Home | Databases | WorldLII | Search | Feedback EPIC Alert

EPIC Alert 16.12 [2009] EPICAlert 12

E P I C A l e r t

http://www.epic.org/alert/EPIC_Alert_16.12.html

"Defend Privacy. Support EPIC." http://epic.org/facebook

On June 17, 2009, EPIC President Marc Rotenberg testified before the House Subcommittee on Information Policy, Census and National Archives on "Identity Theft: Victims Bills of Rights." In his testimony, Mr. Rotenberg outlined the elements of a more comprehensive strategy to address the escalating problem of identity theft.

The problem of identity theft in the United States is substantial, growing and evolving, and according to the FTC, identity theft is the number one concern of American consumers. "Several steps have been taken to assist the victims of identity theft and to prosecute criminals. But in our opinion, none of there efforts get to the root causes of the problem," said Marc Rotenberg. EPIC's testimony also pointed out that the loss of control over the credentials that allow financial transactions and receive medical care poses a different problem than the hazards associated with traditional theft. Identity theft is both a crime by itself and also facilitates further crime.

Among other concerns, EPIC also highlighted the problem of medical identity theft. Mr. Rotenberg stated "[i]t is particularly important to implement safeguards against medical identity theft because the damage arising from the crime is severe, and recent efforts to digitize all medical records exposes increasing numbers of Americans to risk." The Recovery Act provides for the expenditure of substantial federal funds to enhance the infrastructure for electronic health records. Identity thieves continue to succeed through phishing, pretexting, and spyware. The lack of attention by consumers not having the knowledge of the true dangers that may be present contributes to the situation.

The EPIC testimony made specific recommendations regarding Government's need to consider privacy protections in the development of Web 2.0 services and in the outsourcing of government services. EPIC has made specific recommendations to the Department of Homeland Security and to the Office of Science and Technology Policy to address some of these challenges. Another concern is the need to have enforceable privacy rights that bind all private contractors that obtain personal information from the federal government. EPIC recommended regular audits to determine compliance with legal standards.

Mr. Rotenberg also supported the necessity of enacting a comprehensive privacy legislation. Identity theft continues to escalate because it is too easy for companies to collect personal information and too difficult for individuals to safeguard their information once it is in someone's else possession. To reduce the risk of identity theft, EPIC recommended (1) adoption of privacy legislation that places greater responsibilities on companies that collect and use personal information, (2) data breach notifications, and (3) providing consumers an opportunity to seek damages when companies failed to safeguard the information they collected.

Mr. Rotenberg also advised the protection of personal information through the cybersecurity policy and warned that the use of techniques which enable monitoring by third parties expose data that could be obtained and used for improper purposes. EPIC said that one of the key goals for the federal government over the next several years should be the development of an identity management system that is scalable, robust and secure.

Other witnesses at the hearing were from Federal Trade Commission, the Justice Department, Government Accountability Office, The Santa Fe Group, Center for Identity Management and Information Protection, Identity Theft Assistance Corporation, and the Identity Theft Resource Center.

EPIC's Testimony: http://epic.org/privacy/idtheft/epic_idtheft_rotenberg_6-09.pdf

Hearing Webcast: http://epic.org/redirect/062209_IDTheftHearingCast.html

"Identity Theft: Victims Bills of Rights:" http://informationpolicy.oversight.house.gov/story.asp?ID=2487

House Oversight Committee: http://informationpolicy.oversight.house.gov/

EPIC's comments to DHS on Use of Social Media: http://epic.org/privacy/socialnet/dhs_socialnetworking-6-09.pdf

EPIC's Page on Identity Theft: http://epic.org/privacy/idtheft

EPIC's celebrated its 15th anniversary at The Fairfax on Embassy Row, Washington, D.C. on June 9, 2009. On the occasion of the anniversary dinner, EPIC awarded the 2009 Champion of Freedom Awards to Congressman Edward Markey, Supreme Court litigator Paul M. Smith and Hollywood director and producer D.J. Caruso. Slate Supreme Court correspondent Dahlia Lithwick emceed the event.

Congressman Markey is a leading champion of privacy protections for all Americans. A key leader on providing privacy protections for personal information such as medical records, financial records, and purchases on-line, Chairman Markey is the third-longest serving member of Congress from New England. As chairman of the House Telecommunications and the Internet Subcommittee, Rep. Markey has led efforts to protect consumer privacy relating to wireless location information and the use of cable, telephone, and satellite services. Congressman Markey has also recently worked on the need to ensure encryption and security obligations for online medical records information.

Paul Smith, a partner with Jenner & Block, has argued groundbreaking cases before the Supreme Court. He appeared in Crawford v. Marion County Election Board (2008), the Indiana Voter ID case; Lawrence v. Texas (2003), involving the constitutionality of the Texas sodomy statute; and United States v. American Library Ass'n (2003), involving a First Amendment challenge to the Children's Internet Protection Act.

Daniel John "D.J." Caruso is an American director and producer. He has directed films such as Disturbia, Two for the Money, Taking Lives, The Salton Sea, and Eagle Eye. Produced by Steven Spielberg, Eagle Eye explores the role of identification, automation, and surveillance in Washington, D.C. But beneath the fast-paced, action packed plot are looming questions about the future of technology and the importance of government accountability.

Dahlia Lithwick, Senior Legal Correspondent of Slate, emceed the event. She writes "Supreme Court Dispatches" and "Jurisprudence." Ms. Lithwick was awarded the Online News Association's award for online commentary in 2001.

EPIC also welcomed new members to the EPIC Advisory Board: Grayson Barber, Fellow, Center for Information Technology Policy, Princeton University; Aziz Huq, Lecturer, University of Chicago Law School; Ian Kerr, Canada Research Chair in Ethics, Law, and Technology, University of Ottawa; Pradeep K. Khosla, Dean, College of Engineering, Carnegie Mellon University; Rebecca MackInnon, Assistant Professor, University of Hong Kong Journalism and Media Studies Center; Founder, Global Voices; Craig Newmark, Founder, Craig's List; Helen Nissenbaum, Professor, Media, Culture & Communication, Computer Science; Senior Fellow, Information Law Institute, NYU School of Law; Harriet Pearson, Vice President, Security Counsel & Chief Privacy Office, IBM; Georgetown Communication, Culture & Technology Program; Chris Soghoian, Blogger, dubfire.net; Fellow, Berkman Center for Internet & Society.

EPIC also elected four new members to the EPIC Board of Directors Charlie Firestone, Mary Minow, Pablo Molina, and Deborah Peel.

Congressman Ed Markey: http://markey.house.gov/

Paul M. Smith: http://www.jenner.com/people/bio.asp?id=278

D.J. Caruso: http://en.wikipedia.org/wiki/D.J._Caruso

Speech of D.J. Caruso: http://epic.org/linkedfiles/epic_speech_DJCaruso.pdf

Dahlia Lithwick, Slate Magazine: http://www.slate.com/?id=3944&qp=26373

EPIC - Advisory Board: http://epic.org/epic/advisory_board.html

EPIC - Board and Staff: http://epic.org/epic/staff_and_board.html

Eagle Eye - The Movie: http://www.eagleeyemovie.com/

Purchase "Eagle Eye" at Amazon.com: http://www.amazon.com/gp/product/B001L2ZSKS?tag=e03a6-20

On May 26, 2009, President Obama nominated Judge Sonia Sotomayor to replace Justice David H. Souter on the Supreme Court. In early June, Senate Judiciary Committee Chairman Patrick Leahy (D-Vt.) announced that hearings to consider the nomination of Judge Sonia Sotomayor to be an Associate Justice of the U.S. Supreme Court will begin on July 13, 2009.

The Supreme Court of the United States exercises authority as the highest appellate court in the federal judiciary. Under the Constitution, Justices on the Supreme Court receive lifetime appointments for which one must first be nominated by the President and then confirmed by the Senate. An important role is also played midway in the process — after the President selects, but before the Senate as a whole considers the nominee — by the Senate Judiciary Committee. The Committee initiates its own intensive investigation into the nominee's background. Information is based on a committee questionnaire to which the nominee responds in writing as well as confidential FBI reports.

A confirmation hearing begins with a statement from the Committee chairman followed by the nominee's opening statement. The chairman, followed by the ranking minority member and then the rest of the committee in descending order of seniority begins the questioning. Within a week of the end of hearings, the committee meets in open session to determine what recommendation to "report" to the full Senate. A vote to confirm requires a simple majority of Senators present and voting.

Judge Sonia Sotomayor, a student of Yale Law School, joined the New York District Attorney's Office immediately upon graduating. Judge Sotomayor then entered private practice, eventually becoming a partner at Pavia & Harcourt. She specialized in intellectual property litigation, international law, and arbitration. President George H. W. Bush nominated Judge Sotomayor to the U.S. District Court for the Southern District of New York in 1991. In 1997, President Bill Clinton nominated her to the U.S. Court of Appeals for the Second Circuit. If Sotomayor is successfully confirmed by the Senate, she may encounter Constitutional and statutory issues in the area of privacy law during her tenure on the Court which in the contemporary environment, is more vital than ever.

Judge Sotomayor has ruled on several cases affecting the Fourth, First Amendment, and open government issues. Her opinions have included cases regarding the opening and reading of a prisoner's mail, strip-searches of young girls at juvenile facilities and of adult males in jails, concerning errors in police computer databases, addressing the validity of a warrant based upon lies or questionable facts, child pornography on the internet, search of state employee's computer, investigations regarding FBI misconduct, inter-agency documents and tax law administration, gag orders on the media from publishing jury names, contract formation in cyberspace, and concerning the sale of illegal wiretapping devices.

EPIC's Page on the Nomination of Judge Sotomayor: http://epic.org/privacy/sotomayor

Supreme Court Appointment Process: Roles of the President, Judiciary Committee, and the Senate (CRS Report for Congress, July 6, 2005): http://fpc.state.gov/documents/organization/50146.pdf

Sotomayor Confirmation Hearing To Begin July 13: http://leahy.senate.gov/press/200906/060909b.html

Comments of Senator Patrick Leahy (D-Vt.). Chairman, Senate Judiciary Committee, On The President's Nomination of Sonia Sotomayor to the U.S. Supreme Court, May 26, 2009: http://leahy.senate.gov/press/200905/052609a.html

The President's Nominee: Judge Sotomayor, The White House Blog Post, May 26, 2009: http://www.whitehouse.gov/sotomayor/

The American Recovery and Reinvestment Act of 2009 charged the Federal Communications Commission with creating a national broadband plan that would "ensure that every American has access to broadband capability and establishes clear benchmarks for meeting that goal." The FCC sought comments on the plan.

EPIC submitted comments stressing the importance of securing the privacy interests and civil liberties of consumers and Internet users in the development of the broadband plan. EPIC has long supported the FCC's efforts to secure privacy, having previously advocated for the FCC to require strong privacy safeguards for telephone customers' personal information and to protect wireless subscribers from telemarketing. EPIC urged the Commission to again exercise its authority to ensure that the broadband plan includes robust privacy safeguards.

EPIC noted that the goal of widespread adoption of broadband technology depends on consumers being confident that their online activities will not be monitored and their personal information will not be collected, sold, and used in ways other than what they intended. Additionally, EPIC recommended that the Commission exclude personally identifiable information from data collected for the purposes of setting broadband penetration benchmarks and analyzing progress toward these goals.

Increased broadband adoption will also make deep packet inspection more valuable. EPIC recommended that the Wiretap Act's prohibition on deep packet inspection by Internet service providers be strictly enforced. A clear legal prohibition on DPI must be maintained in order to safeguard users' privacy. EPIC also recommended that the Commission regulate the behavioral advertising practices of Internet companies instead of continuing to rely on self-regulation by the industry.

The promotion of the national broadband plan will also improve access to electronic medical records, but it must be accompanied by robust privacy protections. In the past, EPIC has identified the importance of and established principles for federal privacy protection for medical records. EPIC urged the Commission to require protections for all electronic medical records to prevent sensitive patient information from being compromised.

American Recovery and Reinvestment Act of 2009: http://epic.org/redirect/022309_Stimulus_Act.html

FCC Notice of Inquiry: http://hraunfoss.fcc.gov/edocs_public/attachmatch/FCC-09-31A1.pdf

FCC Launches Development of National Broadband Plan: http://hraunfoss.fcc.gov/edocs_public/attachmatch/DOC-289900A1.pdf

Federal Communications Commission: http://www.fcc.gov

EPIC's Comments to the FCC: http://epic.org/privacy/pdf/fcc_broadband_6-8-09.pdf

EPIC's Page on NCTA v. FCC: http://epic.org/privacy/nctafcc/

EPIC's Comments to FCC against Cellphone Marketing: http://epic.org/privacy/telemarketing/fcc_aca_05-11-06.html

EPIC's Page on Deep Packet Inspection: http://epic.org/privacy/dpi/

EPIC's Page on Medical Record Privacy: http://epic.org/privacy/medical/

The Data Accountability and Trust Act was introduced in Congress on April 30, 2009 and sponsored by Congressman Bobby Rush. The bill aims to protect consumers by requiring information brokers that possess personal identification information, to implement security information practices to keep personal consumer information secure from public access.

EPIC, in a testimony before the Subcommittee on Commerce, Trade, and Consumer Protection of the House Committee on Energy and Commerce, had urged Congress to make clear fundamental obligations on companies and organizations that collect and use personal data on consumers and Internet users. Marc Rotenberg, Executive Director had said, "[i]t is simply too easy for firms today to capture the benefits of data collection and ignore the risks." Mr. Rotenberg recommended that the bill adopt a broader definition of personally identifiable information to include any information that "identifies or could identify a particular person." He also advised Congress to require that companies comply with security obligations even if information disclosed was "public record" and it appeared that there was no immediate harm to the individual whose information was acquired, since it was likely a breach would reoccur if the problem was left uncorrected. EPIC also suggested that a private right of action be added to the bill with a stipulated damage award against a company who might improperly leak personal data, and that Congress refrain, in crafting the bill, from preempting more effective individual state legislation on the matter.

On June 3, 2009, the subcommittee amended the bill by a voice vote in a mark-up session. The amendments alter the application and function of the bill in several ways. First, the amendment broadens the scope of the applicability so that it applies to all forms of personal data, and not merely that contained in electronic form. Next, it provides that in order to conform with the bill, information brokers must implement policies and procedures that include a standard method for destroying obsolete paper documents and non-electronic data containing personal information if the Federal Trade Commission finds that such a standard is appropriate.

Other additions raise the level of care expected from information brokers in their treatment of personal information. The newer version of the bill requires an information broker to correct an inaccuracy in his record if an individual provides proof that the broker was reporting incorrect information. Nonetheless, the amendments increase the number of situations in which an information broker may refrain from allowing a consumer to view his or her own personal information. The amendment, however, enables the FTC to issue regulations on the matter in circumstances it deems appropriate. With respect to notifying individuals of unauthorized access of their personal information, the new bill allows law enforcement officers to delay notification of an individual if such notification would impede upon a civil or criminal investigation.

The amendments also alter the definition of various terms contained within the bill. The newer version expand the definitions of "breach of security" to include "unauthorized access to data in electronic form." The definition of "personal information" now explicitly includes driver's license number, passport numbers, military identification numbers, or other similar government issued numbers as one of its elements. Although the original bill was slated to sunset ten years from the date of enactment, the new bill removes such provision.

Amendment in the Nature of a Substitute to H.R. 2221: http://energycommerce.house.gov/Press_111/20090603/hr2221_ans.pdf

H.R. 2221, the Data Accountability and Trust Act (as introduced): http://epic.org/redirect/051509_HR2221.html

Marc Rotenberg - Testimony, May 5, 2009: http://epic.org/linkedfiles/rotenberg_house_ctcp2221_1319.pdf

EPIC's Testimony on Identity Theft (June 17, 2008): http://epic.org/privacy/idtheft/epic_idtheft_rotenberg_6-09.pdf

House Committee on Energy and Commerce, Subcommittee on Commerce, Trade and Consumer Protection - Hearings, May 5, 2009: http://epic.org/redirect/051509_House_CTCP_0505.html

FTC Page on Identity Theft: http://www.ftc.gov/bcp/edu/microsites/idtheft/

EPIC's Page on Identity Theft: http://epic.org/privacy/idtheft

White Open Government Initiative - "Discussion"

In the First Phase of its open government proposal, "Brainstorming," the White House received several public comments. EPIC made five recommendations to promote government transparency and accountability. The next phase, "Discussion," invited comments focusing on several transparency themes: principles, governance, access, data, and operations, to be followed by a series of posts on participation and collaboration. The White House is requesting comments on 18 categories which include: Prizes as Incentives for Public-Private Partnerships; Enhancing Online Citizen Participation Through Policy; New Technologies and Participation; Improving Online Public Participation in Agency Rulemaking; Strengthening Civic Participation; Transparency in Principles, Access to Information, Open Government Operations and in Governance; Enhancing Citizen Participation in Decision-Making; Data Transparency via Data.gov; and Presidential Memo on Scientific Integrity outlined in his memoranda on for the Heads of Executive Departments and Agencies. The Collaboration Discussion will continue through this week. The Third Phase, "Drafting," begins on Monday, June 22, 2009.

Open Government Initiative: http://www.whitehouse.gov/open/

Office of Science and Technology Policy, Executive Office of the President, Transparency and Open Government: http://edocket.access.gpo.gov/2009/pdf/E9-12026.pdf

Phase II: Discussion: http://blog.ostp.gov/

OSTP: Requests for Comments: http://blog.ostp.gov/category/requests-for-comment/

Brainstorming Session: http://opengov.ideascale.com/

EPIC's Comments in the Brainstorming Phase: http://opengov.ideascale.com/akira/pmd/6537-4049

EPIC's Submission: Users Are Not Tracked on Government Sites: http://opengov.ideascale.com/akira/dtd/3544-4049

EPIC's Submission: Promoting Open Government: http://opengov.ideascale.com/akira/dtd/3533-4049

EPIC's Submission: Allowing Meaningful Public Participation: http://opengov.ideascale.com/akira/dtd/3536-4049

EPIC's Submission: Stopping Commercialization of Personal Data: http://opengov.ideascale.com/akira/dtd/3538-4049

EPIC's Submission: Application of Privacy Act to Data Collected: http://opengov.ideascale.com/akira/dtd/3540-4049

EPIC's Page on Open Government: http://epic.org/open_gov/

EPIC's FOIA Litigation Manual 2008: http://epic.org/bookstore/foia2008/

European Advisory Group Issues Opinion on Social Networking

The Article 29 Working Party, which is the European advisory expert group on data protection and privacy, issued a guidance to Social Network Service providers on measures needed to ensure compliance with EU law. Directives 95/46/EC and Directive 2002/58/EC of the European Parliament prescribes the rights and obligations concerning the protection of individuals with regard to processing of personal data and the free flow of this data. The key concern of the group is the dissemination and use of information available on such networks for secondary, unintended purposes. The opinion recommended robust security and privacy-friendly default settings. Topics included processing of sensitive data and images, advertising and direct marketing, and data retention. In January, EPIC suggested regulation of Social Network Service partners, including advertisers and application developers.

Guidance on Social Networks: http://epic.org/privacy/socialnet/Opinion_SNS_090316_Adopted.pdf

Article 29 Working Party: http://epic.org/redirect/040109_A29WP.html

Directive 95/46/EC: http://epic.org/redirect/062209_EU9546EC.html

Directive 2002/58/EC on data protection and privacy: http://epic.org/redirect/091208_eu.html

EPIC Suggestions: http://www.cpdpconferences.org/L-Z/rotenberg.html

EPIC's Page on Social Networking Privacy: http://epic.org/privacy/socialnet/default.html

Expert Group Asks Google to Improve Cloud Computing Privacy

A letter signed by 38 researchers and academics in the fields of computer science, information security and privacy law was sent to Google's CEO. The letter asks Google to uphold privacy promises made to users of Google Cloud Computing services. In March, EPIC filed a complaint with the FTC urging an investigation into Cloud Computing services, such as Google Docs, to determine "the adequacy of the privacy and security safeguards." The EPIC complaint specifically recommended the adoption of encryption to help safeguard privacy and security. Addressing concerns about data vulnerability and interception, the expert group has asked Google to enable HTTPS (web-based encryption) by default in several Google apps, including Gmail. Google in its blog responded by stating that it was planning a trial in which it will move small samples of different types of Gmail users to HTTPS to see what their experience is, and whether it affects the speed and performance of their email.

Letter from Experts Group to Google: http://files.cloudprivacy.net/google-letter-final.pdf

Signatories of the Letter: http://www.cloudprivacy.net/letter/#signers

The Official GMail Blog: Making Security Easier: http://gmailblog.blogspot.com/2008/07/making-security-easier.html

Google Public Policy Blog: HTTPS Security for Web Applications: http://epic.org/redirect/062209_Google_https.html

Tools to Steal Information: http://fscked.org/projects/cookiemonster

HTTPS (web-based encryption): http://en.wikipedia.org/wiki/Https

EPIC's page on Cloud Computing: http://epic.org/privacy/cloudcomputing/

EPIC's Page on In re Google and Cloud Computing: http://epic.org/privacy/cloudcomputing/google/

Senators Take a Pass on REAL ID

Senator Daniel K. Akaka (D-HI), George V. Voinovich (R-OH) and other Senators have introduced the Providing for Additional Security in States' Identification Act of 2009. PASS ID, should it become law, would replace the controversial REAL ID Act of 2005. The REAL ID Act has faced ongoing criticisms from state governments, technical experts, and privacy advocates. In 2007, EPIC and the Privacy Coalition organized a national campaign against REAL ID implementation. The PASS ID proponents say the bill follows the recommendations of the 9/11 Commission for improving the security of drivers licenses while avoiding the problems of REAL ID.

S.1261 - PASS ID Act http://thomas.loc.gov/cgi-bin/bdquery/z?d111:s.01261:

Providing for Additional Security in States' Identification Act of 2009: http://epic.org/privacy/id-cards/PASS%20ID%20-%20FINAL.pdf

Senator Daniel K. Akaka (D-HI): http://akaka.senate.gov/public/index.cfm

George V. Voinovich (R-OH): http://voinovich.senate.gov/public/index.cfm

REAL ID Act of 2005: http://epic.org/privacy/id-cards/real_id_act.pdf

National Campaign: http://privacycoalition.org/stoprealid/

EPIC's page on National ID and the REAL ID Act: http://epic.org/privacy/id-cards/

Justice Department Appoints New Privacy Officer

Nancy Libin, a former Senate Staff member, has been appointed the Justice Department's Chief Privacy and Civil Liberties Officer. The CPCLO's duties and responsibilities is supported by the Office of Privacy and Civil Liberties. This main objective of this office is to protect the privacy and civil liberties of the American people by reviewing and overseeing the Department's privacy operations and ensuring its privacy compliance, which includes compliance with the Privacy Act of 1974 and the E-Government Act of 2002. Other duties include oversight of various Privacy Impact Assessments; assisting the Privacy Officer in developing Departmental privacy policies and refining Department policies relating to the protection of civil liberties of individuals, especially with regard to the Department's counterterrorism and law enforcement efforts; representing the Department with respect to international privacy policy issues; oversight of privacy-related reporting to the President and Congress; and coordinating the work of the Department relating to the protection of privacy and civil liberties.

Justice Department: The Office of Privacy and Civil Liberties: http://www.usdoj.gov/opcl/

National Archives Names FOIA Ombudsman

The National Archives announced Wednesday it has filled the newly created position of FOIA ombudsman for the federal government. Miram Nisbet was appointed to lead the Office of Government Information Services, which is located at the National Archives and Records Administration. The ombudsman's office was created by the 2007 amendments to the Freedom of Information Act to provide guidance and mediation for FOIA activities within the government. The OGIS Director is charged with reviewing policies and procedures of administrative agencies under FOIA; reviewing compliance with FOIA by administrative agencies; recommending policy changes to Congress and the President to improve the administration of FOIA; and is responsible for offering mediation services to resolve disputes between FOIA requestors and administrative agencies, and may also issue advisory opinions if mediation fail to resolve the dispute.

Press Release, The National Archives: http://www.archives.gov/press/press-releases/2009/nr09-93.html

"Schneier on Security" by Bruce Schneier

http://www.amazon.com/gp/product/0470395354?tag=e03a6-20

The public perception about security today revolves largely around notions of long lines in front of metal detectors and x-ray machines, surveillance cameras and uniformed personnel following a rulebook and asking questions. Schneier on Security journeys through a myriad of topics, situations and apparatus which a person would identify with security and makes us think about it in a way we are not used to and logically leads us to conclude what often seems counter-intuitive.

The book, a collection of essays on security technologies, policies and real-world applications, deconstructs the perceived notions of safety, exposes the ludicrous adopted policy, and addresses the true requirements for the prevention of harm. Covering most topics under the sun - ranging from terrorism, national security, and surveillance, to air travel, elections, disaster management, the selection of subjects also focuses on the less understood but definitely essential topics of economics, psychology and business behind security.

Making clear the point that "security is a trade-off," the author of term "security theater" demonstrates that in this line of business agency personnel blindly following rules and applying them to everyone is unlikely to make anyone safer. Time and again Bruce Schneier proves how in this arena hindsight bias may fool the foresight and give rise to false perceived notions of safety. A reader of this book can easily grasp the fallacy that a plethora of information collected from a populace results in an improvement in security. On the other hand, it makes one unsafe from the very people who collect the information, fail to analyze it and store it in unsecure environments. The author clearly makes the point that the debate between "security versus privacy" is, well, pointless, and the hallowed choice is of "liberty versus control." A citizen doesn't have to accept one to get more of the other.

On a word of advice, Schneier urges that the only way to change security is to step outside the system and negotiate with the people in charge as it is only outside the system that each of us has power. He advises three points on fighting back: having one-on-one negotiations, avoiding naming and shaming; and taking advantage of political pressure on elected officials. The emphasis is laid on creating the necessary incentives for building the safeguards with the right, capable, entity and at the right time.

Overall, this book is a fascinating read not only a read for citizens, but also Congressional staff, members of Congress and other lawmaking officials who desires to develop an understanding of what security really means and how to implement and manage it.

-- Anirban Sen

"Litigation Under the Federal Open Government Laws 2008," edited by Harry A. Hammitt, Marc Rotenberg, John A. Verdi, and Mark S. Zaid (EPIC 2008). Price: $60.

http://epic.org/bookstore/foia2008/

Litigation Under the Federal Open Government Laws is the most comprehensive, authoritative discussion of the federal open access laws. This updated version includes new material regarding the substantial FOIA amendments enacted on December 31, 2007. Many of the recent amendments are effective as of December 31, 2008. The standard reference work includes in-depth analysis of litigation under Freedom of Information Act, Privacy Act, Federal Advisory Committee Act, Government in the Sunshine Act. The fully updated 2008 volume is the 24th edition of the manual that lawyers, journalists and researchers have relied on for more than 25 years.

"Information Privacy Law: Cases and Materials, Second Edition" Daniel J. Solove, Marc Rotenberg, and Paul Schwartz. (Aspen 2005). Price: $98.

http://www.epic.org/redirect/aspen_ipl_casebook.html

This clear, comprehensive introduction to the field of information privacy law allows instructors to enliven their teaching of fundamental concepts by addressing both enduring and emerging controversies. The Second Edition addresses numerous rapidly developing areas of privacy law, including: identity theft, government data mining and electronic surveillance law, the Foreign Intelligence Surveillance Act, intelligence sharing, RFID tags, GPS, spyware, web bugs, and more. Information Privacy Law, Second Edition, builds a cohesive foundation for an exciting course in this rapidly evolving area of law.

"Privacy & Human Rights 2006: An International Survey of Privacy Laws and Developments" (EPIC 2007). Price: $75.
http://www.epic.org/phr06/

This annual report by EPIC and Privacy International provides an overview of key privacy topics and reviews the state of privacy in over 75 countries around the world. The report outlines legal protections, new challenges, and important issues and events relating to privacy. Privacy & Human Rights 2006 is the most comprehensive report on privacy and data protection ever published.

"The Public Voice WSIS Sourcebook: Perspectives on the World Summit on the Information Society" (EPIC 2004). Price: $40.

http://www.epic.org/bookstore/pvsourcebook

This resource promotes a dialogue on the issues, the outcomes, and the process of the World Summit on the Information Society (WSIS). This reference guide provides the official UN documents, regional and issue-oriented perspectives, and recommendations and proposals for future action, as well as a useful list of resources and contacts for individuals and organizations that wish to become more involved in the WSIS process.

"The Privacy Law Sourcebook 2004: United States Law, International Law, and Recent Developments," Marc Rotenberg, editor (EPIC 2005). Price: $40.

http://www.epic.org/bookstore/pls2004/

The Privacy Law Sourcebook, which has been called the "Physician's Desk Reference" of the privacy world, is the leading resource for students, attorneys, researchers, and journalists interested in pursuing privacy law in the United States and around the world. It includes the full texts of major privacy laws and directives such as the Fair Credit Reporting Act, the Privacy Act, and the OECD Privacy Guidelines, as well as an up-to-date section on recent developments. New materials include the APEC Privacy Framework, the Video Voyeurism Prevention Act, and the CAN-SPAM Act.

"Filters and Freedom 2.0: Free Speech Perspectives on Internet Content Controls" (EPIC 2001). Price: $20.

http://www.epic.org/bookstore/filters2.0

A collection of essays, studies, and critiques of Internet content filtering. These papers are instrumental in explaining why filtering threatens free expression.

EPIC publications and other books on privacy, open government, free expression, crypto and governance can be ordered at:

EPIC Bookstore
http://www.epic.org/bookstore

"EPIC Bookshelf" at Powell's Books
http://www.powells.com/bookshelf/epicorg.html

EPIC also publishes EPIC FOIA Notes, which provides brief summaries of interesting documents obtained from government agencies under the Freedom of Information Act.

Subscribe to EPIC FOIA Notes at: https:/mailman.epic.org/mailman/listinfo/foia_notes

"The Transformation of Privacy Policy," Institutions, Markets Technology Institute for Advanced Studies (IMT), Lucca, Italy, July 2-4, 2009.

Engaging Data: First International Forum on the Application and Management of Personal Electronic Information hosted by SENSEable City Lab, Massachusetts Institute of Technology. October 12-13, 2009. For more information,
http://senseable.mit.edu/engagingdata

Pan-European Dialogue on Internet Governance (EuroDIG), Geneva, Switzerland, September 14-15, 2009. For more information,
http://www.eurodig.org/

Join the Electronic Privacy Information Center on Facebook
http://epic.org/facebook

Start a discussion on privacy. Let us know your thoughts. Stay up to date with EPIC's events. Support EPIC.

The EPIC Alert mailing list is used only to mail the EPIC Alert and to send notices about EPIC activities. We do not sell, rent or share our mailing list. We also intend to challenge any subpoena or other legal process seeking access to our mailing list. We do not enhance (link to other databases) our mailing list or require your actual name.

In the event you wish to subscribe or unsubscribe your e-mail address from this list, please follow the above instructions under "subscription information."

The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, see http://www.epic.org or write EPIC, 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. +1 202 483 1140 (tel), +1 202 483 1248 (fax).

If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "EPIC" and sent to 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. Or you can contribute online at:

http://www.epic.org/donate

Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and expanding wiretapping powers.

Thank you for your support.

Subscribe/unsubscribe via web interface:
http://mailman.epic.org/mailman/listinfo/epic_news

Back issues are available at:
http://www.epic.org/alert

The EPIC Alert displays best in a fixed-width font, such as Courier.

.