Home | Databases | WorldLII | Search | Feedback EPIC Alert

EPIC Alert 16.09 [2009] EPICAlert 9

E P I C A l e r t

http://www.epic.org/alert/EPIC_Alert_16.09.html

"Defend Privacy. Support EPIC." http://epic.org/donate

EPIC 15th Anniversary Dinner and the EPIC Champion of Freedom Awards Cosmos Club, Washington, DC June 9, 2009

EPIC@15 Invitation: http://www.epic.org/epic15/invite.pdf Your Reply: http://epic.org/epic15/reply.pdf Register (or donate to EPIC@15): http://epic.org/register

In Flores-Figueroa v. United States, the Court was asked to determine whether individuals who proffer identification numbers that are not theirs, but don't intentionally impersonate others, can be subject to harsher punishments under federal law. On December 19, 2008, EPIC filed a "friend of the court" brief in the case, urging the Supreme Court to protect anonymous and pseudonymous activities by ruling that unintentional use of another person's ID number does not constitute "identity theft" under federal law. The brief was filed on behalf of 17 legal scholars and technical experts. EPIC explained that anonymous and pseudonymous behavior is a cornerstone of privacy protection in the identity management field. The brief urges the Court to not "set a precedent that might inadvertently render the use of privacy enhancing pseudonyms, anonymizers, and other techniques for identity management unlawful."

The EPIC amicus brief stated that the term "identity theft" "has a specific meaning among technologists, academics, security professionals, and other experts in the field of identity management." "Identity theft" refers to the knowing impersonation of one person by another. "The unknowing use of inaccurate credentials does not constitute identity theft," amici argued. The EPIC brief explains that precise use of technical concepts is crucial, particularly in a case that could have imposed enhanced criminal identity theft penalties on a person who presented an identity document that contained his own name, but an inaccurate ID number.

The EPIC brief details the importance of anonymous and pseudonymous credentials in identity management systems, and explains how an averse decision in this case "threatens to impose aggravated identity theft penalties on individuals who present inaccurate credentials in an effort to protect their privacy through pseudonymous or anonymous activities." EPIC also described the long and distinguished history of pseudonymous activity, from the American founders' pseudonymous advocacy for liberty through Mary Ann Evans' "George Eliot" nom de plume and the U.S. government's issuance of pseudonymous credentials to enrollees in the Department of Justice's Witness Protection Program.

In Flores-Figueroa v. United States, the petitioner challenged his conviction for "aggravated identity theft" under the Identity Theft Penalty Enhancement Act. Flores-Figueroa maintained that he did not commit identity theft when he used an identity document with his real name and an identity number that was not his to maintain employment.

Federal law provides for enhanced penalties when a person "knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person." Flores-Figueroa identified himself by his real name to his employer, but provided a false Social Security Number and false Permanent Resident Number. Both ID numbers were issued to someone else, but neither person shared Flores-Figueroa's name, and the government presented no evidence that Flores-Figueroa knew that the ID numbers were assigned to real people. The case resolved whether a person can be convicted of aggravated identity theft if he does not "knowingly" use an ID number assigned to "another person."

EPIC has advocated for strong protections against identity theft, and opposed burdensome ID requirements. In 2008, EPIC encouraged federal regulators to impose monetary penalties on companies that exposed their customers' data to criminals. In addition, EPIC has long supported the right of individuals to preserve their anonymity, particularly in the face of ever more intrusive government identification requirements.

Supreme Court Opinion in Flores-Figueroa v. United States: http://www.supremecourtus.gov/opinions/08pdf/08-108.pdf

"Friend-of-the-court," Brief by EPIC, Legal Scholars, Technical Experts, and Privacy and Civil Liberty Groups (Dec. 19, 2008): http://epic.org/privacy/flores-figueroa/121908_brief.pdf

US Supreme Court Docket page for Flores-Figueroa v. United States: http://www.supremecourtus.gov/docket/08-108.htm

EPIC's Flores-Figueroa v. United States page: http://epic.org/privacy/flores-figueroa/

EPIC's Identity Theft Page: http://epic.org/privacy/idtheft/

EPIC's Support for Constitutional Right to Anonymity in Watchtower Bible v. Stratton: http://epic.org/free_speech/watchtower.html

Petitioner's Brief for Supreme Court Review in Flores-Figueroa v. United States: http://epic.org/privacy/flores-figueroa/pet_amicus.pdf

The Government's Brief Regarding Supreme Court Review in Flores-Figueroa v. United States: http://epic.org/privacy/flores-figueroa/gov_amicus.pdf

EPIC submitted a Freedom of Information Act request to the General Services Administration seeking agency records concerning agreements the GSA negotiated between federal agencies and social networking services, including Flickr, YouTube, Vimeo, Blip.tv, and Facebook.

News reports in March and April of 2009 stated that the GSA signed agreements with social networking and cloud computing service providers on the behalf of federal government agencies. The report revealed that several government agencies had been seeking arrangements with Internet service providers, but companies were reluctant to negotiate separate agreements with each agency. Further, it was reported that the government wanted to address three areas of concern: liability limitations, endorsements, and freedom of information requests. The GSA leverages the buying power of the federal government to acquire goods, and services. The agency has the power to negotiate government wide contracts and agreements with manufacturers and service providers.

EPIC is seeking disclosure of these agreements, which have not been made public. Social networking applications make it easy for users to share information about themselves with others. Many online services relay information about online associations as users create new relationships. While government agencies may use social networking, cloud computing, and Internet services to create greater transparency on their activities, it remains unclear if there are data collection, use, and sharing limitations.

In the FOIA request, EPIC is asking for the public release of the contracts and any legal opinions concerning the application of the Privacy Act of 1974 and Freedom of Information Act to the services that collect information on citizens.

EPIC's Freedom of Information Request: http://epic.org/privacy/socialnet/gsa_foia_4-30-09.pdf

U.S. General Services Administration: http://gsa.gov

Social Networking Privacy, EPIC: http://epic.org/privacy/socialnet/default.html

"GSA signs agreements with Web 2.0 providers," Doug Beizer, Federal Computer Week, March 25, 2009: http://fcw.com/articles/2009/03/25/web?gsaagreement.Aspx

"GSA signs agreement with Facebook," Doug Beizer, Federal Computer Week, April 10, 2009: http://fcw.com/articles/2009/04/10/web?facebook?gsa.aspx

EPIC asked Senator Patrick Leahy to investigate the Department of Justice's failure to make public statistics detailing the federal use of "pen registers" and "trap and trace" devices by requiring the DOJ to submit the annual pen register reports to the Administrative Office of U.S. Courts.

The Omnibus Crime Control and Safe Streets Act of 1968 requires the Administrative Office of the United States Courts to report to Congress the number and nature of federal and state applications for orders authorizing or approving wiretaps. The statute requires that specific information be provided to the court agency, including the offenses under investigation, the location of the intercept, the cost of the surveillance, and the number of arrests, trials, and convictions that directly result from the surveillance. The Administrative office has a proven track record of reliably collecting information and publicly disseminating statistics regarding such wiretap orders.

Although law enforcement agents are not required to obtain search warrants before using pen registers or trap and trace devices, the Electronic Communications Privacy Act of 1986 requires the Attorney General to "annually report to Congress on the number of pen register orders, and orders for trap and trace devices applied for by law enforcement agencies of the Department of Justice." Complying with public reporting requirements is critical to ensuring transparency and ensuring Congressional oversight.

Law enforcement agencies use pen registers and trap and trace devices to conduct covert surveillance. Pen registers record outgoing non- content information regarding telephone calls and Internet communications. Non-content information includes telephone numbers dialed and the length of calls, as well as the identities of an email message's sender and recipient. Trap and trace devices capture the same information concerning incoming communications.

Between 1999 and 2003, the Department of Justice failed to comply with this requirement. The report provided failed to include all of the information that the Pen Register Act required to be shared with lawmakers and did not include information regarding the offenses for which the pen register and trap and trace orders were obtained. Further, the DOJ has failed to provide annual pen register reports to Congress since 2004. EPIC stated that such "failure would demonstrate ongoing, repeated breaches of the DOJ's statutory obligations to inform the public and the Congress about the use of electronic surveillance authority."

EPIC also called to attention the accuracy of the pen register reports for the period 1999-2003. "Hybrid orders," which are used to determine location information through the use of a suspect's cellular phone is based on non-content information and therefore should also be included in the DOJ's annual reports to Congress. Such surveillance had been invoked using a combination of authorities under the Pen Register Act and the Stored Communications Act.

EPIC specifically suggested that the Attorney General make public pen register and trap and trace reports from 2004 through the present, and to publicly disclose all future reports as a matter of course. EPIC contended that if such information was made available in web 2.0 compatible formats, it would enable a more extensive analysis and further the President's goal of enabling the use of new technology for a more informed public.

EPIC's letter to Senator Leahy: http://epic.org/privacy/wiretap/ltr_pen_trap_leahy_final.pdf

Reporting Requirement on the Use of Pen Registers and Trap and Trace Devices, Section 3126: http://www.usdoj.gov/criminal/cybercrime/pentrap3121_3127.htm

Wiretap Applications Decline in 2008: http://epic.org/redirect/051509_Wiretap_2008_decline.html

2008 Wiretap Report: http://www.uscourts.gov/wiretap08/contents.html

EPIC's Page on Wiretapping: http://epic.org/privacy/wiretap/

Title III Electronic Surveillance 1968-2005: http://epic.org/privacy/wiretap/stats/wiretap_stats.html

EPIC's Page on Foreign Intelligence Surveillance Act (FISA): http://epic.org/privacy/terrorism/fisa/

EPIC Director Marc Rotenberg testified before Congress on the Data Accountability and Trust Act. The proposed statute requires the implementation of policies and procedures regarding information security practices of personal information and regulate the information broker industry. The Act also sets up special requirements for information brokers which includes submission of security policies to the Federal Trade Commission and issuing of breach notifications.

Rotenberg said, "there is a need to make clear fundamental obligations on the companies and organizations that collect and use personal data on consumers and Internet users. It is simply too easy for firms today to capture the benefits of data collection and ignore the risks. In the absence of security obligations and breach notification requirements, it is too easy for firms to continue bad practices." The EPIC Director urged Congress to focus on broad obligations of these companies, to make clear the incentives, and to encourage the development of the best solutions."

The recommendations included the use of text messaging and social networking services to supplement the prescribed methods of email and written notifications. Rotenberg also recommended that the security obligation upon companies should continue to apply even if the information disclosed was "public record" and there was no immediate harm to the individual as it was likely that the breach would occur again if the problem was left uncorrected.

Other suggestions included adopting a broader definition of personally identifiable information to include any information that "identifies or could identify a particular person." A major issue that arose in the new act was that of preemption and the circumstances under which the federal law would overwrite possibly more effective state information security information. EPIC opposed the preemption of stronger state laws and warned that adopting such a law would be a mistake as security issues are rapidly changing and the states required the ability to respond to emerging issues and "placing all of the authority to respond here in Washington in one agency would be ... a critical failure point."

The EPIC President also urged the Committee to add a private right of action to the bill with a stipulated damage award against a company who might improperly leak personal data as it would provide a necessary backstop to the envisaged enforcement scheme which relied almost exclusively on the FTC to act on its own discretion and without any form of judicial review. Another problem highlighted in the breach notification mechanism was the measure of discretion given to a company in suspending notice requirements if it decided there was "no reasonable risk of identity theft, fraud, or other unlawful conduct."

Rotenberg concluded the testimony by saying "many companies have poor security practices and collect far more information than they need or can safeguard" and "companies need to know that they will be expected to protect the data they collect and that, when they fail to do so, there will be consequences."

Marc Rotenberg - Testimony, May 5, 2009: http://epic.org/linkedfiles/rotenberg_house_ctcp2221_1319.pdf

House Committee on Energy and Commerce, Subcommittee on Commerce, Trade and Consumer Protection - Hearings, May 5, 2009: http://epic.org/redirect/051509_House_CTCP_0505.html

H.R. 2221, the Data Accountability and Trust Act: http://epic.org/redirect/051509_HR2221.html

FTC Page on Identity Theft: http://www.ftc.gov/bcp/edu/microsites/idtheft/

EPIC's Page on Identity Theft: http://epic.org/privacy/idtheft

The Office of the Inspector General at the Department of Justice recently conducted an audit and found that many watchlist nominations were processed in an untimely manner and the FBI had not consistently nominated known or suspected terrorists to the consolidated terrorist watchlist in accordance with FBI policy. The consolidated terrorist watchlist was created in March 2004 and is managed by the Federal Bureau of Investigation through its supervision of the Terrorist Screening Center. The watchlist is meant to be used by screening personnel at U.S. points of entry and by federal, state, local, and tribal law enforcement officials.

As of December 31, 2008, the consolidated terrorist watchlist contained more then 1.1 million known or suspected terrorist identities. Last year, an audit report that examined the nomination process found that initial watchlist nominations created by FBI field offices often contained inaccuracies or were incomplete, leading to delays in the inclusion of known or suspected terrorists on the watchlist. The audit had determined that the FBI did not consistently update or remove watchlist records when appropriate and FBI field offices had, at times, bypassed some of the FBI's quality control mechanisms by excluding FBI headquarters and submitting watchlist nominations directly to the National Counterterrorism Center.

EPIC testified on cleaning up the nation's watchlists last year and bringing to the attention of the Congress the lack of transparency surrounding the process of removing one's name from the watchlist. EPIC highlighted problems with the security watchlist - first, the databases in the system are not subject to the full safeguards of the Privacy Act of 1974 as the Transportation Security Administration had sought wide-ranging exemptions; and, the security watchlists on which the system was based are riddled with inaccurate and obsolete data. EPIC had also criticized the Secure Flight program as it could severely restrict an individual's right to travel. Secure Flight receives passenger and certain non-traveler information, conducts watchlist matching against the consolidated terrorist watchlist, and transmits boarding pass printing instructions back to aircraft operators. However, relying on a flawed database would restrict legitimate travelers from obtaining a boarding pass.

The OIG report found flaws in the watchlist maintenance even after several reports were published calling attention to the same. The report states that 78 percent of the initial watchlist nominations reviewed were not processed in established FBI timeframes. In other cases, the FBI failed to modify records as necessary, remove subjects names within designated timeframes or altogether fail to remove names even in closed cases. The agancy also found failure to place appropriate individuals on the watchlist. Additionally, the report also found that the FBI did not have a designated process to modify or remove from a watchlist those subjects who were nominated through the use of Information Intelligence Reports based on FBI sources overseas.

The FBI's Terrorist Watchlist Nomination Practices, U.S. Department of Justice, Office of the Inspector General, Audit Division, Audit Report 09-25, May 2009: http://www.usdoj.gov/oig/reports/FBI/a0925/final.pdf

Audit of the DOJ Terrorist Watchlist Nomination Processes: http://www.usdoj.gov/oig/reports/plus/a0816/final.pdf

EPIC Testimony, "Ensuring America's Security: Cleaning Up the Nation's Watchlists: http://epic.org/privacy/airtravel/watchlist_test_090908.pdf

EPIC's page on Secure Flight: http://epic.org/privacy/surveillance/spotlight/0807/default.html

EPIC's page on Air Travel Privacy: http://epic.org/privacy/airtravel/

EPIC's page on Registered Traveler Card: A Privatized Passenger ID: http://epic.org/privacy/surveillance/spotlight/1005/

EPIC's FOIA Note #8: http://epic.org/foia_notes/note8.html

New Administration Reverses Antitrust Policies, Focuses on Consumers

The head of the Justice Department's antitrust division, Christine A. Varney, announced a change in the antitrust policies of the new administration. The new policy is aimed at encouraging smaller companies to bring complaints to the Justice Department about possible inappropriate business practices by large companies. Ms. Varney stated, "the current economic challenges raise unique issues for antitrust authorities and private sectors... [a]ntitrust must be among the frontline issues in the Government's broader response to the distressed economy....[t]he Antitrust Division will be ready to take a lead role in this effort." Criticizing the Section 2 Report of the previous administration on various issues, the Antitrust Division Chief withdrew the former policy and said the courts, antitrust practitioners, and the business community could no longer rely on the report as DOJ Policy. In 2007, EPIC requested the FTC to open an investigation into the proposed acquisition of DoubleClick by Google. In a hearing last year, EPIC President Marc Rotenberg testified before the European Commission urging privacy safeguards and that stated Google was beginning to reveal the characteristics of an "information monopolist" and that it was important for governments to act and preserve the rights of citizens and to safeguard competition and innovation in the information economy.

Justice Department Withdraws Report on Antitrust Monopoly Law: http://www.usdoj.gov/opa/pr/2009/May/09-at-459.html

Christine A. Varney, Assistant Attorney General for Antitrust: http://epic.org/redirect/051509_Varney_Antitrust.html

EPIC - Privacy? Proposed Google/DoubleClick Deal http://epic.org/privacy/ftc/google/

CRS Publishes Report on Airport Passenger Screening

A Congressional Research Service report on Airport Passenger Screening stated that policymakers and aviation security planners had not agreed upon a well-defined strategy and plan for evolving airline passenger and baggage screening functions to incorporate new technologies, capabilities, and procedures to detect potential threats to aviation security. The report also states that the whole-body imaging technologies were deployed in an effort to reduce an elevated security risk, while maintaining privacy rights and dignity of passengers identified for secondary screening. However, earlier this year, the TSA announced that the use of these devices would be the default screening method. Last month, Congressman Jason Chaffetz (R-UT) introduced legislation before Congress seeking a ban on these devices from being used by the Transportation Security Administration in various airports across America.

Airport Passenger Screening: Background and Issues for Congress, April 23, 2009: http://assets.opencrs.com/rpts/R40543_20090423.pdf

Congressman Chaffetz Seeks to Ban Whole-Body Imaging at Airports: http://epic.org/redirect/042809_Chaffetz_WBI.html

Joe Sharkey, Whole-Body Scans Pass First Airport Tests, April 6, 2009: http://www.nytimes.com/2009/04/07/business/07road.html

Testimony of Secretary Napolitano: http://www.dhs.gov/ynews/testimony/testimony_1235577134817.shtm

Spotlight on Surveillance- Plan to X-Ray Travelers Should Be Stripped of Funding: http://epic.org/privacy/surveillance/spotlight/0605/

EPIC's Page on Air Travel Privacy: http://epic.org/privacy/airtravel/

X-Ray Backscatter Technology and Your Personal Privacy: http://www.tsa.gov/research/privacy/backscatter.shtm

TSA's page on Backscatter: http://www.tsa.gov/approach/tech/backscatter.shtm

Privacy and Consumer Groups Seek New FTC Commissioner

EPIC joined other privacy and consumer organizations in a letter to President Obama urging the appointment of a pro-consumer Commissioner to the Federal Trade Commission. The groups called for the appointment of someone with a "distinguished record of achievement in consumer affairs, with a demonstrated commitment to protecting the public from all manner of unfair, deceptive, fraudulent, and non-competitive monopolistic/oligopolistic business practices." The Commission has been one person short of its full membership since former Chair Deborah Platt Majoras left the agency last year. The President appointed Jon Leibowitz to serve as the current chair of the FTC.

Letter to President Obama: http://epic.org/linkedfiles/Obamaletter042709-1.pdf

EPIC's Page on the Federal Trade Commission: http://epic.org/privacy/internet/ftc/

Red Flags Rule Enforcement Postponed Until August

The Federal Trade Commission postponed the enforcement of the "Red Flags" identity theft rule which require financial institutions and creditors to maintain identity theft prevention programs that identify, detect, and respond to patterns, practices, or specific activities that could indicate identity theft. "Given the ongoing debate about whether Congress wrote this provision too broadly, delaying enforcement of the Red Flags Rule will allow industries and associations to share guidance with their members, provide low-risk entities an opportunity to use the template in developing their programs, and give Congress time to consider the issue further," FTC Chairman Jon Leibowitz said. The rules were developed pursuant to the Fair and Accurate Credit Transactions Act of 2003. EPIC had testified before Congress regarding the FACTA, supporting the inclusion of stronger privacy and identity theft protections in the law. "Americans need greater protections to address problems with identity theft, privacy, and inaccuracy," EPIC argued.

FTC Will Grant Three-Month Delay of Enforcement of 'Red Flags' Rule Requiring Creditors and Financial Institutions to Adopt Identity Theft Prevention Programs: http://www2.ftc.gov/opa/2009/04/redflagsrule.shtm

Letter from the House Committee on Small Business to FTC Chairman Jon Leibowitz: http://epic.org/redirect/051509_House_Letter_Leibowitz.html

Federal Register Notice Issuing "Red Flags" ID Theft Rules: http://ftc.gov/os/fedreg/2007/november/071109redflags.pdf

Agencies Issue Final Rules on Identity Theft Red Flags, October 31, 2007: http://ftc.gov/opa/2007/10/redflag.shtm

EPIC's Page on Identity Theft: http://epic.org/privacy/idtheft

Federal Commission Investigating Cloud Computing Issues

The FTC acknowledged examining privacy issues associated with cloud computing networks at a testimony before Congress on a proposed statute, the Data Accountability and Trust Act. In March, EPIC had filed a complaint before Commission requesting it to open an investigation into Google's Cloud Computing Services to determine "the adequacy of the privacy and security safeguards" following reports of a breach in Google Docs. EPIC had cited the growing dependence of American consumers, businesses, and federal agencies on cloud computing services, and had urged the Commission to take "such measures as are necessary" to ensure the safety and security of information submitted to Google. Subsequently, the Commission had agreed to review EPIC's complaint.

FTC Testifies on Data Security, Peer-to-Peer File Sharing: http://www.ftc.gov/opa/2009/05/peer2peer.shtm

EPIC's complaint to the FTC: http://epic.org/privacy/cloudcomputing/google/ftc031709.pdf

FTC's letter to EPIC: http://epic.org/privacy/cloudcomputing/google/031809_ftc_ltr.pdf

In re Google and Cloud Computing: http://epic.org/privacy/cloudcomputing/google/default.html

EPIC's Page on Cloud Computing: http://epic.org/privacy/cloudcomputing/default.html

MIT Calls for Papers on New Privacy Standards for PII Management

The SENSEable City Lab of the Massachusetts Institute of Technology is launching the Engaging Data Initiative by hosting an international forum on the application and management of personal electronic information. The event includes a series of discussion panels and conferences at MIT and seeks to understand and explore the societal values of data and the influence it has on society by its use. The initiative aims to address issues and questions through invited talks, paper presentations, and panel discussions. The forum strives to serve as a platform to exchange ideas, discuss the latest developments in the field, address significant issues, and create visions for the future. The position papers must be 4-6 pages in length; technical papers must be 6-8 pages in length. For further details, see links below.

Engaging Data: http://senseable.mit.edu/engagingdata

Call for papers: http://senseable.mit.edu/engagingdata/call_for_papers.html

Registration: http://senseable.mit.edu/engagingdata/registration.html

TACD Publishes Resolution on Social Networks:

The Trans Atlantic Consumer Dialogue made a Resolution on Social Networking and made several recommendations directed towards the EU and US governments and social network operators. The suggestions to the governments included the prevention of access to social network contingent on use of data for marketing purposes, requirement of affirmative consent before data use, limiting personal information available to applications running on them. The suggestions also declared that social networks must enable an user to delete PII obtained by third party services. Other recommendations included the integration of privacy and security by design, preventing access by search engines by default, and developing common ethical codes for behavioral tracking and advertising online. In February, EPIC prepared to file a complaint with the FTC against Facebook which threatened to take ownership of user data. Facebook reverted to its earlier terms of service just before the complaint was about to be filed.

TACD - Resolution on Social Networking, May 2009: http://epic.org/redirect/051509_TACD_SocNet_Res.html

EPIC's Page on Social Networking Privacy: http://epic.org/privacy/socialnet/default.html

EPIC's Group Page on Facebook: http://epic.org/facebook

EU Parliament adopts Harbour Report Amendments on e-Privacy Directive

The European Parliament adopted a large majority of the Harbour Report amendments on the revision of the E-Privacy Directive. The amendments involve mandatory notification of breaches affecting personal data, treating IP addresses as personal data instead of public information, ensuring the processing of personal information for network security purposes subject to Directive 95/46, requiring the informed consent of user for using cookies or storing information. Stavros Lambrinidis, Member of the European Parliament, also obtained a formal declaration of the Commission, supporting the position of the Parliament and affirming that legislative reforms and proposals will be defined in order to extend the scope to all personal data inappropriately released, handled, or used by service providers through the medium of an electronic communications service, to all providers of information society services and others.

EU Parliament Press Release: http://www.europarl.europa.eu/news/public/default_en.htm

Press Release, Office of Stavros Lambrinidis: http://epic.org/redirect/051509_StavrosLam_ePriv_PR.html

Stavros Lambrinidis, Socialist Group in the European Parliament: http://epic.org/redirect/051509_StavrosLambrinidis_EuroParl.html

"Identity in the Age of Cloud Computing" by J.D. Lasica http://tinyurl.com/IACCAI

In the summer of 2008, 28 leaders and experts from the information and communications technology world, financial, government, academic and public policy leaders convened at Aspen, Colorado, to better understand the implications of cloud computing and suggest policies for the betterment of society. Out of these discussions emerged the substance of this report. As the introduction suggests, the concept of identity is undergoing a radical shift. No longer are recognized offline parameters the sole criteria in defining "the very essence of who we are." Instead, online reputation and digital socialization are the new auras of one's identity.

The report presents factual developments in the evolution of cloud computing, the current state of growth, and the factors blowing the cloud forward. Based on the discussion of the participants, the publication provides a birds-eye view on the possibilities and the probabilities of things to come. While reading the book, one barely notices the obvious technological advances that have already taken place, but by taking a step back, it is easy to marvel at the full spectrum of developments while trying to fathom the true impact the internet has had on the people, society and human interactions.

Analyzing the changing concept of identity through the prism of cloud computing is no elementary task. In the cloud ecosystem, the control over the smattering of personal information is what defines the boundaries between ensuring identity and losing privacy. And, if the report is to be taken at face value, the commercial development of the cloud is only at its nascent stage with old business models just beginning to face the challenge of the new wave of cloud based commerce. To ensure that a trade thrives in the digital economy, it is imperative that young industries start off with their eyes gazed at the cloud.

The discussions held last year bore ominously true earlier this year. When revised Facebook policies threatened to take user information out of the hands of their owners, the social networking giant faced widespread criticism and public relations damage. Google Docs suffered a security breach and the dangers of security in the cloud computing environment became apparent even to the uninitiated. While the perceived threats of last year may sound like a portentous foreboding this year, the clock keeps ticking on the rate with which we can analyze dangers in cloud computing and commence corrective action.

Overall, the report does a brilliant job at capturing the thoughts of the experts and extracting the essence of the conference. An insightful expedition into the realm of future cloud computing, this publication is a must-read for anyone who desires to sojourn into the inevitable destiny of the internet.

-- Anirban Sen

"Litigation Under the Federal Open Government Laws 2008," edited by Harry A. Hammitt, Marc Rotenberg, John A. Verdi, and Mark S. Zaid (EPIC 2008). Price: $60.

http://epic.org/bookstore/foia2008/

Litigation Under the Federal Open Government Laws is the most comprehensive, authoritative discussion of the federal open access laws. This updated version includes new material regarding the substantial FOIA amendments enacted on December 31, 2007. Many of the recent amendments are effective as of December 31, 2008. The standard reference work includes in-depth analysis of litigation under Freedom of Information Act, Privacy Act, Federal Advisory Committee Act, Government in the Sunshine Act. The fully updated 2008 volume is the 24th edition of the manual that lawyers, journalists and researchers have relied on for more than 25 years.

"Information Privacy Law: Cases and Materials, Second Edition" Daniel J. Solove, Marc Rotenberg, and Paul Schwartz. (Aspen 2005). Price: $98.

http://www.epic.org/redirect/aspen_ipl_casebook.html

This clear, comprehensive introduction to the field of information privacy law allows instructors to enliven their teaching of fundamental concepts by addressing both enduring and emerging controversies. The Second Edition addresses numerous rapidly developing areas of privacy law, including: identity theft, government data mining and electronic surveillance law, the Foreign Intelligence Surveillance Act, intelligence sharing, RFID tags, GPS, spyware, web bugs, and more. Information Privacy Law, Second Edition, builds a cohesive foundation for an exciting course in this rapidly evolving area of law.

"Privacy & Human Rights 2006: An International Survey of Privacy Laws and Developments" (EPIC 2007). Price: $75.
http://www.epic.org/phr06/

This annual report by EPIC and Privacy International provides an overview of key privacy topics and reviews the state of privacy in over 75 countries around the world. The report outlines legal protections, new challenges, and important issues and events relating to privacy. Privacy & Human Rights 2006 is the most comprehensive report on privacy and data protection ever published.

"The Public Voice WSIS Sourcebook: Perspectives on the World Summit on the Information Society" (EPIC 2004). Price: $40.

http://www.epic.org/bookstore/pvsourcebook

This resource promotes a dialogue on the issues, the outcomes, and the process of the World Summit on the Information Society (WSIS). This reference guide provides the official UN documents, regional and issue-oriented perspectives, and recommendations and proposals for future action, as well as a useful list of resources and contacts for individuals and organizations that wish to become more involved in the WSIS process.

"The Privacy Law Sourcebook 2004: United States Law, International Law, and Recent Developments," Marc Rotenberg, editor (EPIC 2005). Price: $40.

http://www.epic.org/bookstore/pls2004/

The Privacy Law Sourcebook, which has been called the "Physician's Desk Reference" of the privacy world, is the leading resource for students, attorneys, researchers, and journalists interested in pursuing privacy law in the United States and around the world. It includes the full texts of major privacy laws and directives such as the Fair Credit Reporting Act, the Privacy Act, and the OECD Privacy Guidelines, as well as an up-to-date section on recent developments. New materials include the APEC Privacy Framework, the Video Voyeurism Prevention Act, and the CAN-SPAM Act.

"Filters and Freedom 2.0: Free Speech Perspectives on Internet Content Controls" (EPIC 2001). Price: $20.

http://www.epic.org/bookstore/filters2.0

A collection of essays, studies, and critiques of Internet content filtering. These papers are instrumental in explaining why filtering threatens free expression.

EPIC publications and other books on privacy, open government, free expression, crypto and governance can be ordered at:

EPIC Bookstore
http://www.epic.org/bookstore

"EPIC Bookshelf" at Powell's Books
http://www.powells.com/bookshelf/epicorg.html

EPIC also publishes EPIC FOIA Notes, which provides brief summaries of interesting documents obtained from government agencies under the Freedom of Information Act.

Subscribe to EPIC FOIA Notes at: https:/mailman.epic.org/mailman/listinfo/foia_notes

IEEE/SP 2009 Symposium on Security and Privacy, "The IEEE Symposium on Security and Privacy has been the premier forum for presenting developments in computer security and electronic privacy, and for bringing together researchers and practitioners in the field." Sunday, May 17, 2009 - Thursday, May 21, 2009, Oakland, California. For more information, http://oakland09.cs.virginia.edu/

Web 2.0 Security & Privacy 2009, Thursday, May 21, The Claremont Resort, Oakland, California. For more information,
http://w2spconf.com/2009/

Computers, Freedom, and Privacy, 19th Annual Conference, Washington, D.C., June 1-4, 2009. For more information,
http://www.cfp2009.org/wiki/index.php/Main_Page

EPIC 15th Anniversary Dinner and the EPIC Champion of Freedom Awards, Cosmos Club, Washington, DC, June 9, 2009. For invitation, see
http://www.epic.org/epic15/invite.pdf. Register at
http://epic.org/register

IAPP - Practical Privacy Series - "Data Breach," "Data Governance,", "Human Resources," and "Information Security and Privacy." Network Meeting Center at Techmart, Santa Clara, CA. June 17-18, For more information, https://www.privacyassociation.org/index.php

"The Transformation of Privacy Policy," Institutions, Markets Technology Institute for Advanced Studies (IMT)Lucca, Italy, July 2-4, 2009.

Engaging Data: First International Forum on the Application and Management of Personal Electronic Information hosted by SENSEable City Lab, Massachusetts Institute of Technology. For more information,
http://senseable.mit.edu/engagingdata

Join the Electronic Privacy Information Center on Facebook
http://epic.org/facebook

Start a discussion on privacy. Let us know your thoughts. Stay up to date with EPIC's events. Support EPIC.

The EPIC Alert mailing list is used only to mail the EPIC Alert and to send notices about EPIC activities. We do not sell, rent or share our mailing list. We also intend to challenge any subpoena or other legal process seeking access to our mailing list. We do not enhance (link to other databases) our mailing list or require your actual name.

In the event you wish to subscribe or unsubscribe your e-mail address from this list, please follow the above instructions under "subscription information."

The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, see http://www.epic.org or write EPIC, 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. +1 202 483 1140 (tel), +1 202 483 1248 (fax).

If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "EPIC" and sent to 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. Or you can contribute online at:

http://www.epic.org/donate

Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and expanding wiretapping powers.

Thank you for your support.

Subscribe/unsubscribe via web interface:
http://mailman.epic.org/mailman/listinfo/epic_news

Back issues are available at:
http://www.epic.org/alert

The EPIC Alert displays best in a fixed-width font, such as Courier.

. .