as video questions....Participants of the Remote hub used it as a starting point to create a local committee to discuss [Information and Communication Technology] related issues."

The international meeting focused on 5 main sessions which were organized in 3 thematic days under the headings: "Reaching the Next Billion;" "Promoting Cyber-Security and Trust;" and "Managing Critical Internet Resources." The last day covered "Emerging Issues - the Internet of Tomorrow" and "Taking Stock and the Way Forward." Parallel to the main sessions, 87 self-organized workshops were held, including meetings of the IGF dynamic coalitions, best practices and open forums.

The Government of India hosted the meeting, which was chaired by Mr. Thiru Andimuthu Raja, India's Union Cabinet Minister for Communications and Information Technology. Opening addresses were made by Mr. Jomo Kwame Sundaram on behalf of the Secretary General of the United Nations, Mr. Nitin Desai, special advisor to the Secretary General for Internet Governance and chairman of the multistakeholder Advisory Group, Mr. Damodar Reddy, Minister for Information Technology, Government of Andhra Pradesh, and Minister Andimuthu Raja.

UN representative Mr. Sundaram stated during the Opening Session: "The IGF is not a new organization or agency, and rather than being a decision-making body, the IGF is a space, a platform, for frank and enlightened debate. The forum provides a unique opportunity for all stakeholders to foster innovative dialogue under the auspices of the United Nations. The forum shapes and informs the decision-making processes of other institutions and governments and prepares the ground for negotiations that will take place in intergovernmental as well as other forums."

Mr. Sundaram further emphasized: "The forum is a place to launch ideas, trial balloons, perhaps that can serve as the basis of broader agreement on concrete ways and means to shape and govern the Internet."

In the summary of the conference, Chairman Andimuthu Raja noted: "The role of the IGF in building an Internet society was inclusive, human centered and geared to development." Mr. Raja also indicated that "[a]ccess to information by the people helped democracy by having transparency in the functioning of the government and enhanced the participation of the people in the governing process. Without appropriate information, people could not adequately exercise their rights as citizens."

The summary of the conference also highlighted: "Speakers noted that the IGF provided the opportunity for a dialogue between all stakeholders and a mutual exchange of ideas. It fostered the building of partnerships and relationships that otherwise might not occur. The IGF was appreciated for its open multi-stakeholder model, with examples of new national and regional IGF initiatives illustrating the spread of the multi-stakeholder ideal and its value in policy discussion."

In 2010, the United Nations General Assembly will decide if it should extend the IGF's initial five-year mandate, based on a review of its work as well as its achievements. The next IGF meetings will be held in Cairo, Egypt, on November 15-18, 2009 and in Vilnius, Lithuania in 2010.

Internet Governance Forum: http://www.intgovforum.org/

IGF Chairman's Summary (pdf): http://epic.org/redirect/122208_IGF_Chairman.html

The Public Voice: http://www.thepublicvoice.org

Remote Participation: http://www.intgovforum.org/cms/index.php/remoteparticipation

The Department of Education issued its Final Rules under a federal statute that protects the privacy of student education records. The law applies to all schools that receive federal funds. The new rules which come into effect on January 8, 2009, have been formulated because educational agencies and institutions face considerable challenges, especially with regard to maintaining safe campuses, protecting personally identifiable information in students' education records and responding to requests for data on student progress.

The new rules under the Family Educational Rights and Privacy Act include amendments needed to implement provisions of other federal laws, as well as two Supreme Court decisions. The new rules are consistent with the USA Patriot Act, which added new exceptions permitting the disclosure of personally identifiable information from education records without consent. The changes: 1) clarify permissible disclosures to parents of eligible students; 2) clarify conditions that apply to disclosures in health and safety emergencies; 3) clarify permissible disclosures of student identifiers as directory information; 4) and allow disclosures to contractors and other outside parties in connection with the outsourcing of institutional functions and services.

The amendments also revise certain key definitions of terms. The rule modifies "attendance" to include "other electronic information and telecommunications technologies" that do not require classroom presence. The rules also note that there is no statutory authority under the federal law to prohibit an educational institution from using a student's social security number as a student ID number. The definition of "disclosure" now excludes the return of a document to its source and clarifies that information maintained in a consolidated student records system may be provided back to the original institution without consent. The new rules clarify that "education records" does not include information created or received on a former student as long as it is not directly related to a students' attendance. Noting that removal of the name and SSN (or other ID number), does not necessarily prevent the release of personally identifiable information, the amendments also delete the "easily traceable" standard as it lacked "specificity and clarity." Additionally, biometric records have also been included within the definition of "personally identifiable information."

The final report of the Review Panel of the mass shootings at Virginia Tech cited misinterpretations of information privacy laws as the reason why action was not taken regarding the shooter's mental health history. The amendments clarified that institutions are permitted to disclose personally identifiable information from students' education records, without consent, "to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals."

The amendments implement a provision of the USA Patriot Act allowing the Attorney General to apply for a court order to collect, retain, disseminate, and use certain education records in the possession of an educational agency or institution without regard to any other statutory requirement.

The rules widen the meaning of "education record" to include even records with all names and Social Security Numbers redacted if the institutions believe that the records could be used to identify a student. The Department of Education stated it would not recognize an exception to confidentiality even if the person to whom the document related has voluntarily revealed her own identity to the media, because the "general public interest does not give an educational agency or institution permission to release the same or related information from education records without consent."

Education Records Privacy Final Rules - Federal Register, Vol. 73, No. 237, December 9, 2008: http://edocket.access.gpo.gov/2008/pdf/E8-28864.pdf

Family Educational Rights and Privacy Act (FERPA), U.S. Department of Education: http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html

EPIC's page on FERPA: http://epic.org/privacy/education/ferpa.html

EPIC's page on Privacy of Education Records: http://epic.org/privacy/education/school.html

EPIC's Student Privacy Page: http://epic.org/privacy/student/

On December 2, 2008, the third meeting of the Internet Governance Forum, held in Hyderabad, India, focused its discussions on the theme of "Promoting Cyber-Security and Trust."

The topic was covered in two panel discussions, one on the "Dimensions of Cybersecurity and Cyber-crime," and the second on "Fostering Security, Privacy and Openness." An open dialogue followed these panels. In parallel, many events on this topic were organized: 14 dedicated to Openness, 8 to Security, 1 to best practices and 1 to Emerging Topics on the Future of Online Privacy. The events provided an opportunity for IGF participants to discuss ideas and share experiences.

The first main session on the "Dimensions of Cyber-Security and Cyber-crime" was chaired by Mr. Rentala Chandershekhar, Special Secretary of the Department of Information Technology in the Indian Ministry of Communications & Information Technology, and moderated by Mr. Bertrand de la Chapelle, Special Envoy for Information Society of the French Foreign Ministry. The main points of the discussion regarded cybercrime and the problems concerning jurisdiction and geographical boundaries that law enforcement agencies face because of the borderless nature of the Internet. The session also addressed the need to intensify efforts to combat cybercrime. However, the discussions did not address any public accountability measures to oversee the legality and limit the use of the surveillance in communications. There was no mention of the wiretapping abuses that have been revealed around the world, sometimes involving thousands of illegal wiretaps, as noted by many participants at the Latin American Regional Preparatory Meeting of the IGF. Furthermore, no emphasis was recorded regarding the need of the States and countries that signed the Cybercrime Treaty of the Council of Europe to also sign the "Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data" in order to enhance privacy while fighting cybercrime as suggested by civil society participants at some IGF parallel privacy workshops.

The second session, "Fostering Security, Privacy and Openness," was chaired by Mr. Shyamai Ghosh, Chairman of the Data Security Council of India (DSCI) and moderated by Ambassador David A. Gross, Coordinator for International Communications and Information Policy in the United States Department of State.

Chairman Raja noted in the summary of the conference:

"The increased awareness of the importance of data protection was mentioned as regards not only the protection of the private sphere of individuals, but their very freedom. Internal and international security requirements and market interests could lead to the erosion of fundamental safeguards of privacy and freedom. It was discussed how data that were collected for one specific purpose were often made available for other purposes and made available to bodies, both public and private, that were not intended recipients of these data."

Chairman Raja also acknowledged the comments of the moderator regarding the role of online anonymity:

"The moderator mentioned an issue that was alluded to, but not discussed in this session, that is, the role of anonymity on the Internet and its relation to privacy, especially in spheres such as medical information." In concluding, Chairman Raja acknowledged the challenge in converting the areas of tension or conflict into areas of convergence, so that both the issues of security and privacy could be addressed in the proper perspective.

Internet Governance Forum: http://www.intgovforum.org/

IGF Chairman's Summary (pdf): http://epic.org/redirect/122208_IGF_Chairman.html

IGF "Promoting Cyber-Security and Trust" transcripts: http://www.intgovforum.org/cms/index.php/hyderabadprogramme

Latin American and The Caribbean Regional Preparatory Meeting of the IGF http://www.lacnic.net/en/eventos/mvd2008/igf.html

Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data: http://conventions.coe.int/Treaty/en/Treaties/Html/108.htm

The Department of Homeland Security has released the Privacy Impact Assessment for the State, Local, and Regional Fusion Center Initiative. The assessment, which is the first of two reports by the agency, examines the privacy implications of the State, Local and Regional Fusion Centers and the DHS' State and Local Program Management Office. Fusion Centers are intelligence databases that collect information on ordinary citizens.

The DHS' Privacy Office identified a number of privacy risks presented by the fusion center program. These include ambiguous lines of authority, rules, and oversight; participation of the military and the private sector; data mining; excessive secrecy; inaccurate and incomplete information; and mission creep. The assessment reports that no "two fusion centers define or carry out their missions in exactly the same way or are subject to the same authorities or regulations." It also asserts that notions of comity and federalism prohibit the DHS from placing certain requirements on fusion centers.

The assessment asserts that a number of steps have been taken to embed privacy into the management of fusion center programs and encourage the fusion centers to consider privacy in their practices. For example, the DHS disseminated the Global Justice Information Sharing Initiative Guidelines. The report states that the Criminal Intelligence Systems Operating Policies, which includes privacy requirements for federally funded criminal intelligence systems at use in the states, served as the foundation for many of the recommendations related to privacy. These policies recommend mechanisms that centers can develop to assist them in adhering to their privacy policies. Such mechanisms include: establishing a privacy oversight committee or appointing a privacy officer; developing or updating privacy training and orientation for all employees; taking steps to promote ongoing information privacy awareness; developing a process for tracking and handling privacy complaints or concerns; developing a consistent sanction policy for failure to comply with the privacy policy for all individuals in the organization; recognizing the overlap in privacy activities and security activities; and ensuring that all personnel are adequately trained in the privacy policy compliance.

The Privacy Office recommends that fusion centers: undertake "regular and aggressive public accounting of fusion center activities"; perform regular privacy audits; acknowledge errors and take corrective action; implement the Program Manager of the Information Sharing Environment's guidance regarding error correction. The report also clarifies that DHS analysts may not share and collect information that does not have a nexus to DHS' mission and intelligence and analysis responsibilities. The Privacy Office acknowledged that the assessment is incomplete – it does not cover all conceivable issues raised by either the involvement of the Justice Department or all practices of the states who manage and operate various fusion centers.

In May, EPIC prevailed in its freedom of information request to disclose documents describing the federal government's involvement in efforts to limit Virginia's transparency and privacy laws and uncovered a secret contract between the State Police and the FBI that limits the rights of Virginia citizens to learn what information the State Police collect about them.

Privacy Impact Assessment, Department of Homeland Security, State, Local, and Regional Fusion Center Initiative: http://epic.org/redirect/122208_PIA_Fusion_dhs.html

EPIC's page on Information Fusion Centers and Privacy: http://epic.org/privacy/fusion/

State and Local Fusion Centers: http://www.dhs.gov/xinfoshare/programs/gc_1156877184684.shtm

Fusion Center Guidelines: Developing and Sharing Information in a New Era (Global Guidelines): http://it.ojp.gov/documents/fusion_center_guidelines.pdf

EPIC v. Virginia Department of State Police: http://epic.org/privacy/virginia_fusion/

Health Department Encourages Use of Patient Information to Improve Care

The U.S. Department of Health & Human Services announced privacy principles and a toolkit to guide efforts to harness the potential of new technology and more effective data analysis, while protecting privacy. Secretary Michael Leavitt stated that consumers should not be forced to accept privacy risks. Secretary Leavitt articulated several principles like individual access; correction; openness and transparency; individual choice; collection, use, and disclosure limitation; data integrity; safeguards and accountability. Also announced were several tools intended to help consumers and health information exchanges improve toward privacy protection and consumer access to their information.

U.S. Department of Health & Human Services, News Release, December 15, 2008: http://www.hhs.gov/news/press/2008pres/12/20081215a.html

EPIC's page on Medical Privacy: http://epic.org/privacy/medical/

Change in Yahoo Search Retention Leaves Privacy Questions Unresolved

Yahoo announced that, after 90 days, it will obscure some elements in the records that it keeps about all Internet users who use the company's services. The search company will continue to keep modified record locators, time/date stamps, web pages viewed, and a persistent user identifier, known as a "cookie," for an indefinite period. Yahoo is also retaining much of the IP address. Privacy rules classify IP addresses as "personal data" and the partial deletion of IP addresses does not provably anonymize user records. In September, Google also announced the partial anonymization of users’ IP addresses. However, experts have criticized the partial deletion of IP address data as insufficient to protect consumers, and it is possible to use a database containing user search data to sort by time and location, to locate and identify the source of search queries, and to build individual profiles.

Yahoo! Sets New Industry Privacy Standard with Data Retention Policy: http://biz.yahoo.com/bw/081217/20081217005332.html

EPIC's page on Search Engine Privacy: http://epic.org/privacy/search_engine/

Survey Reflects Continued Importance of Privacy

A Ponemon Institute survey announced the results of the Ponemon Institute's fifth annual survey of Most Trusted Companies for Privacy. Around 73 percent of consumers felt that protection of personal privacy was "important" or "very important." The survey also found consumers losing faith in the ability to exercise control over their personal information. While 62 percent of consumers believed identity theft affected their notion in trusting a company, 53 percent thought data breach notifications affected their perception in a company's privacy.

Ponemon Institute and TRUSTe Announce Results of Annual Most Trusted Companies for Privacy Survey: http://truste.org/about/press_release/12_15_08.php

EPIC's page Privacy and Consumer Profiling: http://epic.org/privacy/profiling/

Massachusetts Holds Hearing on Data Security Rules

In November, the Commonwealth of Massachusetts became the first state in the United States to enact comprehensive data privacy and security standards and regulations. The rules will go into effect on May 1, 2009, consistent with rules of the Federal Trade Commission that require financial institutions and creditors to develop and create ID theft prevention programs. The Massachusetts Office of Consumer Affairs and Business Regulation announced that it will hold a public hearing on January 16, 2009 to allow interested parties an opportunity to provide receive oral and written testimony regarding the "Standards for The Protection of Personal Information of Residents of the Commonwealth."

Notice of Public Hearing, Office of Consumer Affairs and Business Regulation, Commonwealth of Massachusetts: http://epic.org/redirect/122208_Notice_OCABR_Mass.html

"Standards for The Protection of Personal Information of Residents of the Commonwealth" (201 CMR 17.00): http://epic.org/redirect/122208_OCABR_210cmr1700.html

201 CMR 17.00 Compliance Checklist: http://www.mass.gov/Eoca/docs/idtheft/compliance_checklist.pdf

FAQs regarding 201 CMR 17.00: http://epic.org/redirect/112008_FAQ_201CMR1700.html

EPIC's page on Privacy Preemption Watch: http://epic.org/privacy/preemption/

Federal Court Denies DHS Lifting Ban on SSN No-Match Letters

In October 2008, DHS finalized a rule providing a "safe harbor" from liability to employers who follow certain procedures when they receive a letter from the Social Security Administration stating that the SSN of their employee did not match with the SSA database. Failure to correct discrepancies results in liability under US Immigration laws. However, due to the cumbersome process involved in correcting errors, employers may instead choose to fire workers including citizens and non-citizens. Earlier, a federal court had granted a preliminary injunction in implementing such a rule. Now, the same court declined to vacate the injunction on the federal agency's SSN No-Match Rule. EPIC has detailed substantial errors in government databases. The DHS has also been sponsoring advertisements in the media for the E-Verify program, which is supposed to determine employee work eligibility. Government investigators have highlighted errors in the databases used by E-Verify and detailed the many problems associated with the program.

Department of Homeland Security, Safe Harbor Procedures for Employers, October 28: http://edocket.access.gpo.gov/2008/pdf/E8-25544.pdf

EPIC: Spotlight on Surveillance, E-Verify System: DHS Changes Name, But Problems Remain for U.S. Workers: http://epic.org/privacy/surveillance/spotlight/0707/default.html

Canadian Privacy Commissioner Issues Report to Parliament

The Canadian Privacy Commissioner issued the Annual Report to the Parliament. The report for the year 2007-2008 on the Privacy Act, lists key accomplishments for the year, which included proactively supporting the Parliament, addressing public needs through inquiries, investigations, campaigns and litigations. The Office of the Commissioner also worked with international organizations and groups and encouraged research and debate. However, the report also cites significant concern regarding the posting of Canadian's highly sensitive personal information to the web by the government's passport operations and federal administrative tribunals. The report recommended providing all employees who handle personal information with privacy training.

Annual Report to Parliament 2007-2008, Office of the Privacy Commissioner of Canada: http://www.privcom.gc.ca/information/ar/200708/200708_pa_e.asp

EPIC's Online Guide to Privacy Resources: http://epic.org/privacy/privacy_resources_faq.html

European Researchers Issue Report on Web 2.0 Vulnerabilities

The European Network and Information Security Agency released a position paper on Web 2.0 Security and Privacy. The report underscores the inadequacy of access and authorization frameworks in the Web 2.0 model and in policy frameworks governing the separation of control between web applications. Excessive privileges and weak authentication are other risks identified in this area. The report also highlights knowledge and information management problems like misinformation dissemination and establishing trustworthiness of collaborative knowledge systems. The paper recommends policy incentives for secure development practices and encourage public and intergovernmental discussion.

ENISA Report on Web 2.0 Security and Privacy: http://www.enisa.europa.eu/doc/pdf/deliverables/enisa_pp_web2.pdf

ENISA Report Survey Results: http://www.enisa.europa.eu/doc/pdf

"The Privacy Advocates: Resisting the Spread of Surveillance" by Colin J. Bennett, (MIT Press 2008)

http://www.powells.com/biblio/62-9780262026383-1?&PID=24075

Consider the phrase "the privacy movement." It is almost an oxymoron. How could people, committed to the "right to be left alone," join together to create any type of political force? One might as easily imagine "anarchist governance" or the "libertarian bureaucracy."

And yet a privacy movement has emerged, with growing influence, widening impact, and far-reaching political consequence. What is most remarkable is the presence of privacy campaigns in so many places on so many issues. In South Korea, teachers object to the creation of a new student database and organize a protest. In Germany, activists take to the streets to object to an obscure government regulation that requires telephone companies to keep data on their customers. Japanese officials resign rather than to implement a nationwide identity system. In Peru, opposition is launched to surveillance cameras. And French activists recently brought an end to a massive new government database.

As Bob Dylan once wrote, "something is happening here" that is amazing, remarkable, often heartening, and not well understood. To be sure, the movement has almost everything going against it. To begin with, the issues are complex and the technology rapidly changing. The twin dynamics of the post 9/11 security economy coupled with the "Internet must not be regulated" mantra have created a surveillance tsunami. Privacy groups must do their homework and then anticipate that, on any matter of consequence, there will be well-paid experts on the other side to prove that the world is flat, that two and two equals five, and that the massive aggregation of search histories is not a ticking privacy time bomb.

There is also the fundamental problem that privacy claims are almost always viewed as a "worry" or a "concern," a failure to understand the wonders of new technology, the imposition of a paternalistic moral code, or perhaps (according to those who repeat this gibberish) a combination of all of the above. The legacy of Orwell's 1984 – fatalism and determinism – has also not served the movement well. As you recall, there was no happy ending in 1984.

Thus, the first challenge for the privacy advocate is to translate a concern into a genuine political debate, to create a space where people are empowered to make decisions about such topics as identity cards, surveillance cameras, technical standards, and business practices. It is in this space that the opportunity for political change arises. Privacy advocates have to work harder than advocates in other fields because the public simply assumes the benefits (or necessity), as well as the inevitability, of new technology.

Still, these efforts often succeed. Just ask John Poindexter, the architect of Total Information Awareness, who watched his proposal for an all-seeing government surveillance plan collapse under a wave of public criticism. (Of course, he did receive a Big Brother Award from Privacy International for his efforts). When a privacy concern is understood as a policy choice, the public becomes engaged, and bad ideas can be defeated. This happens more often than most people would suspect. It is also one of the reasons that major players in the privacy world – the government agencies, the private companies – seek out the opinions of privacy experts before the big announcements.

Privacy advocates must also contend with the absence of a decent business model. Unlike the public interest organizations that emerged in the late twentieth century with their monthly newsletters, large membership lists, foundation grants, and annual dues, the privacy groups in the current era are often little more than a web site, a few dedicated individuals, and a PayPal button. Surprising outcomes can still be obtained, but glory and news clips do not pay the bills.

Which raises the thorny question of the relationship between privacy advocates and the organizations that they are often expected to oversee. For some in the privacy community, this presents a genuine moral quandary, as most conflicts of interest do. For others, it has become a nearly perfected business model, an opportunity to bless controversial projects, isolate critics, and make the policy case to the public that the sponsors never could. The companies see the business case as well. Much better to provide a fellowship or a sponsorship to a non-profit than to risk a critical news story or an actual lawsuit.

One company's notable achievement is not simply to obtain the silence of consumer groups that might otherwise raise privacy objections to the search firm's business practices, but to enlist these same organization's active support in *privacy campaigns* against its business competitors, which is as remarkable as it is ironic.

Some government officials, privacy agencies and individual donors, who recognize this problem, are providing the funding and support to research institutions and advocacy organizations that allows real inquiry and meaningful policy solutions to be pursued, without the heavy hand of a private sponsor steering toward a predetermined conclusion.

But there are other concerns in the privacy movement as well. There is in the Anglo countries the nagging problem that few privacy groups have addressed the issue of diversity in any meaningful way. The problem is not unique to privacy organizations; there is still "movement essentialism," left over from the past generation of activists that limits the ability of people of color from articulating claims of common concern. But this may be changing also, as the recent Presidential election in the United States suggests.

Still, the progress is real and the impact beyond dispute. Privacy campaigns of this era reflect both the opportunities and challenges of this new age. To look at the privacy movement today and imagine that it would be similar to social movements of the past is a mistake. Political organizations have been transformed by technology. They are global, dynamic, and fluid. There is little time for formal organization and even less incentive. A campaign may attract a nation's attention over a few weeks, produce a favorable outcome, and then dissolve.

And still, with surprising frequency, those who believe in privacy, a fundamental human right, join forces, work together, and transform the politics of the modern age.

-- Marc Rotenberg

"Litigation Under the Federal Open Government Laws 2008," edited by Harry A. Hammitt, Marc Rotenberg, John A. Verdi, and Mark S. Zaid (EPIC 2008). Price: $60.

http://epic.org/bookstore/foia2008/

Litigation Under the Federal Open Government Laws is the most comprehensive, authoritative discussion of the federal open access laws. This updated version includes new material regarding the substantial FOIA amendments enacted on December 31, 2007. Many of the recent amendments are effective as of December 31, 2008. The standard reference work includes in-depth analysis of litigation under Freedom of Information Act, Privacy Act, Federal Advisory Committee Act, Government in the Sunshine Act. The fully updated 2008 volume is the 24th edition of the manual that lawyers, journalists and researchers have relied on for more than 25 years.

"Information Privacy Law: Cases and Materials, Second Edition" Daniel J. Solove, Marc Rotenberg, and Paul Schwartz. (Aspen 2005). Price: $98.

http://www.epic.org/redirect/aspen_ipl_casebook.html

This clear, comprehensive introduction to the field of information privacy law allows instructors to enliven their teaching of fundamental concepts by addressing both enduring and emerging controversies. The Second Edition addresses numerous rapidly developing areas of privacy law, including: identity theft, government data mining and electronic surveillance law, the Foreign Intelligence Surveillance Act, intelligence sharing, RFID tags, GPS, spyware, web bugs, and more. Information Privacy Law, Second Edition, builds a cohesive foundation for an exciting course in this rapidly evolving area of law.

"Privacy & Human Rights 2006: An International Survey of Privacy Laws and Developments" (EPIC 2007). Price: $75.
http://www.epic.org/phr06/

This annual report by EPIC and Privacy International provides an overview of key privacy topics and reviews the state of privacy in over 75 countries around the world. The report outlines legal protections, new challenges, and important issues and events relating to privacy. Privacy & Human Rights 2006 is the most comprehensive report on privacy and data protection ever published.

"The Public Voice WSIS Sourcebook: Perspectives on the World Summit on the Information Society" (EPIC 2004). Price: $40.

http://www.epic.org/bookstore/pvsourcebook

This resource promotes a dialogue on the issues, the outcomes, and the process of the World Summit on the Information Society (WSIS). This reference guide provides the official UN documents, regional and issue-oriented perspectives, and recommendations and proposals for future action, as well as a useful list of resources and contacts for individuals and organizations that wish to become more involved in the WSIS process.

"The Privacy Law Sourcebook 2004: United States Law, International Law, and Recent Developments," Marc Rotenberg, editor (EPIC 2005). Price: $40.

http://www.epic.org/bookstore/pls2004/

The Privacy Law Sourcebook, which has been called the "Physician's Desk Reference" of the privacy world, is the leading resource for students, attorneys, researchers, and journalists interested in pursuing privacy law in the United States and around the world. It includes the full texts of major privacy laws and directives such as the Fair Credit Reporting Act, the Privacy Act, and the OECD Privacy Guidelines, as well as an up-to-date section on recent developments. New materials include the APEC Privacy Framework, the Video Voyeurism Prevention Act, and the CAN-SPAM Act.

"Filters and Freedom 2.0: Free Speech Perspectives on Internet Content Controls" (EPIC 2001). Price: $20.

http://www.epic.org/bookstore/filters2.0

A collection of essays, studies, and critiques of Internet content filtering. These papers are instrumental in explaining why filtering threatens free expression.

EPIC publications and other books on privacy, open government, free expression, crypto and governance can be ordered at:

EPIC Bookstore
http://www.epic.org/bookstore

"EPIC Bookshelf" at Powell's Books
http://www.powells.com/bookshelf/epicorg.html

EPIC also publishes EPIC FOIA Notes, which provides brief summaries of interesting documents obtained from government agencies under the Freedom of Information Act.

Subscribe to EPIC FOIA Notes at: https:/mailman.epic.org/mailman/listinfo/foia_notes

The Privacy by Design Challenge - nine privacy leaders from major corporations present their latest innovations in Privacy-Enhancing Technologies. Toronto, Canada, January 28, 2009. For more information, http://www.privacybydesign.ca/registration.htm

The American Conference Institute is hosting the 8th National Symposium on Privacy and Security of Consumer and Employee Information at the Four Points by Sheraton, Washington, D.C., January 27-28, 2009, Washington, DC. http://www.americanconference.com/Privacy.htm

"Patents, Copyrights and Knowledge Governance: The Next Four Years," Trans Atlantic Consumer Dialogue (TACD) Workshop held by the TACD Working Group on Intellectual Property, Washington, D.C., January 12-13, 2009. For more information,
http://www.tacd-ip.org/blog/?page_id=5

The IAPP Privacy Summit 2009 will be held between March 11-13, 2009, at Washington, D.C. For more information, http://www.privacysummit.org

"Conference on International Aspects of Securing Personal Data," The Federal Trade Commission, Washington, D.C., March 16-17, 2009: For more information, http://ftc.gov/opa/2008/12/datasec.shtm

Computers, Freedom, and Privacy, 19th Annual Conference, Washington, D.C., June 1-4, 2009. For more information,
http://www.cfp2009.org/wiki/index.php/Main_Page

"The Transformation of Privacy Policy," Institutions, Markets Technology Institute for Advanced Studies (IMT)Lucca, Italy, July 2-4, 2009.

Subscribe/unsubscribe via web interface: https://mailman.epic.org/mailman/listinfo/epic_news

Back issues are available at:
http://www.epic.org/alert

The EPIC Alert displays best in a fixed-width font, such as Courier.

The EPIC Alert mailing list is used only to mail the EPIC Alert and to send notices about EPIC activities. We do not sell, rent or share our mailing list. We also intend to challenge any subpoena or other legal process seeking access to our mailing list. We do not enhance (link to other databases) our mailing list or require your actual name.

In the event you wish to subscribe or unsubscribe your e-mail address from this list, please follow the above instructions under "subscription information."

The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, see http://www.epic.org or write EPIC, 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. +1 202 483 1140 (tel), +1 202 483 1248 (fax).

If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "EPIC" and sent to 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. Or you can contribute online at:

http://www.epic.org/donate

Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and expanding wiretapping powers.

Thank you for your support.

If you would like more information on Privacy '08, go online and search for "Privacy 08." You'll find a Privacy08 Cause at Facebook, Privacy08 at Twitter, a Privacy08 Channel on YouTube to come soon, and much more. You can also order caps and t-shirts at CafePress Privacy08.

Start a discussion. Hold a meeting. Be creative. Spread the word. You can donate online at epic.org. Support the campaign.

Facebook Cause:
http://www.epic.org/redirect/fbprivacy08.html

Twitter:
http://twitter.com/privacy08

CafePress:
http://www.cafepress.com/epicorg

EPIC is seeking a smart, energetic, creative individual
for the position of Staff Counsel
Deadline: Jan. 1, 2009
Click here for more details http://www.epic.org/epic/jobs/counsel_1108.html

.