16-30 September 2012

 

Biometrics

US – Voice Verification Technology Prevents Impersonators from Obtaining Voiceprints

Computer users have learned to preserve their privacy by safeguarding passwords, but with the rise of voice authentication systems, they also need to protect unique voice characteristics. Researchers at Carnegie Mellon University’s Language Technologies Institute (LTI) say that is possible with a system they developed that converts a user’s voiceprint into something akin to passwords. The system would enable people to register or check in on a voice authentication system, without their actual voice ever leaving their smartphone. This reduces the risk that a fraudster will obtain the person’s voice biometric data, which could subsequently be used to access bank, health care or other personal accounts. “When you use a speaker authentication system, you’re placing a lot of faith in the system,” said Bhiksha Raj, an associate professor of language technologies. “It’s not just that your voiceprint might be stolen from the system and used to impersonate you elsewhere. Your voice also carries a lot of information—your gender, your emotional state, your ethnicity. To preserve privacy, we need systems that can identify you without actually hearing your voice or even keeping an encrypted record of your voice.” [Source]

CA – Quebec Sets Rules For Biometric Identification Systems

In Quebec, employers need to comply with the requirements set in the Act to Establish a Legal Framework for Information Technology, which the Quebec Commission on Information Access strictly monitors. Under the act, both physiological biometry and behavioral biometry are available to employers. Usually, employers choose physiological biometry, which deals with fingerprints to record employee attendance. Kronos Touch ID Technology is used often because it does not store fingerprint images. All it requires is for the employee to enter his or her personal ID code and place his or her finger on a screen.

Biometric identification systems based on mathematical representation technology are acceptable to the Quebec Commission on Information Access as it does not store images, thus it does not infringe on the rights of an individual to privacy. The Act Respecting the Protection of Personal Information in the Private Sector is strict when it comes to employers using biometrics in Quebec. There are nine conditions summarized in its guidelines entitled “Biometrics in Quebec: Application Principles, Making an Informed Choice.” The approach first prompts employers to explore alternative choices other than biometrics. If employers do choose biometrics, they need to secure the consent of each individual or employee to be subjected to biometrics. This gives employees the option whether to give their consent or not, and employees can withhold their consent without providing any justification. Employers need to conduct information sessions so as to acquaint and make the employees understand the “ins and outs” of the biometric identification system and its necessity to be employed in the workplace. Furthermore, employers have to consult with legal counsel to make sure that human rights issues are assessed properly and that necessary legal requirements and reporting obligations to Commission are obliged with. [Source]

EU – Facebook Suspends Use of Facial Recognition Tool in EU

Facebook has suspended the use of its facial recognition tool in Europe. The feature suggests users who could be tagged in photographs posted to the site. Facebook says that the feature has been turned off for new EU users and that “templates for existing users will be deleted by 15 October.” The decision was made in response to recommendations from the Irish Data Protection Commissioner. In addition, Germany has demanded that Facebook disable the service and destroy its associated database. [BBC] [ComputerWorld] [InformationWeek] [v3.uk] [ArsTechnica] See also: [US: To lawbreakers’ angst, mug shot websites spreading]

WW – Airport Iris-Scanning May Be Wave of Future

Iris-scanning technology is being rolled out in select airports. Technology similar to AOptix’s InSight Duo iris scanner may become a standard security check at airports and border crossings around the globe, the report states, making the security experience more efficient. A company whitepaper states, “In an InSight-based eGate, a traveler would pass through border control by first scanning his biometric passport on the eGate and then authenticating his biometric record with InSight.” Privacy concerns loom, however, as researchers recently were able to reverse engineer iris code back into an iris image. Privacy expert Woodrow Hartzog said, “A significant enough breach could render an entire verification system unreliable.” [Ars Technica]

Canada

CA – Alberta Privacy Commissioner Issues Report on Privacy Breaches

Alberta’s new Privacy Commissioner, Jill Clayton, has released a report on the first two years of mandatory privacy breach reporting in Alberta (the “Breach Report”). As of the end of April 2012, 151 breach reports had been received by the Privacy Commissioner. Of these reports, 63 cases (42%) involved a real risk of significant harm. In the remainder of the matters, this threshold was not reached, PIPA was determined not to apply, or the matter was still under review. The Breach Report shows that a majority of the 63 reported cases meeting the real risk of significant harm threshold involved human error or lost or stolen unencrypted electronic devices: 22 breaches were caused by human error. These incidents included inappropriate disposal of personal information, emails sent to the wrong individuals (or viewable to all individuals in a mass email), faxes sent to the wrong person or to an unsecure fax, loss of files and portable memory sticks, and unauthorized disclosure of passwords. The most common form of human error was mail and courier errors caused by delivery to the wrong individual.

–          18 breaches were caused by theft. These breaches were primarily due to office and car break-ins resulting in the loss of computer devices, although in a few cases paper documents were also stolen.

–          14 breaches were caused by electronic system compromises. These breaches were typically found to occur as a result of targeted attacks by external hackers seeking to extract large amounts of data. In one incident, 50 million individuals were affected.

–          9 breaches were caused by a failure to adequately control access to electronic or paper files. One case in particular involved files that were accessible to the public via the Internet.

Where a real risk of significant harm was found, the Breach Report indicates that most of the personal information breached was considered to be of high sensitivity, such as social insurance numbers, drivers’ license numbers, or credit card numbers. The Breach Report also indicates that the following circumstances were likely to lead to a real risk of significant harm:

–          where information was apparently stolen for nefarious purposes;

–          where recipients could not be determined;

–          where electronic devices containing personal information had no encryption and no audit capability, making access possible and unknown; and

–          where a large number of individuals were affected and where there was a likelihood that the personal information could be used for a nefarious purpose (such as “phishing” for more personal information).

The Breach Report also offers some commentary on when reporting is not required. Where no real risk of significant harm was found, the personal information involved was typically of low sensitivity. Even where sensitive information was breached, reporting was not required where the organization used strong encryption methods or auditing capability, thus making access to the information highly unlikely. Typically, reporting was not required where recipients were few and known to the organization, or where the information was returned or confirmed destroyed in a relatively short time frame. The Breach Report offers further guidance on prevention of privacy breaches. In addition to measures intended to protect against specific risks to personal information, organizations should implement the following basic steps: [Source]

CA – Newfoundland Passes Amendments to Privacy and ATIP Laws

Despite a four-day, record-breaking, filibuster in mid-June, the provincial Conservative party of Newfoundland and Labrador passed a bill that will radically reduce public access to government information in the province. Bill 29 has drawn widespread criticism from legal experts, opposition politicians and working journalists alike, who have called the bill regressive and draconian. “It’s more of a piece of legislation that sets rules on how not to release things,” Russell Wangersky, an editor and columnist with The Telegram in St. John’s. The amendment to the province’s Access To Information and Protection of Privacy Act (ATIPPA) has the potential to drastically reduce the need of the Newfoundland government to respond to, well, anything, really. Requests that Cabinet determines are “vexatious, frivolous [or] trivial” can now be disregarded. The definition of “Cabinet confidences” has also been expanded to include documents that have been prepared for Cabinet, but which Cabinet doesn’t need to have ever seen or used. Bill 29 took its cue from a review of the ATIPPA, released in January of 2011, undertaken by career NL bureaucrat John R. Cummings, Q.C. Among other high-ranking governmental positions, Cummings has been Newfoundland’s Deputy Minister of Justice, Deputy Attorney General and Secretary to the Cabinet. The new law subsequently implemented 16 of the review’s 33 recommendations. Cummings’ review was supposed to rely heavily on a public consultation process, but Wangersky sees it differently. “The review [to] our Access to Information Privacy Act…was overseen by a former civil servant who had a number of years’ experience turning down Access to Information requests,” says Wangersky. “[Cummings] heard primarily from civil servants and government departments and came up with modifications to the Act that substantially restrict the release of documents and put more and more of a control over what can be released into the hands of Cabinet.” [Source]

CA – Kenney’s Emails Targeting Gay Community Raises Privacy Concerns

For many who received an email from Citizenship and Immigration Minister Jason Kenney about gay refugees, the message raised one important question: How did he know I’m gay? The bulk email sent from Kenney’s MP’s office to thousands was titled “LGBT (lesbian, gay, bisexual and transgender) Refugees in Iran” and began with the salutation, “Friend.” Among the recipients was Meredith Richmond of Peterborough, Ont., who, to her knowledge, had never had any contact with Kenney’s office before. She had no idea how Kenney got her personal Gmail address and seemed to know about her sexual orientation. “It felt really targeted at me,” she said. “I’m not a supporter of the Conservatives.” While Richmond had never directly emailed Kenney’s office, she was one of nearly 10,000 people who electronically signed a 2011 online petition supporting a gay artist from Nicaragua, who was then facing deportation. Toronto community organizer and former NDP candidate Michael Erickson posted the petition on the website change.org. Whenever someone “signed” the petition, the site automatically sent a form letter by email to Kenney’s office with the signatory’s reply email address. It appears those thousands of messages were harvested by the email program in Kenney’s office and saved for later use. [Source] [Elections watchdog mulls regulation of parties’ voter databanks] and [Political Parties Operate Outside Canada’s Privacy Laws] andalso: [MB: Bateman apologizes for 1,500 leaked email addresses]

CA – Toronto Real Estate Board Seeks to Bar Public from Tribunal Hearing

The Toronto Real Estate Board is sticking so vociferously to its claims that Multiple Listing Service information routinely handed out by its own agents is such a violation of privacy in the wrong hands, it tried to have the public removed from a Competition Tribunal hearing. In the face of objections from the Competition Commissioner’s legal counsel and media covering the hearing, Tribunal chair Justice Sandra Simpson agreed that no one would be barred from the hearing. But she asked that MLS data on a handful of homes for sale as of Sept. 17 be edited to remove a number of details before being entered into the public record. That included virtual tour photos of the interior of the homes, the names of the homeowners, mortgage and commission information that is more often than not on MLS listings that traditional “bricks-and-mortar” realtors give out to clients. [Source]

CA – Teen’s Identity in Facebook Privacy Case to be Kept Confidential

A Nova Scotia teenager who wants to sue the people she alleges bullied her on Facebook will be able to keep her name private but won’t be able to get a partial publication ban on the trial, the Supreme Court of Canada has ruled. The case involved a 15-year-old teen known only as “A.B.” who learned in 2010 that a fake profile of her had been set up on Facebook. It included a photo of her and a slightly modified version of her name. The fake profile discussed her physical appearance and allegedly included “scandalous sexual commentary of a private and intimate nature,” according to the court documents. She wanted to launch a civil suit and wanted the court to compel Internet provider Bragg Communications to disclose the identity of the people behind the IP address where the alleged defamation came from. But A.B. also wanted a partial publication ban on the case, to keep the details of the alleged defamation under wraps and her full name kept confidential. This week, the Supreme Court agreed that the teen’s identity should be kept confidential, saying the court has a duty to protect her because of her age. [Source]

Consumer

CA – Canadians Trust That Organizations Won’t Share Their Information” Poll

In asking Canadians what information they’re willing to share with organizations – via consumer loyalty programs, for instance – pollsters found a considerable chunk of the population agreeable to divulging everything from sexual orientation (40%) to health details (31%) to political and religious affiliations (30% and 41%, respectively). “There’s an inherent trust that organizations are going to act reasonably with your information,” says Bryan Pearson, author of The Loyalty Leap: Turning Customer Information into Customer Intimacy. Fully 48% of Canadians say they always or often read the privacy policies of companies Canadians trust that organizations won’t share their information with whom they deal – a surprisingly high figure, Mr. Pearson said. The nationally representative survey, released Tuesday, is considered to be accurate 95% of the time, with a margin of plus or minus three percentage points. It was conducted online throughout June. [The National Post]

US – U.S. Consumers Reveal Surprising Privacy Findings

Research findings LoyaltyOne released this week show that when it comes to privacy, U.S. consumers are still protecting some of their personal information as much as they do their social security number. Of the 1,000 U.S. consumers responding to an online survey, 50% said they’d be willing to give a trusted company their religious affiliation, 49% their political affiliation, 49% their sexual orientation, 36% health information, 26% mental health information, 24% browsing history and 15% for both smart phone location and number of sexual partners. Last on the list is their social security number at 11%. Several of the 2012 questions followed up on a 2011 survey and were structured to measure changes in U.S. consumer sentiments over the past year. For brands intent on deepening their customer relationships, the results signal a concerning trend — trust may be eroding. Some key year-to-year results: 78% of U.S. respondents said they do not feel they receive any benefit at all from sharing information, up from 74% in 2011 Less than half feel that companies use their personal data to better serve the consumer, an 11% slip from 2011 62% said they would share more personal data if it meant receiving relevant product and service offers, down from 66% in 2011. “Consumers are disappointed. For years they’ve provided their valuable information and they’re not realizing something of suitable worth in return,” Pearson said. “If businesses don’t act quickly to demonstrate they have the consumer’s best interest at heart, they risk an erosion of the business-to-consumer relationship.” [Source]

WW – Think Tank: Business Would Benefit by Upping Consumer Data Control

Policy think tank Demos has said businesses would benefit if they granted consumers more control over how their personal data is used. Consumers are suffering a “crisis of confidence” when it comes to information sharing, Demos said. Businesses could overcome this if they have “open, transparent and clear information-sharing relationships with customers” and allow consumers to make an “informed choice” about the ways their personal information is used. “Regulators and businesses need to find a flexible, dynamic framework, which recognizes the diversity of views on the issue, and consider how people can customize and negotiate their relationship with organizations so that it is and feels mutually beneficial.” [Out-Law.com] [DEMOS Report]

Electronic Records

US – HHS, VA Demonstrate PHI eTransfer

The U.S. Department of Health and Human Services and the Veterans’ Administration have demonstrated how sensitive patient data can be transferred electronically while maintaining confidentiality. Developed as part of the Data Segmentation for Privacy Initiative (DS4P), the demonstration showed how a patient could consent to a transfer and how data would be tagged according to sensitivity, requiring further authorization from the patient prior to additional disclosure. Office of the National Coordinator for Health IT Chief Privacy Officer Joy Pritts said, “This project helps demonstrate that with proper standards in place, existing privacy laws and policies can be implemented appropriately in an electronic environment.” [FierceEMR]

EU Developments

EU – Reding: Data Protection Directive Overhaul Could Save 2.3 Billion in Costs

EU Justice Commissioner Viviane Reding says an overhaul of EU data protection rules could save as much as €2.3 billion in administrative costs. Reding has said a single set of data rules for the EU and a one-stop-shop for data protection will make Europe a more attractive place to do business. The proposed legislation will also provide better access to personal data, Reding and Irish Data Protection Commissioner Billy Hawkes wrote in a recent piece for the Irish Examiner. Ireland will play a key role in shaping the new rules, Reding says, as it is home to many firms handling personal data. [Bloomberg] See [Letter to European Parliament re: European Commission General Data Protection Regulation – US Consumer Organizations] and also: [Article 29 Data Protection Working Party – Opinion 07/2012 on the Level of Protection of Personal Data in the Principality of Monaco – Working Paper 198]

EU – EC Releases Cloud Strategy; ICO Releases Guidelines

The European Commission (EC) has released a new strategy for “unleashing the potential of cloud computing in Europe.” Among the “key actions” in the strategy are “Cutting through the jungle of technical standards so that cloud users get interoperability, data portability and reversibility,” EU-wide certification schemes and a European Cloud Partnership with member states. EC Vice President Viviane Reding said the strategy “will enhance trust in innovative computing solutions and boost a competitive digital single market where Europeans feel safe,” adding, “That means swift adoption of the new data protection framework…”

UK – ICO Issues ‘Viable and Realistic’ Cloud Computing Guide

The Information Commissioner’s Office (ICO) released, on 27 September 2012, a cloud computing guide, recommending, among others, that cloud customers create a clear record about the categories of data they intend to move to the cloud and warns that using cloud services ‘may give rise to more personal data collected…for example, the usage statistics or transaction histories of users may be recorded’. [Source] Information Commissioner’s Office publishes guidelines on the responsible use of cloud computing. [Source] See also: [European Data Protection Supervisor – Formal Comments on DG MARKT’s Public Consultation on Procedures for Notifying and Acting on Illegal Content Hosted by Online Intermediaries]

UK – ICO Releases Google Data Protection Audit Report

The Information Commissioner’s Office (“ICO”) followed-up on a consensual audit and found that the organisation remained at a level of “reasonable assurance”; areas where the organisation improved included introducing privacy as a key theme for internal audit reviews (privacy risk is actively considered in the scoping of audits), the use of Privacy Design Documents in user-facing products (these documents are granular to the different types of products, to ensure the relevant privacy issues are addressed by an appropriate working group), and advanced, mandatory training covering privacy (building on the experience gained through the Privacy Design Document process). The organisation still needs to do more regarding historical projects lacking a Privacy Design Document (a risk-based approach was adopted to roll out Privacy Design Documents, but procedures need to ensure that the right projects are being escalated for review). [Source]

EU – Irish Data Protection Commissioner Released Report of Facebook Re-Audit

A re-audit finds that a social networking website responded to recommendations in a satisfactory way, addressing third party applications (creating an App Centre that standardised the user experience with respect to privacy and creating an audience selector, allowing users to choose who can view their activity with respect to apps), tagging of photos (users have tools to pre-approve tags, un-tag photos, block users who are harassing them with unwanted tags, and remove the record of a deleted tag), privacy and data use policy (new users are met by a “welcome dashboard” that gives a tour of the greatest areas of privacy risk and are given a privacy prompt 30 days after joining, to provide information and choice once they have a working knowledge of the site), and retention (users can delete posts, friend requests, tags and messages on a per-item basis and social plug-in data is deleted for users after 60 days, and non-users within 10 days). Issues that remain on-going include compliance management (all significant changes to the use of personal data are to be approved in a manner set out by the board of directors that takes full account of European data protection requirements), third party apps (a tool to check whether apps’ privacy policy links are live still needs to become operational), cookies (the exact form of consent needed to comply with the cookie law is still being debated among industry and regulatory authorities), and advertising (although the site does not allow targeted advertising based on sensitive categories, advertisers can still use words and terms that are sensitive in nature to filter their ad campaigns). [Source] See also: [UK Information Commissioner’s Office – Submission to the Joint Committee – Pre-Legislative Scrutiny on the Draft Communications Data Bill] and [UK: BBC issues extraordinary apology after airing private conversation with the Queen]

EU – EDPS Calls for Harmonized “Illegal Consent” Definition

European Data Protection Supervisor (EDPS) Peter Hustinx has said the European Commission (EC) should define the term “illegal content” in order to provide clarity on content host responsibilities for removal of such information. Comments by the EDPS come after an EC consultation on reforming rules governing the removal of illegal material posted online. Examples of what the EC considered illegal include content infringing on intellectual property rights, inciting hate, relating to terrorism or invading privacy. Hustinx said he “is of the view that there is a need for a more pan-European harmonized definition of the notion of illegal content for which notice-and-action procedures would be applicable.” [Out-Law.com]

Facts & Stats

US – 94 Million Exposed: The Government’s Epic Fail on Privacy

94 million is the number of Americans’ files in which personal information has been exposed, since 2009, to potential identity theft through data breaches at government agencies. This number — which was just revealed in the latest report from tech security firm Rapid7 — is only the most conservative estimate. When you take into account the difference between reported data breaches, which is what this report measures, and actual incidents, you are talking about a much, much bigger number. [Source]

Finance

WW – PCI SSC Issues App Best Practice Guidelines

The Payment Card Industry Security Standards Council (PCI SSC) has issued best practice guidelines for developers and manufacturers to provide direction in securing mobile device payment processes. The recommendations include isolating sensitive functions and data in trusted environments; using secure code best practices; minimizing third-party access; developing remote payment-disabling functions, and creating suspicious activity monitoring tools. The guidelines also look at ways to prevent the interception of account data in transit. “We have a brand new group of developers that aren’t aware of their responsibility,” said PCI SSC’s chief technology officer. “They are designing good code but don’t know all it’s being used for.” [SC Magazine] [Press Release]

FOI

CA – BC Not So Free With Information: Report

The British Columbia government responds to nearly a quarter of all requests under freedom-of-information laws by insisting it has no records to offer, according to statistics compiled by a group that argues the dramatic increase in such cases raises serious questions about public accountability. The BC Freedom of Information and Privacy Association filed a complaint this week with the province’s information and privacy commissioner, suggesting the trend is either a sign the province isn’t releasing all the information it could or, worse, a symptom of a government that avoids keeping records to skirt the law. The group compiled statistics, available on the provincial government’s website, that indicate the number of such cases has increased sharply in the past decade. In 2002-2003, there were no cases in which the government could not find any records to satisfy a request; today, that scenario accounts for 23% of all requests. [Source] See also: [City of Victoria seeks to limit requests for information] [Saskatchewan Gov’t will look into Workers Compensation Board concerns of Privacy Commissioner] and [NL: Privacy-breach penalties should be enforced, says commissioner] 

US – DND Tightens the Screws on Release of Information

Members of the Canadian military have been told to tighten the screws and withhold information, even though it may not be sensitive or a threat to national security. The unusual directive, known as a CANFORGEN, was written last year by the country’s deputy top commander in response to a media story on financial uncertainty facing National Defence. The story was deemed to have contained “information that was not meant for wider or public consumption,” but the data had not been given the designation of either secret or protected. That prompted Vice-Admiral Bruce Donaldson, the vice-chief of defence staff, to instruct those handling information to give everything that passes over their desks – or is posted on the internal department system – a second glance with an eye to keeping it hidden. “Information that is not sensitive to the national interest, and therefore not classified, should also be examined to see if it is sensitive to other than the national interest, and therefore requires an appropriate designation of either Protected A, B, or C,” said the directive, obtained by The Canadian Press under the Access to Information Act. The directive goes beyond reviewing information to protect privacy. “Sensitivity to other than the national interest is not limited to information that is personally sensitive, but also includes, for example, information that is sensitive to the organization, administration, finances or other internal functioning of the department, its relationship to outside organizations, or other government business operations.” [Source]

CA – Commissioner Urges Public Institutions to Join Global Open Data Movement

Ontario’s Information and Privacy Commissioner, Dr. Ann Cavoukian, is calling on public institutions to take advantage of emerging technologies to make data available to the public, academics, researchers, and industry, for use in new and unanticipated ways. As long as personally identifiable information is protected from such disclosure, the open data movement bodes very well for introducing greater transparency to government institutions. The global movement towards Open Data makes vast amounts of machine-readable data freely available by way of portals, metadata, and search tools. It is one of the truest embodiments of Commissioner Cavoukian’s concept of Access by Design, by which public institutions proactively release information as part of an automatic process, fostering more transparency and accountability in government. [Source]

Genetics

US – Court to Examine Legality of Warrantless DNA Samples

The U.S. Supreme Court has decided to reexamine the constitutional privacy of an individual’s blood chemistry. In Missouri v. McNeely, the court will decide whether police can take a DNA sample from a criminal suspect without a judge’s approval, the report states. In Schmerber v. California in 1966, the court ruled that police could take a DNA sample without a warrant in an emergency case, such as drunk driving. In McNeely, the court will analyze that ruling after a police officer ordered a DNA sample from a drunk driving suspect, considering it an emergency as his blood-alcohol level would drop over time. [National Constitution Center] See also: [Do Patients Have A Right To Access Their Clinical Sequence Data? – Alison Hall, Senior Policy Adviser, PHG Foundation]

US – ACLU Asks Court to Stop DNA Collections on Felony Arrests

Through California’s DNA database of close to two million samples, more than 10,000 criminal suspects have been identified in the last five years. But the American Civil Liberties Union (ACLU) will argue to the Ninth U.S. Circuit Court of Appeals that the state’s genetic data collection efforts have become “unconstitutionally aggressive…at the expense of civil liberties,” the report states. California’s Proposition 69 allows police to take a DNA sample of every suspect arrested on felony charges. The ACLU says the practice “comes too early in the criminal justice process,” and samples should be taken only from those convicted. [The Washington Post]

Health / Medical

US – Medicare Bills Rise as Records Turn Electronic

“When the federal government began providing billions of dollars in incentives to push hospitals and physicians to use electronic medical and billing records, the goal was not only to improve efficiency and patient safety, but also to reduce health care costs. But, in reality, the move to electronic health records may be contributing to billions of dollars in higher costs for Medicare, private insurers and patients by making it easier for hospitals and physicians to bill more for their services, whether or not they provide additional care.” [New York Times]

Horror Stories

US – Breach Affects 100,000 IEEE Members

The user names and passwords of approximately 100,000 members of the Institute of Electrical and Electronics Engineers (IEEE) have been compromised in an apparent breach. The affected data was stored on an FTP server in unencrypted form. The IEEE has as many as 400,000 members worldwide, many of whom are security professionals. The incident was discovered by Romanian researcher Radu Dragusin. [Help Net Security] See also: [Health Agency Notifies 2,500 Clients of Breach]

CA – BC Health Ministry Fires Fifth Worker for Alleged Breach

A fifth employee of British Columbia’s Health Ministry has been fired over an alleged privacy breach. The worker had been one of three who had been suspended, but according to the report, the 30-year government employee in charge of data access, research and stewardship has now been released. BC Health Minister Margaret MacDiarmid has said the issues in the ongoing investigation relate to inappropriate conduct, data management and “contracting-out allegations,” the report states. “It’s been incredibly complex and it continues to be,” MacDiarmid added. [The Victoria Times Colonist] [NextGov] [Vancouver Sun] [Vancouver Sun] See also: [US: Former Howard University Hospital Employee Sentenced For Selling Personal Information About 40 Patients] and [Newfoundland’s Eastern Health says computer software will track privacy breaches]

US – Provider Settles HIPAA Case for $1.5 Million

Massachusetts Eye and Ear Infirmary and Massachusetts Eye and Ear Associates, Inc., (MEEI) has agreed to settle with the U.S. Department of Health and Human Services (HHS) for $1.5 million for potential violations of the HIPAA Security Rule. The HHS Office for Civil Rights conducted an investigation after MEEI reported that an unencrypted personal laptop containing sensitive health data was stolen. The investigation found MEEI “failed to take necessary steps to comply with certain requirements of the Security Rule.” In addition to the fine, MEEI will now review, revise and maintain policies and procedures to comply with the rule and will undergo independent compliance assessments for three years. Meanwhile, Lahey Clinic Hospital has alerted patients of a breach. [Source] See also: [UK: Stolen Laptop Contained Children’s Data] and [Hospital Employee Sentenced to Six Months for Selling Data]

US – AvMed Ruling May Open the Door for Liability Cases

The recent AvMed data breach case may open the door for plaintiffs to prove they are victims of identity theft as a result of a data breach. The 11th U.S. Circuit Court of Appeals ruled earlier this month that plaintiffs in Curry v. AvMed sufficiently alleged liability against the health plan provider for the data breach affecting 1.2 million customers that led to identity theft and financial losses for some. “When a company doesn’t live up to the obligation that it’s supposed to…that person has a cause of action for that money he paid toward the protection of his personal information,” said the lawyer representing the plaintiffs. [SC Magazine]

US – Report: Most Breaches Due to Employee Error

Forrester Research has found that most data breaches are caused by events such as employees losing or misusing corporate assets or having them stolen. In the survey of more than 7,000 executives and employees in North America and Europe, 31% said theft or loss was the cause of data breaches, and 39 percent said data leaks on mobile devices are a concern. “Whether their actions are intentional or unintentional, insiders cause their fair share of breaches,” the report’s authors said, adding it’s not only a matter of appropriate tools and controls; only 56% of respondents said they were aware of their organization’s security policies. [COMPUTERWORLD]

Identity Issues

U.S. – State Dept. Admits Passport Form Was Illegal, But Still Wants It Approved

“Early last year, the State Department proposed a new “Biographical Questionnaire” for passport applicants, which would have required anyone selected to receive the new long-form DS-5513 to answer bizarre and intrusive personal trivia questions about everything from whether you were circumcised (and if so, with what accompanying religious rituals) to the dates of all of your mother’s pre- and post-natal medical appointments, your parents’ addresses one year before you were born, every address at which you have ever resided, and your lifetime employment history including the names and phone numbers of each of your supervisors at every job you have ever held.” [Papers Please]

US – Court Rules in Favor of Plaintiffs’ ID Theft Case

The 11th Circuit Court has ruled in a 2-1 opinion that the plaintiffs in a class-action lawsuit sufficiently alleged liability against a health plan provider for a data breach involving identity theft. Two laptops containing unencrypted sensitive information— including Social Security numbers—on 1.2 million AvMed customers were stolen in 2009. In Curry v. AvMed, Inc., the plaintiffs said they carefully avoided sharing their sensitive information digitally but still became victims of identity theft and suffered financial losses. The ruling “gives crucial guidance to plaintiffs seeking damages for identity theft caused by a data breach and to defendants seeking to defend against such claims,” the report states. [Information Law Group] See Curry v. AvMed, Inc., No. 11-13694, 2012 WL 2012 WL 3833035, — F.3d —- (11th Cir. Sep. 5, 2012).

Intellectual Property

EU – French Government Levies First Piracy Fine

The French government has imposed its first fine under the country’s new anti-piracy law. Alain Prevost was fined 150 euros (US $197) for downloading two songs, even though his wife has admitted that she was the person who had downloaded the files. The fine was levied against Prevost because he paid for the Internet connection over which the songs were downloaded. After receiving two warnings about the downloaded songs from Hadopi, the agency that seeks out Internet copyright violators, Prevost terminated his ISP account. He and his wife are divorcing, and he had written to Hadopi, telling them to contact her about the downloaded songs. Their replies were sent to an email address that he no longer had access to. [BBC] See also: [Dutch Court Says Links to Photos Constitute Copyright Violation | Source]

Internet / WWW

WW – Project Founder: Data Subjects Should Take Some Profit

The founder of a large-scale data project says individuals should receive a portion of the profits companies generate by capturing their personal data. The Human Face of Big Data aims to create a digital snapshot of the human race, the report states, by using a smartphone app to ask 10 million people for personal details about their lives. “Big Data is a new asset class, and yet the ones creating it seem to have no say in the process,” founder Rick Smolan said. “Why is it everyone is making money off our browser history except us?” [The Sydney Morning Herald]

US – CSA Launches Big Data Working Group

The Cloud Security Alliance (CSA) has initiated a Big Data Working Group to develop best practices for privacy and security solutions, particularly in government, healthcare and e-commerce sectors. The CSA’s charter document notes “traditional security mechanisms, which are tailored to securing small-scale static—as opposed to streaming—data are inadequate” for Big Data. In addition to developing Big Data security and privacy best practices, the group aims to help industry and government adopt best practices; create coordination efforts between organizations to develop standards; speed up efforts to research privacy and security solutions, and draft research proposals for joint government and industry funding, the report states. [Integration Developer News]

WW – Tech Companies Form Lobbying Group Aimed at Protecting Internet Freedom

Several big technology companies have joined forces to form a lobbying group to protect Internet freedom. The Internet Association was founded in large part to counteract efforts by the Recording Industry Association of America (RIAA) and the Motion Picture Association of America (MPAA) to influence legislation; both the RIAA and the MPAA lobbied hard for the Stop Online Piracy Act (SOPA), and effort that was ultimately unsuccessful. The Internet Association counts Amazon, Google, and Facebook among its members. [WIRED]

WW – Last of the IPv4 Addresses to be Allocated in Europe

RIPE, the organization that gives out IP addresses in Europe, is down to its last batch of IPv4 addresses. Companies may only make one more request for these addresses, and if the request is granted, they will receive 1,024 IPv4 addresses. All applications must describe how the organization is implementing the new IPv6 address scheme. Until this final batch, RIPE was giving out about four million IPv4 addresses every 10 days. [v3] [RIPE.net] [BBC] [InfoWorld] See also: [Majority of US Government Agencies Will Not Meet IPv6 Deadline | Source]

Law Enforcement

CA – Police Checks Routinely Violate Privacy, Report Says

A new report by the Canadian Civil Liberties Association says many Canadians, especially in Alberta, are having their privacy rights violated because police are releasing non-criminal information in routine police checks. “The status quo is unacceptable,” the report concludes. “There is an urgent need for greater fairness and clarity in the police background check process.” In the past decade, more and more organizations across Canada are requiring police checks before hiring employees or accepting volunteers. In Alberta alone, the report estimates that police run about 160,000 background checks every year. The information released contained not only information about convictions, but also about charges or contact with police which were either withdrawn or did not involve criminal activity. This includes cases involving mental health issues or where individuals were merely contacted as witnesses to crimes. “Disclosing this kind of sensitive information may undermine the presumption of innocence,” the report says. “Employers who receive negative record checks may not fully understand the distinctions between different types of police information, creating significant risk that non-conviction records will be misconstrued as a clear indication of criminal conduct.” The 50-page report calls for standards that would prohibit the release of information other than convictions, except in rare circumstances. It also says non-conviction records should be reviewed regularly and destroyed where warranted. It also says individuals should have a right to be notified on the information in their file and be able to appeal it before an independent adjudicator. While there are laws governing the release of certain information, such as under the Privacy Act and the Youth Criminal Justice Act, the report says there are no set standards for what police services can or can’t collect and release in police checks. It calls the situation across Canada “a patchwork” of policies that may violate Canada’s Charter of Rights and Freedoms. The report says the problem is particularly acute in Alberta, where it says there is too much discretion is left to individuals in police services as to what information can and should be retained and released. The report points to Ontario as an example of good practices. There, the province’s Privacy Commissioner issued an Order regarding the handling of information collected by police. [Source] [Press Release] [Report: Presumption of Guilt? The Disclosure of Non-Conviction Records in Police Background Checks]

Mobile Privacy

US – Proposed Privacy Act Makes Mobile Tracking Harder

US lawmakers have introduced a new bill that will make it tougher for companies or anyone else to track mobile users without consent. The Mobile Device Privacy Act simply makes it illegal for companies to monitor device users without their express consent. The bill was introduced by Rep. Edward Markey (D-Mass.), who is co-chair of the Bi-Partisan Congressional Privacy Caucus. The legislation is a result of concern over last year’s Carrier IQ controversy, which centered on a piece of software that wireless operators installed on smartphones in order to help track network congestion and end-user quality problems, with an eye to improving service. The software, which Sprint and others quickly disabled after the flak started, was meant to be a diagnostic tool but has the capability to be used for ill: Android developer Trevor Eckhart posted a video showing how the software logs text messages, web searches and other activities without the mobile user’s knowledge or permission – promptly setting off big privacy alarm bells. “Consumers should know and have the choice to say no to software on their mobile devices that is transmitting their personal and sensitive information,” Markey said. “This legislation will provide greater transparency into the transmission of consumers’ personal information and empower consumers to say no to such transmission.” The law requires anyone performing data collection, even with consumers’ opt-in permission, to inform the US FTC and the FCC of their tracking activities. The agencies would be given enforcement power as well. Also, the legislation would require that any tracking software contained on the device at purchase or included in software updates be disclosed upfront, giving consumers the right to refuse tracking. This disclosure must include what types of information is collected, who it is transmitted to and how it will be used.[Source]

WW – Funding Among Reasons for App Security Breaches

A recent survey has found that the majority of companies questioned experienced at least one web application security incident since last year. In the Forrester study, which questioned 240 North American and EU companies, 18% reported a breach had cost their organization $500,000 or more and indicated the incident had a negative impact on their brand. Among the reasons for the security failures were an inability to secure additional funding for technology and processes, a lack of tools for application security and pressure to quickly deliver new products and services. SQL injection was the leading cause of breaches at organizations that had experienced five to 10 incidents since 2011. [Network World] See also: [Over half of Android devices have unpatched vulnerabilities, report says] and [McAfee: New malware is proliferating]

WW – PCI Council Issues Best Practice Guidance for Mobile Apps

The Payment Card Industry Security Standards Council (PCI SSC) has released best practice guidance for mobile app developers and device manufacturers. It said that the main focus of the guidelines is to provide direction on securing mobile device payment processes and the payment environment itself by educating developers in the emerging mobile app market. Key recommendations of the report include isolating sensitive functions and data in trusted environments, implementing secure coding best practices and eliminating unnecessary third-party access and privilege escalation. Developing ways to remotely disable payment functions, in addition to creating tools for mobile apps to monitor and report suspicious activity were also among the recommendations. The guidelines focus on ways to prevent account data from being intercepted while sent or received on mobile devices or from being compromised while being processed or stored on them. [Source] [Press Release] [Guidance: PCI Mobile Payment Acceptance Security Guidelines]

Offshore

UK – ICO Issues Outsourcing Guide for Small and Medium-Sized Businesses

Summary: Where a data processor is used to process data on the data controller’s behalf, the data controller must ensure that suitable security arrangements are in place to comply with the seventh data protection principle (the processor must provide sufficient guarantees in respect of the technical and organisational security measures, and the controller must take reasonable steps to ensure compliance with those measures); if the data processor is located outside the EEA, they must comply with the eighth data protection principle (organisations that transfer personal data to a data processor in a third country will remain subject to the ICO’s powers of enforcement, and continue to be responsible for protecting the data subjects in relation to the overseas processing of their personal data by the data processor). Model contract clauses offer adequate safeguards for the protection of the rights and freedoms for international transfers of data (the clauses are in a standard form which may not be amended, however they may be incorporated in their entirety into a data processing service agreement with an overseas data processor). Before using a non-EEA based data processor, an organisation should consider whether there is any particular legislation in place in the country or territory where the chosen processor is located which might adversely affect the rights of the data subjects whose data is to be transferred. [Source]

Online Privacy

CA – Commissioner: Websites Inappropriately Sharing Users’ Personal Information

A report by Canada’s Office of the Privacy Commissioner says some leading Canadian websites are inappropriately sharing users’ personal information with third parties. Privacy Commissioner Jennifer Stoddart investigated 25 shopping, travel and media sites and found information—including names, e-mail addresses and postal codes—was being collected without consent. Stoddart has written to 11 of the sites, seeking explanations on how changes will be made to comply with Canadian privacy law, the report states. “Our research serves as a wake-up call to all online services to ensure they are complying with Canadian law—and respecting the privacy rights of people who use their sites,” Stoddart said. [Canadian Press] See also: [Experts call for Privacy Commissioner to reveal data leaking Web sites]

US – FTC Supports W3C’s Do-Not-Track Guidelines

The Federal Trade Commission (FTC) says it supports the World Wide Web Consortium’s (W3C) efforts to develop voluntary guidelines for a do-not-track system. “The commission has repeatedly and forcefully called for industry—not government—to implement a do-not-track mechanism that would allow consumers to decide whether to have their online activity…collected,” said FTC Chairman Jon Leibowitz in a letter to Congress. Leibowitz was responding to an inquiry by nine Republican lawmakers on whether the FTC was “empowered to work with an international organization like the W3C,” the report states. Meanwhile, a Georgia man is currently working on an online registry with features similar to the W3C’s do-not-track. [MediaPost] [Do-Not-Track Talks Reach a Stalemate]

US –Policy Limits Hotmail Passwords to 16 Characters

It has recently been revealed that unbeknownst to most Hotmail users, their account passwords have been limited to 16 characters, regardless of whether or not they have chosen longer passwords. A security researcher recently received an error message when he typed in his 30-character Hotmail password; he had never before received the message, and was able to access his account by entering just the first 16 characters of the password. Kaspersky Lab’s Costin Raiu wrote that “To pull off this trick with older passwords, Microsoft has two choices: Store fill plaintext passwords in their [database and] compare the first 16 [characters] only, or calculate the hash only on the first 16 [and] ignore the rest. A Microsoft representative has acknowledged that “16 characters has been the limit for years now,” and noted that “uniqueness is more important than length.” [Source] [See also: [Mobile PCI Standards Released]

US – Twitter Gives Court Protester’s Posts

After months of fighting a subpoena, Twitter has given a U.S. judge the online posts of Occupy Wall Street protester Malcolm Harris. The tweets, which were handed over to Manhattan Criminal Court Judge Matthew Sciarrino, will remain under seal while a request for a stay by Harris is heard in a higher court, the report states. The Electronic Frontier Foundation (EFF) and the American Civil Liberties Union have filed an amicus brief supporting Twitter’s appeal. EFF’s Marcia Hofmann called it a “canary-in-a-coal-mine case,” adding “companies will look at this case and say it’s not a good idea to push back against governments we think are overreaching.” [Reuters] [Ars Technica] [CNET] [WIRED]

US – Google Adds Support for ‘Do Not Track’ Within Chrome

The development team behind Google Chrome has added the ‘Do Not Track’ privacy setting in the most recent Canary version of the Web browser. The privacy option will be available to all Chrome users before the end of the year after passing through the development and beta phases. While Google did agree to launch support for the ‘Do Not Track’ initiative earlier this year, the Chrome development team has been extremely slow in adding the feature to the browser. Alternatively, Mozilla added support for the feature in Firefox during early 2011 and Apple added the ‘Do Not Track’ privacy setting to Safari 6. In addition, Microsoft took the feature a step further and enabled the ‘Do Not Track’ function within Internet Explorer 10 without requiring the user to turn it on. [Source] [Source] [Source] [Source]

WW – Wikipedia Releases Search Data to Public But Pulls It After Privacy Concerns

Wikipedia announced they have decided to give away their search data to the public for free. Shortly after they announced this, they decided to “temporarily taken down this data to make additional improvements to the anonymization protocol related to the search queries.” [Source]

US – Confusion Over Facebook Wall Posts Leads to Privacy Scare

Facebook representatives have said recent reports that private messages were appearing on users’ timelines were false. According to Facebook, “A number of users raised concerns after what they mistakenly believed to be private messages appeared on their Timeline,” adding that an investigation revealed “that the messages were older wall posts that had always been visible on the users’ profile pages.” In response, France’s data protection authority—the CNIL—has been asked to investigate the issue. Meanwhile, the Electronic Privacy Information Center plans to ask the Federal Trade Commission to investigate the new Facebook-Datalogix deal and whether it contravenes a recent settlement. [The Wall Street Journal]

Other Jurisdictions

AU – Parliamentary Report Recommends Privacy Amendment Bill

A tabled parliamentary report recommends the House of Representatives pass the Privacy Amendment Bill 2012. The bill would clarify the role and strengthen the powers of the privacy commissioner, address credit reporting arrangements and protect personal information. According to a statement, “The committee has examined the bill to ensure that an appropriate balance between privacy protection and the convenient flow of data has been achieved.” Attorney-General Nicola Roxon said, “Both consumers and governments have a role to play to protect privacy,” adding, “In introducing these changes, the Gillard government is doing its bit to protect the privacy of Australian families.” [COMPUTERWORLD]

AU – Parliamentary Committee Endorses Fines for Breaches

A parliamentary committee has recommended passing a bill that would allow for fines of up to $1.1 million for severe or repeated privacy breaches. The suggested penalties were contained in a report tabled in the Lower House. A Senate committee is examining the bill as well and will report to Parliament this month. The bill responds to the Australian Law Reform Commission’s 2008 report, which aims to update privacy laws given technological advances. Privacy Commissioner Timothy Pilgrim says the fines would incentivize better data protection. Should the bill become law, the committee advises that the attorney general should conduct a review 12 months after implementation. [The Australian]

AU – Coalition Seeks ‘Softer’ Privacy Law

A spokesman for shadow attorney-general George Brandis said that Liberal senators would recommend softening parts of the bill around company liability for privacy breaches following a strong backlash from the industry, particularly the internet sector. If passed in their current form, the new laws would give the Federal Privacy Commissioner the ability to seek court ordered fines against companies and large organisations of up to $1.1m in cases of severe or repeated privacy breaches. Senator Brandis’s spokesman said the coalition would recommend changes to the laws that would limit company liability in cases where they can demonstrate that they’ve taken “all reasonable precautions” to prevent privacy breaches. The recommendations were only one of about half a dozen that the senators were expected to include in a parliamentary report expected to be tabled in the upper house yesterday following a short delay last week. The senators are also expected to make recommendations to make it easier for social networking companies to share information about their members with third parties and for all companies to transfer data about Australian customers. Federal Privacy Commissioner Timothy Pilgrim declined to comment for this report. [Source] SEE ALSO: [Office of the Australian Information Commissioner – Submission to the Parliamentary Joint Committee on Intelligence and Security on the Inquiry Into Potential Reforms of National Security Legislation] and [Australian Security Intelligence Organisation – Submission to the Parliamentary Joint Committee on Intelligence and Security on the Inquiry Into Potential Reforms of National Security Legislation [ Baker & McKenzie Review]

NZ – Commissioner Seeks Data Broker Enforcement Powers

New Zealand’s privacy commissioner is seeking additional powers to monitor companies that collect and sell personal data. Assistant Privacy Commissioner Blair Stewart has said the current version of the Privacy Act clears the way for enforcement only after a complaint is filed, but many citizens do not know of the existence of data brokers. The privacy commissioner has supported a Law Commission recommendation to update the law, giving the commissioner powers to serve compliance notices on organizations. Stewart said, “People don’t tend to complain about certain practices, if the sort of practices go on in the background and they can’t see what’s happening.” [Otago Daily Times] See also: [NZ Prime Minister Requests Inquiry Into Allegations of Unlawful Interception of Communications in Megaupload Case] and [Office of the Privacy Commissioner, New Zealand – Proposed Amendment No 7 to Credit Reporting Privacy Code 2004 – Information Paper] and [EU: Commission to decide on New Zealand’s adequacy in October]

Privacy (US)

US – Supreme Court to Hear Driver’s License Case

The U.S. Supreme Court will hear a case involving whether lawyers can legally obtain personal data gleaned from driver’s license records to recruit individuals for lawsuits. The appeal comes from three South Carolina residents who were solicited by lawyers to join a lawsuit against car dealers, the report states. The justices will determine whether the lawyers’ actions contravened federal privacy law pertaining to the protection of driver’s license records. The federal law does have a lawsuit exception. [Associated Press]

US – Apple Shareholders File Proposal on Privacy and Data Security

Investors in Apple Inc. have filed a shareholder proposal asking the company to publish a report explaining how its Board of Directors is overseeing privacy and data security risks. The proposal, which is intended for consideration by Apple shareholders at the company’s 2013 annual meeting, states that “Unauthorized collection, disclosure, or misuse of personal information can cause great harm to individuals and society – including discrimination, identity theft, financial loss, loss of business or employment opportunities, humiliation, reputational damage, questionable government surveillance or physical harm,” the proposal states. The shareholders assert that “Apple’s Board has a fiduciary and social responsibility to protect company assets which include the personal information of a variety of stakeholders.” In seeking a report, the shareholders state that “investors need to understand more fully how the Board is overseeing” concerns about privacy and data security. The shareholder proposal at Apple was developed in consultation with the Open Media and Information Companies Initiative – or Open MIC – a non-profit organization that works with shareholders and companies to foster more open and responsible media policies and practices. A copy of the Apple proposal is available here. [Source]

US – Exploring Privacy’s Top Thinkers and Practitioners

At the annual Privacy Law Scholars Conference held earlier this year, information privacy law scholars and other top thinkers met with practitioners from industry, advocacy and government to hash out privacy’s toughest and most pressing challenges. Law scholar Daniel Solove discusses the strong conduit that is forming between privacy scholarship and practice, and in three such examples, papers delving into Big Data, hiring discrimination in a Web 2.0 world and operationalizing Privacy by Design are explored. [IAPP Privacy Advisor]

US – Groups Ask FTC to Investigate Facebook Tracking Partnership

Facebook’s in-store tracking partnership with Datalogix aims to show advertisers whether their ads lead to sales. Facebook says the data collection doesn’t violate any FTC regulations because of an opt-out link on Datalogix’s website. The Electronic Privacy Information Center and the Center for Digital Democracy have asked the FTC to look into the partnership. Ryan Calo of the Center for Internet and Society says the opt-out link’s location isn’t best practices, and it’s unlikely that Facebook consulted the FTC before unveiling the initiative. “That opt-out option isn’t easy to find nor is it on the Facebook website,” he said. [The Atlantic Wire] [US – Facebook Now Knows What You’re Buying at Drug Stores]

US – Appeals Court Approves Facebook Beacon Settlement

In a split decision, a US federal appeals court has approved a US $9.5 million settlement in a class action lawsuit brought against Facebook over its Beacon program, which kept track of and posted information about what users purchased from Blockbuster, Overstock, and other sites. The lawsuit alleged that Beacon violated federal wiretap and video rental privacy laws. Under the terms of the settlement, Facebook admits to no wrongdoing, but does agree to put money in a so-called digital trust fund, which would provide grants to organizations studying online privacy issues. Some of those being represented by the lawsuit maintained that the award was too small and that Facebook should not have a seat on the board of the digital trust fund. In a separate case involving Facebook’s “Sponsored Stories” feature, a US District Court judge in San Francisco rejected a settlement that would have had Facebook pay US $10 million to charity and US $10 million to cover attorneys’ costs. He is the judge who approved the Beacon settlement. [Source] OTHER NEWS: [Privacy Advisor: FTC ramping up data privacy enforcement actions] and [FTC – In the Matter of Apogee One Enterprises – Complaint and Stipulated Final Judgement and Order] and [FCC – Enforcement Advisory – Political Campaigns And Promoters Are Reminded Of Restrictions On Autodialed and Prerecorded Calls

Security

US – Report: Mobile Device Theft Tops Risk List

A new report has revealed that the top healthcare privacy risk is the theft of mobile devices. Of the reported breach cases, 52% involved the theft of portable devices such as laptops, smartphones and tablets. Kaufman Rossin Director of Information Security and Compliance Jorge Rey—a co-author of the report—said there was a drop in reported breaches, indicating more organizations are complying with HIPAA, but the rise in mobile device theft “was concerning because physical security is usually your easiest area of risk to address.” [American Medical News] SEE ALSO: Analysis of Apple’s disk encryption program, FileVault 2, that first appeared in the Lion operating system. Short summary: they couldn’t break it. [Source]

UK – Body Scanners Removed by Manchester Airport

A UK airport is scrapping passenger body scanners after a three-year trial period ended without a decision from the European Commission. The airport will replace the body scanners with “privacy friendly” scanners. Manchester Airport Group Chief Operating Officer Andrew Harrison expressed frustration “that Brussels has allowed this successful trial to end,” adding, “Our security surveys and those run by the Department for Transport show passengers regularly rate their experience at Manchester as one of the best security processes in the UK, if not Europe. There’s no doubt that body scanners play a big part in these results.” [BBC News]

US – NIST Issues Risk Assessments Guidance

The National Institute of Standards and Technology has issued what could be characterized as the bible of risk assessment. Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments, provides direction for conducting risk assessments and amplifies the guidance found in SP 800-39: Managing Information Security Risk. Though SP 800-30 was written for federal information systems and organizations, its lessons can be applied to other organizations in and out of government. The new guidance document, issued Sept. 18, provides direction for carrying out each of the steps in the risk assessment process, such as preparing for the assessment, conducting the assessment, communicating the results of the assessment and maintaining the assessment. It also shows how risk assessments and other organizational risk management processes complement each other. [Source] [Full announcement on the CSRC News/Announcement page] [NIST Public Business Affairs Office media release] [SP 800-30 Revision 1] [CSRC Special Publications] S [Draft Special Publication 800-88 Revision 1, Guidelines for Media Sanitization is available for public comment]

AU – Privacy Commissioner: Citizens Concerned About Smart Meter Data

Australian Privacy Commissioner Timothy Pilgrim has said smart meter technology could threaten people’s privacy. “We are starting to see people voicing concern about the level of data that these meters can collect,” Pilgrim said. Customers with smart meters must consent to having their data shared with various third parties, the report states. Pilgrim said companies have an obligation to delete or de-identify personal information that is no longer necessary. An Origin Energy spokesman said its online energy-usage portal is fully compliant with Australian privacy legislation and that the company keeps personal data for tax and compliance purposes. [The Age]

US – Meeting Scheduled to Establish Voluntary Smart Grid Code of Conduct

In response to workshops on smart grid privacy, a task force will develop a voluntary code of conduct for utilities and third parties providing consumer energy use services. The White House released “Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Innovation for the Global Digital Economy,” in February. The blueprint contains an outline for a multi-stakeholder process to develop a voluntary code in order to promote consumer confidence. As such, an initial multi-stakeholder meeting will take place December 6 in Washington, DC, and aims to develop the process and a timeline as well as to establish priorities. [Smartgrid.gov]

WW – Risk Report Finds “Sharp Increase” in Browser Exploits

Results of the IBM X-Force 2012 Mid-Year Trend and Risk Report suggest “the landscape has seen a sharp increase in browser-related exploits…along with renewed concerns around social media password security and continued disparity in mobile devices and corporate bring-your-own-device (BYOD) programs.” The report notes an upward trend in vulnerabilities. “We’ve seen an increase in the number of sophisticated and targeted attacks,” said IBM’s Clinton McFadden, adding, “As long as these targets remain lucrative, the attacks will keep coming and in response, organizations should take proactive approaches to better protect their enterprises and data.” [InfoSecurity]

Surveillance

US – Rent-to-Own Laptops Secretly Photographed Users Having Sex, FTC Says

Seven rent-to-own companies and a software maker are settling charges with the FTC alleging they spied on consumers using rented computers. Without consumers’ knowledge or consent, the companies captured screenshots of confidential and personal information, logged keystrokes and in some cases took webcam pictures. The proposed settlement bans the companies from using monitoring software and from using deceptive methods to gather information about consumers. It also forbids the companies from using geolocation tracking without consumer notice and consent and from “providing others with the means to commit illegal acts,” among other provisions. [WIRED] [Settlement] [Commentary: Web Cam Spying Settlement Indicates Need for Stronger Privacy Laws] [FTC Wrist Slaps PC Rental Firms For Spying]

US – Report Indicates “Massive Spike” in Tracking

Documents indicate a jump in law enforcement is “real-time surveillance targeting social networks and e-mail providers 80% from 2010 to 2011.” The documents, obtained through a Freedom of Information Act suit by the American Civil Liberties Union (ACLU), also indicate “a massive spike in ‘non-content’ surveillance by federal law enforcement over the last two years, jumping 60 percent from 23,535 cases in 2009 to 37,616 in 2011.” The report suggests “police are using a 1986 law intended to tell police what phone numbers were dialed for far more invasive surveillance: monitoring of whom specific social network users communicate with, what Internet addresses they’re connecting from” and other interactions. [Source]

US – Survey: More Than a Third of Public Fears Police Use of Drones

More than a third of Americans worry their privacy will suffer if drones like those used to spy on U.S. enemies overseas become the latest police tool for tracking suspected criminals at home, according to an Associated Press-National Constitution Center poll. Congress has directed the Federal Aviation Administration to come up with safety regulations that will clear the way for routine domestic use of unmanned aircraft within the next three years. The government is under pressure from a wide range of interests to open U.S. skies to drones. But privacy advocates caution that drones equipped with powerful cameras, including the latest infrared cameras that can “see” through walls, listening devices and other information-gathering technology raise the specter of a surveillance society in which the activities of ordinary citizens are monitored and recorded by the authorities. Nearly half the public, 44%, supports allowing police forces inside the U.S. to use drones to assist police work, but a significant minority – 36% – say they “strongly oppose” or “somewhat oppose” police use of drones, according to a survey last month. When asked if they were concerned that police departments’ use of drones for surveillance might cause them to lose privacy, 35% of respondents said they were “extremely concerned” or “very concerned.” An almost identical share, 36%, said they were “not too concerned” or “not concerned at all.” [Associated Press]

US – GAO Report on Drones Cites Growing Privacy Concerns

A Government Accountability Office (GAO) report has said there are growing concerns about privacy and civil liberties as unmanned aircraft systems (UAS) are introduced to the public airspace. The GAO reported, “Concerns include the potential for increased amounts of government surveillance using technologies placed on UAS, the collection and use of such data and potential violations of constitutional Fourth Amendment protections against unreasonable search and seizure.” The GAO report also revealed that no federal agency “has been statutorily designated with specific responsibility to regulate privacy matters relating to UAS for the entire federal government.” [Security Management]

Telecom / TV

US – Tech Companies Form Alliance To Lobby Washington

Major Internet companies have formed a lobbying group to address regulatory and political issues in Washington, DC. Google, Yahoo, LinkedIn, Amazon, eBay and Facebook are among those comprising The Internet Association. The group will lobby on privacy and cybersecurity issues, among others. The group’s president said it’s the Internet’s “decentralized and open model that has unleashed unprecedented entrepreneurialism. Policymakers must understand that the preservation of that freedom is essential to the vitality of the Internet itself and the resulting economic prosperity.” [Reuters] SEE ALSO: [Commission nationale de l’informatique et des libertés, France – Connected TV: What Challenges for the Protection of Privacy?]

US Government Programs

US – New York to Expand Access to DMV Information by Law Enforcement Agencies

Governor Andrew M. Cuomo has announced a new data sharing initiative that will give law enforcement agencies greater and instantaneous access to information housed by the Department of Motor Vehicles (DMV) through a secure internet portal. This information includes photos of all 16 million New York State drivers and non-drivers, vehicle registrations, drivers’ lifetime driving histories, as well as real-time notifications of traffic violations and other changes to a driver’s record.[Source]

US – White House Draft of Executive Order on Cybersecurity “Close to Completion”

US Department of Homeland Security (DHS) Secretary Janet Napolitano says that the White House’s executive order on cybersecurity is “close to completion,” but added that to ensure the safety of US networks, lawmakers will have to pass cybersecurity legislation as well. There are issues that an executive order cannot address: it cannot provide liability protection as incentives for employing cybersecurity measures and it cannot change penalties for cybercrimes. The president has not yet reviewed the draft document. [NextGov] See also: [Senator Sends Letters to Fortune 500 CEOs Asking About Cybersecurity Efforts] and [State Dept. Legal Adviser Says Cyberattacks Subject to Int’l Laws of War] and [FERC Establishes Cybersecurity Office]

US Legislation

US – Groups Disagree on Proposed COPPA Changes

Privacy advocates are urging the Federal Trade Commission (FTC) to discard a proposal by the Walt Disney Company that would change how organizations meet COPPA obligations. The company wants the FTC to alter its definition of websites “directed at children” and has proposed a “family-friendly” classification. The Center for Digital Democracy has said “children’s privacy would receive much less protection as a result” of the changes. Meanwhile, in its comments to the FTC, the Interactive Advertising Bureau has said new behavioral advertising limits “would restrict children’s access to online resources by undermining the prevailing business model.” [NationalJournal]

US – Senator Introduces Bill Requiring Warrant for E-Mail History

After more than 25 years since the passage of the Electronic Communications Privacy Act (ECPA), Sen. Patrick Leahy is hoping to get the out-of-date privacy law up to speed by introducing a new bill in the Senate Judiciary Committee. The key component of this new bill is that law enforcement officials would no longer have the ease of freely being able to read people’s personal e-mail and online communication — they’d need a warrant first. As the law now stands, police are allowed to get individual’s private correspondence by simply asking e-mail providers for the person’s message history.[Source] See also: [US: Judge preserves privacy of climate scientist’s e-mails]

US – Bill Would Require Police to Obtain Warrants for E-mail, Location Data

A new bill would require police to acquire warrants before accessing U.S. citizens’ e-mail or tracking their cell phones. Introduced by Rep. Zoe Lofgren (D-CA), the bill would require a search warrant for law enforcement access to cloud data or location information, the report states. The bill is backed by Digital Due Process, which comprises companies including Amazon.com, Apple, Google, Twitter and Microsoft. It’s anticipated that the U.S. Justice Department will combat the effort; it has previously warned that such protocols would hinder “the government’s ability to obtain important information in investigations of serious crimes,” the report states. [CNET News]

US – CA Signs Two Social Media Privacy Bills Into Law

California Gov. Jerry Brown has signed two social media privacy bills, making it illegal for businesses and universities to ask for access to people’s social media and e-mail accounts. Brown said, “The Golden State is pioneering the social media revolution, and these laws will protect all Californians from unwarranted invasions of their personal social media accounts.” Assembly Bill 1844 prevents employers from requiring user names or passwords from employees or job applicants, and Senate Bill 1349 prevents public and private universities from requiring students to disclose their user names and passwords. [Mercury News]

US – Senate Panel Delays Privacy Law Rehash

The Senate Judiciary Committee will likely wait until after the presidential elections to overhaul the Video Privacy Protection Act and the Electronic Communications Privacy Act (ECPA). Judiciary Chairman Patrick Leahy (D-VT) said panel members told him “they want further discussion” of the reforms. Earlier this week, several law enforcement groups wrote the committee saying, “Any effort to revise ECPA should involve detailed and careful consideration of the consequences of proposed changes on the ability of law enforcement investigators to conduct their work efficiently and effectively on behalf of American citizens.” [NationalJournal] SEE ALSO: [ Connecticut’s new data-breach hotline goes live Oct. 1] and [New Jersey Senate, No. 1898 – An Act Prohibiting a Requirement to Provide Information to Access an Account on a Social Networking Website by an Employee – State of New Jersey 215th Legislature] and [Departing CA Senator Simitian Hopes Others Pick Up the Privacy Torch]

Workplace Privacy

US – Managing Risks in Implementing Bring Your Own Device Programs

Companies must deal with the following issues in the context of implementing a corporate bring your own device (“BYOD”) strategy – hardware and software standards (determine what the technical minimum requirements a device must meet in order to be released for productive use in the company’s IT-system environment), rights on ownership and licenses (in order to put the device into productive use, it is very likely that the company must dispose of all rights needed to use the device with the existing IT-system environment), access and control rights (for the purpose of having legal certainty, the company must establish clear rules to determine under what circumstances it may access the employees’ devices or monitor their use), transfer rights (the fact that company data resides on the device impacts the employees’ ability to transfer the device to third parties, e.g., in case of maintenance or repair), and data protection compliance (there must be a comprehensive data protection concept in place which spans reasonable technical and organization measures to protect confidentiality of the data, and provides adequate notification of the individuals whose data are processed). [Source: Matthias Scholz, Baker and McKenzie]

EU – EU Proposal Would Complicate Workplace Evidence Gathering

If the EU adopts its new data protection proposal, companies could have a difficult time conducting internal investigations that rely on collecting documents and e-mail from employees. EU regulations already make it difficult for lawyers to gather information—including data stored on company computers and servers, the report states. But the new proposal “eliminates the most convenient way of gathering evidence for U.S. legal compliance purposes,” said DLA Piper’s Jim Halpert. He added that under current law, lawyers can gather information if given voluntary employee consent. But under the EU’s proposal, that consent, “even if freely given,” would be deemed “invalid.” [Corporate Counsel]

US – California Governor OKs Web Privacy Bill

California Gov. Jerry Brown has signed privacy bills making it illegal for employers and colleges to demand ac-cess to social media accounts. Brown announced Thursday that he signed the bill that prohibits employers from demanding usernames and passwords from employees and job applicants. The companion bill makes it illegal for colleges and universities to demand social media user-names and passwords from students. [Source] See also: [US: Lawyer’s Facebook photo causes mistrial in Miami-Dade murder case] See also: [OIPC SK – Investigation Report F-2012-003 – Saskatchewan Workers’ Compensation Board] and [OIPC SK – Investigation Report F-2012-002 – Saskatchewan Workers’ Compensation Board] and [OIPC SK – Investigation Report F-2012-005 – Saskatchewan Worker’s Compensation Board]

 

+++

 

 

01-15 September 2012

 

Biometrics

US – FBI Begins Installation of $1 Billion Face Recognition System Across America

A move by the Federal Bureau of Investigation (FBI) to upgrade its biometric database has a number of privacy and civil liberties groups raising red flags over potential privacy intrusions. The Next Generation Identification program will update the FBI’s fingerprint database and will compile mugshots, DNA data, iris scans and voice recognition to help agents track down suspects. An FBI spokesman said the agency “is tentatively planning to host a meeting of federal law enforcement and national security agencies with privacy and civil liberties groups to discuss various aspects of federal government uses of facial recognition technology later this year.” Sen. Al Franken (D-MN) has expressed privacy concerns about the database. [CNET News] [Source]

US – Alabama First State to Scan Fingerprints of Prison Visitors

The Alabama Department of Corrections has enacted a first-in-the-nation policy requiring visitors at the state’s prisons to have their fingerprint scanned before they are allowed to enter the facilities. No other state prison system in the country has a similar requirement. The change, implemented in August, has its roots in the prison system getting a new computer program, said a spokesman for the Department of Corrections. The move is drawing some criticism. State Departments of Corrections routinely require that visitors be approved, and each visitor undergoes a criminal background check. However, the fingerprint requirement is “extreme” said David Fathi, director of the American Civil Liberties Union’s National Prison Project.” If showing a driver’s license is all that is required to get on an airplane that will fly you near the White House, it should be enough to get you inside a prison to visit someone,” he said. [Source]  

WW – Devices Capture Increasing Amounts of Intimate Data

A growing number of products are capable of monitoring intimate biological data—devices like wireless health monitors and, soon, “stretchable electronics” capable of measuring heart rate, brain activity, body temperature and hydration levels. One company will soon pilot a “Digital Health Feedback System” that will capture biometric data using microchips embedded in a pill and using stomach fluids to emit signals to an external sensor. The ways companies may use or share the data collected by such devices is yet to be seen. One company says customers will own the data but requires customers to grant it permission to use data for “product development and the cultivation of its data sets,” the report states. [The New York Times]

 

Canada

CA – Stop Collecting Health Numbers, SaskTel Told

Saskatchewan’s privacy commissioner says SaskTel should stop collecting health card numbers from its customers. Gary Dickson also wants the Crown-owned phone company to stop gathering social insurance numbers and other unique identifiers whenever possible. The recommendations were part of a 58-page report Dickson released this week. [Source] [Source]

CA – Ontario Trial Hinging on Cellphone Search Warrant Raises Privacy Concerns in B.C.

David Eby of the B.C. Civil Liberties Association is concerned about the outcome of a court case in Ontario ruling on whether police can search a suspect’s cellphone without a warrant. A cellphone was found on an Ontario man after he had been arrested on suspicion of armed robbery in July 2009. On the phone were images and text messages that were used against him in his trial. A warrant to examine the phone was only obtained after the police found evidence on the phone. The cellphone information was ruled admissible as evidence but that decision has gone to the Ontario Court of Appeal for a ruling on whether it was a violation of Charter of Rights and Freedoms. Police can search a bag or briefcase when they arrest someone. They need a warrant to get into your house or the trunk of your car. But a phone can carry a lot more vital information these days than a briefcase. “The issue that the courts are grappling with now is the realities of new technologies,” said Eby. He believes police should get a warrant before accessing all that information. [Source]  

CA – Growing Number of Stolen ID Cards Used to Obtain Passports: RCMP Report

Criminals are increasingly using stolen social insurance numbers and doctored birth certificates to obtain legitimate driver’s licences and passports, an internal RCMP report says. And by leveraging pilfered or forged identity markers into higher-value IDs, criminals can sidestep tough anti-counterfeiting features built into government-issued identity documents, including a pending upgrade of passports with biometric chips. “Identities are being overtaken, altered or created, facilitating a number of other crimes, including many variations of fraud, typically for financial gain or to conceal a true identity,” says the March 2011 report prepared by the RCMP’s criminal intelligence division. It points to a rising use of “breeder” documents — identity records such as social insurance numbers, birth or citizenship certificates — that are stolen, tampered with or falsified, then used to sign up for credit cards or valid forms of identity. The report suggests Ottawa’s recent move to stop issuing SIN cards, instead sending the information in a letter, may not hinder identity thieves who skim someone’s mail or pick through their garbage looking for the nine-digit number. The report says the failure of governments to cross-check the authenticity of personal documents used in applications allows fraudsters to stitch together a “synthetic” identity, often combining a stolen social insurance number or altered birth certificate with a made-up name and date of birth.That means a social insurance number can be successfully paired with an entirely different name on a government application form, since the two are not routinely checked for a match, it says. And online applications make it easier for criminals to avoid face-to-face interactions when committing identity fraud, the report notes. [Source]  

CA – Privacy Goes Missing With Alberta’s New Missing Persons Act: Critics

A new law that came into effect this month giving Alberta police easier access to personal records when investigating missing persons cases is being touted as a potential lifesaver by the provincial government. But critics say that however well-intentioned the Missing Persons Act is, it presents real dangers to privacy and, possibly, personal safety. The legislation, introduced more than a year ago, allows police in a missing person case to seek an order from a justice of the peace to search personal information, such as cellphone and computer records, employment, education and health files, closed circuit television records and financial histories. In emergency situations, police can also make a written demand for information without going to the courts. Justice Minister Jonathan Denis said Friday the law’s major impact is that police can now access information even if there is no reason to think a crime has been committed. Denis said the legislation is the first of its kind in Canada. But Liberal MLA Laurie Blakeman said she’s horrified by how much personal information the government is allowing police to collect under the law. [Source]  

CA – Commissioner Urges Orgs to Make Privacy Part of Their Corporate Culture

Ontario’s Information and Privacy Commissioner, Dr. Ann Cavoukian, says it is not enough for organizations to have a privacy policy in place – they must take steps on an ongoing basis to make sure it is reflected in every aspect of their operations. A new paper, released today by the Commissioner at a meeting of the Privacy Section of the Canadian Bar Association, provides a 7-step action plan on how to effectively execute an appropriate privacy policy and embed it in the concrete practices of an organization. Paper: A Policy is Not Enough: It Must be Reflected in Concrete Practices [Source: Office of the Information & Privacy Commissioner of Ontario]

 

Cloud Privacy 

HK – Cloud Security Alliance Presents Privacy Level Agreement Initiative

The Cloud Security Alliance (CSA) has announced the launch of launched a Privacy Level Agreement (PLA) Working Group in the EU and a partnership with the Hong Kong Applied Science and Technology Research Institute (ASTRI) to advance cloud computing security and build capabilities that will accelerate the development of the cloud ecosystem in Hong Kong. The PLA Working Group is comprised of independent privacy and data protection subject matter experts, privacy officers, and representatives from data protection authorities. The group will work to define compliance baselines for data protection legislation and establish best practices for defining a standard for communicating the level of privacy measures such as data protection and data security that it agrees to maintain while hosting third-party data. [Source]

 

E-Government 

CA – BC: Coquitlam Rejects Plan to Publish Voters’ Names

Coun. Terry O’Neill’s plan to improve voter turnout was flatly rejected at a council meeting in Coquitlam this week. Introduced in July, O’Neill’s motion sought to publicize the names of those who vote in a civic election, a move he hoped would improve “abysmally low” voter turnout in recent years. But the key stumbling block among his council colleagues was the issue of privacy, and the motion was defeated 8-1. O’Neill was the lone councillor to vote in favour of the motion. “No idea is perfect,” he said. “But I think this is a good idea and it’s a good start.” O’Neill got the idea after reading an Atlantic magazine article entitled, “The Ideas Report.” The report cited a U.S. study that suggests “people are more likely to follow social norms when their behaviour is observed by others” – in other words, if their names are published, they are more likely to vote. Under current provincial legislation, municipalities are mandated to produce voter lists for eight weeks after an election, a point O’Neill used to counter claims his motion would undermine privacy concerns. He also argued publishing the names of those who vote in local newspapers would instill a sense of pride, while also exerting pressure on those who choose not to vote. Coun. Selina Robinson, however, said that tactic encouraged a form of public shaming rather than public engagement. [Source]

 

Electronic Records

US – New Texas Privacy Law Adds More Hassle, Expense

Texas physicians and certain other professionals who use electronic health records must comply with a new state privacy law beginning this month that imposes more stringent requirements than HIPAA. HB300, an omnibus health information technology privacy and security bill, covers meaningful use of electronic health records, the physician quality and reporting system, e-prescribing, translator availability, drug plan authorizations, and increased documentation and certification requirements. The changes begin with a broadened definition of “covered entities,” to include almost anyone who handles protected health information. This may include business associates, healthcare payers, government units, schools, healthcare facilities, providers, researchers and physicians. Covered entities are allowed to transmit protected health information for treatment, payment, health plan operations and insurance functions, and patients must be informed — through prominently displayed notices in public areas — that this disclosure may occur for authorized purposes. Other uses will require patient authorization. Patient requests for their electronic health records must be fulfilled within 15 business days of a written query, just as physicians have been required to do for paper records under state law. Health care workers also face stricter training requirements regarding privacy issues, and penalties for violations will be ramped up significantly under the new law.[Source]  

US – ONC Shelves Voluntary “Rules of the Road” Draft Regs

The Office of the National Coordinator (ONC) for Health Information Technology has stepped away from plans to set voluntary “rules of the road” for health information exchanges—including guidelines for privacy and security. In a blog post about the shelving of a Nationwide Health Information Exchange Governance Rule, ONC head Farzad Mostashari wrote, “Based on what we heard and our analysis of alternatives, we’ve decided not to continue with the formal rulemaking process at this time and instead implement an approach that provides a means for defining and implementing nationwide trusted exchange with higher agility, and lower likelihood of regret.” [GovInfoSecurity]

 

Encryption 

UK – UK Limits Spyware That May Have Targeted Dissidents

The British government has imposed export controls on U.K.-based Gamma Group’s FinSpy surveillance tool, which can remotely take over computers and phones, following reports that the systems may have been used to target political dissidents. The U.K. Secretary of State for Business Innovation and Skills informed the company that existing export restrictions apply to FinSpy, requiring Gamma to obtain a license to sell the system outside the European Union, according to an Aug. 8 letter the government sent to lawyers for London-based Privacy International, which is pressing for such restrictions. [Source]

 

EU Developments

US – Privacy, Consumer Groups Back EU’s Proposed Privacy Rules

22 U.S. privacy and consumer groups have voiced support for a tough online privacy proposal being considered by the European Union, even though some U.S. businesses and government officials have described the proposal as too regulatory. The proposal “provides important new protections for the privacy and security of consumers,” the groups wrote in a letter sent to members of the European Parliament. “We believe that the promotion of stronger privacy standards in Europe will benefit consumers around the globe, as businesses improve their privacy practices and security standards.” The privacy and consumer groups, including Consumers Union, Privacy Rights Now, the Electronic Privacy Information Center and Public Citizen, called for the E.U. to strengthen the privacy protections in the proposal. The E.U. should limit the number of compliance exceptions in the proposed General Data Protection Regulation, promote greater transparency in data practices and strengthen the public’s right to data portability, the groups said. The proposal should also limit the scope of information online businesses can collect through “legitimate interests,” the groups said. [Source]

EU – Privacy Czar: Civil Rights at Stake in Asylum Database Proposal

European Commission proposals that would give the police access to a new EU-wide fingerprint database for asylum seekers – Eurodac – is a “serious intrusion” into the rights of a vulnerable group, the European Data Protection Supervisor (EDPS) says. The EDPS said that under Commission proposals, law enforcement authorities would have access to Eurodac data. While the EDPS understands that the availability of a database with fingerprints could be a useful additional tool in combating crime, EDPS views the Commission’s amendment “a serious intrusion into the rights of a vulnerable group of people in need of protection.” The EDPS said the access might not be really necessary. “Just because the data has already been collected, it should not be used for another purpose which may have a far-reaching negative impact on the lives of individuals,” said EDPS supervisor Peter Hustinx. “To intrude upon the privacy of individuals and risk stigmatising them requires strong justification and the Commission has simply not provided sufficient reason why asylum seekers should be singled out for such treatment,” he added. [Source]

UK – ICO: Cookie Compliance Deadline Set for Some

Information Commissioner’s Office (ICO) Group Manager for Business and Industry Dave Evans said Businesses should now “know they have to respond to the law,” said Evans. The comments come after one web software firm taunted the ICO about cookie compliance. For noncompliant businesses, Evans said, “It might be a law they wish didn’t exist, but the simple fact is that it is here to stay,” adding, “for example, some sites have failed to engage with us at all, and they’re now being set a deadline to take steps towards compliance, with formal enforcement action likely if they fail to meet this deadline.” [Out-law.com] [Privacy watchdog to issue massive fines for cookie law breaches]

UK – Web Software Firm Taunts UK Data Regulator Over Cookies

A software firm has challenged the UK’s Information Commissioner’s Office to punish it over its use of web cookies. Derby-based Silktide said it created http://nocookielaw.com to highlight the “ineffective” rules put in place in May to clamp down on websites using “tracking” cookies which log user data. The site says: “Dear ICO, sue us. Send in a team of balaclava-clad ninjas in black hawk helicopters to tickle us to death with feather dusters.” The ICO has defended its role. “We welcome any opportunity to help us draw attention to this matter, as a key part of our work in ensuring compliance with the cookie law has been making businesses aware of the regulations,” a spokesman said. [Source]

UK – Parliamentary Committee Hears Evidence on Proposed Framework

The UK Parliament’s Justice Select Committee has held its first evidence session on the EU’s proposed data protection framework. The Association of Chief Police Officers, the Federation of Small Businesses and the Information Commissioner’s Office were among those who provided their opinions. While many said the regulation brings welcome changes, “the overwhelming response was to criticize the overly-engineered text” of both the regulation and the Data Protection Directive, the report states, and a key “tension in the regulation exists between the drive toward harmonization and the consequent prescriptive practices and procedures that the commission’s version of harmonization requires.” [Source]

UK – British Funeral Director Puts QR Codes on Grave Stones

Visitors to graveyards in the UK may soon be able to learn much more about the people buried there, with the introduction of quick response (QR) codes on headstones. Chester Pearce in Poole is the first funeral director to offer families the option of interactive gravestones with embedded QR codes. The £300 QR codes are etched on to small granite or metal squares before being embedded or glued on to the gravestones. When scanned using a smartphone or tablet, the code launches a personalised web page dedicated to the deceased, complete with pictures, videos and contributions from family and friends. The QR codes can also be put on memorials and tribute plaques on benches. [Source]

EU – Working Party Releases Meeting Agenda

The Article 29 Working Party has released a draft agenda ahead of its next meeting. The meeting will take place September 25 and 26 in Brussels. It will discuss “the draft application form and cooperation procedure for Binding Corporate Rules (BCR) for processors,” the draft opinion on purpose limitation and “developments on the draft data protection regulation and directive.” [Source]

EU – Uruguay Declared Adequate by EU

The European Union has confirmed that Uruguay has achieved adequacy for personal data protection, according to the website of the nation’s data protection authority. “It is a recognition to the work of the regulatory unit and control of personal data,” the website states, “and a confidence in Uruguay as a country capable of assuming the challenge of taking care of the adequate controls that are required in the use and treatment of the personal data that has been provided.” [Source]

 

Facts & Stats

US – 94 Million Records Affected by Government Breaches, Sheriff Announces Breach

The government sector reported 268 incidents of data breaches from January 2009 to May 2012, reports Help Net Security. The breaches exposed a combined total of more than 94 million records. According to research by Rapid7, the number of PII records exposed from 2010 to 2011 increased by almost 170 percent. The leading causes of such losses were unintended disclosure, loss and theft of portable devices, physical loss and hacking, the report states. Meanwhile, a Maine sheriff’s office is warning approximately 180 people who were recently arrested to monitor their personal accounts after their Social Security numbers were inadvertently made public last week for “a fairly limited period of time.” [Help Net Security] 

WW – Data Breaches are Down but Hackers Are More Selective: Symantec

The latest data breach figures from Symantec present a ‘good news, bad news’ scenario. Symantec’s August 2012 Intelligence Report compares the number of breaches for the first eight months of this year with the same period of 2011. There were an average of 14 data breaches per month so far in 2012, down from 16.5 from January to August of 2011. And the average number of identities stolen during those incidents was cut in half from 2011 to 2012 during the months of January to August. Sounds like good news. But the bad news is that, as Symantec cautions, hackers may just be getting smarter and more strategic. And although hackers are still to blame for most of the breaches (40%) the rest of us can bear some responsibility too: 21% of breaches result from data being made public accidentally and 19% are due to theft or loss. [Source]

 

Finance

CH – Banks to Notify Employees of Data Transfers

In the wake of concerns surrounding the transfer of bank data to other countries, Swiss banks have agreed to inform employees before data is sent to foreign tax investigators. Data Protection Commissioner Hanspeter Thür said five banks have “signed on to notify employees after Thür threatened to ask the Federal Administrative Court to force banks to protect employee data,” the report states, noting Thür met with bank officials to promote “a transparent process for employees” and that he has “doubts data handovers to the U.S. are legal.” [World Radio Switzerland]

AR – Argentina Government Tracking All Credit Card Purchases

The Argentina government has begun mandating banks to report credit card purchases to national tax authorities and is adding a 15% surcharge on purchases made outside the country using Argentinian bank-issued credit cards,. The changes are an effort to combat tax evasion and close off ways for people to convert pesos to U.S. dollars at the official rate—which is lower than the black market rate. The author states this is an example of how a “cashless society… has actually advanced the cause of financial repression,” adding, they are “important lessons in why a cashless society should not strip everyone of their transactional and financial privacy.” [Forbes] 

US – Bank Fraud Ringleader Sentenced

The leader of a bank fraud and identity theft scheme in Pennsylvania that targeted top-tier financial institutions and their customers has been sentenced to more than eight years in prison for his crimes. Although that sentence is steeper than in many similar ID theft cases, one legal expert says the case merited an even harsher sentence. [Source]

 

Health / Medical 

CA – Manitoba Ombudsman Wants Tougher Penalties for Snooping by Health Workers

Manitoba’s acting ombudsman says penalties for nosiness should be strengthened now that technology is making it easier for health-care workers to snoop into the private information of patients they have a grudge against. “In the old days, three people had access to your record — your doctor, his or her nurse and his or her receptionist. Now, you can have thousands of people with access to your records,” Mel Holley said. Holley has concluded an investigation into a case last year in which a worker at CancerCare Manitoba, the province’s prime centre for cancer treatment, got into the electronic patient files of a neighbour’s child who was undergoing treatment. The worker, whom Holley did not identify, did not need to see the child’s file for any work-related purpose, but did so because of a personal conflict with the youngster’s mother. [Source]

 

Horror Stories 

US – App Company Admits to Being the Source of Apple UDID leak

A Florida-based app publishing company called BlueToad has claimed it was the source of the Apple UDID leak, contradicting claims from Anonymous that it hacked them from an FBI laptop. Speaking to NBC News, BlueToad CEO Paul DeHart said data released by Anonymous closely matched data held on one of the company’s databases. DeHart believes Blue Toad was hacked several weeks ago. He apologised to those whose data was stolen, adding that an investigation is underway into the exact circumstances. Earlier this month Anonymous leaked one million UDIDs out of about 12 million it claimed to posses. It said it had hacked the data from a laptop belonging to an FBI agent as it wanted to publicly expose the monitoring and tracking by US government agencies such as the FBI. However the FBI was quick to deny it was the source of the data, saying in a statement that it could find, “no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data.” Apple also denied handing over the information to the FBI. It is also phasing out the use of UDIDs, partly. There has been no response yet from the usual Twitter accounts connected to Anonymous. However one thing is clear: the dates do not match up. Anonymous said the information was hacked back in March but BlueToad believes its data breach occurred within the last two weeks. DeHart admitted that it is possible the data had been shared by whoever stolen it from BlueToad and found its way onto an FBI laptop. Web pages have been set up to check whether IDs have been compromised and Apple users can look up an UDID using a confidential partial search at http://pastehtml.com/udid [Source] [FBI Disputes Claims of Hackers’ Apple Data Breach] [Alleged FBI Hack: Much Ado about Nothing?] [Hacker group claims FBI tracking Apple users] 

US – Officials Alert Patients: Breached Data May Have Been Sold

University of Miami officials are warning patients affected by a July breach that two university employees may have sold their data. The employees accessed information including names, dates of birth, insurance policy numbers, partial Social Security numbers and some clinical information. In some cases, Social Security numbers may have been viewed in full. The university is providing two years of identity protection services, the report states. “We continue to review and refine our physical and electronic safeguards to enhance protection of all patient data,” university officials wrote in a letter. [Healthcare IT News] [Miami hospital data breach due to employee offense] 

CA – B.C. Health Ministry Suspends Workers Over Privacy Breach

Seven employees have been suspended without pay from the B.C. Ministry of Health over allegations of inappropriate access to medical information. The employees in question worked in the area of research and evidence development, which awards drug research contracts on behalf of the ministry. Government has also terminated agreements with two research contractors until after the investigation is complete. It is believed both government workers and research contractors had inappropriate access to health data. It is not clear what information, if any, has been compromised. Both the RCMP and B.C.’s Office of the Information and Privacy Commissioner have been notified about the allegations. [Source] See also: [NL: Eastern Health announces more privacy breaches] Update: [BC: McInnes: Alleged data breach a body blow to health research expansion] and [Alaska’s Health and Social Services CSO Offers Lessons Learned from a Breach] 

US – Judge Consolidates Four Breach Class Actions

A U.S. District Court Judge yesterday consolidated four proposed class-action lawsuits against LinkedIn Corp. The suits were filed in California’s Northern District in response to a June security breach and claimed $5 million in damages after hackers stole 6.5 million user passwords from the site and posted them online, the report states. The suits claim that although LinkedIn’s privacy policy says it will protect user data with “industry standards and technology,” the company used “a weak encryption format that failed to comply with basic industry standards…without implementing other crucial security measures.” [The Recorder] 

US – Judge Throws Out Consumer Complaint

A federal judge has dismissed a consumer lawsuit against 17 tech companies. U.S. District Court Judge Sam Sparks found the consumers’ written complaint is “too unwieldy” for the lawsuit to proceed, the report states. The suit was filed against the tech companies for allegedly collecting or storing users’ address books without their consent, the report states. Complaints are required to make allegations in a “short and plain statement.” Sparks said the consumers’ complaint was not “written with an eye toward this court’s busy docket” and is instead aimed at the “court of public opinion.” The consumers have until September 12 to amend the complaint. [MediaPost]

 

Identity Issues 

CA – Tighter Air Security Rules Leads To New Canadian Passports With Electronic Chip

Starting next spring, Canadian passports will be valid for up to 10 years. But it will also feature a new electronic chip on which vast amounts of data can be stored. Not that it will, insists Passport Canada. But it could – including personal commercial information like cars you’ve rented, hotel reservations made or your frequent flyer programs. Eleven years after 9/11, the new passport is part of a global tightening of air travel security that is the subject of a three-day conference starting this week at Montreal’s International Civil Aviation Organization (ICAO). [Source]

WW – Research Paper Reexamines Reidentification

Columbia University’s Daniel Barth-Jones has released a paper reexamining Latanya Sweeney’s 1997 analysis of reidentification vulnerabilities. With a “profound impact on the development of de-identification provisions” within HIPAA, Sweeney’s study has been “frequently cited as an example” of the “astonishing ease” with which medical data can be reidentified. According to Barth-Jones, this reexamination “exposes an important systemic barrier to accurate reidentification known as ‘the myth of the perfect population register.’” The author provides “recommendations for enhancements to existing HIPAA de-identification policy” and commentary on “balancing the competing goals of protection patient privacy and preserving the accuracy of scientific research and statistical analyses conducted with de-identified data.” [Source] 

US – University Decides Sex Tracking Smartphone App May Not Be Such a Great Idea

Earlier this summer, researchers from Indiana University and the Kinsey Institute launched the ultimate app for the TMI crowd: the Kinsey Reporter, which “crowdsources sexual behavior.” It works how you would expect it to work. The app acts as a digital Dr. Alfred Kinsey — the pioneering sex researcher, a.k.a. Liam Neeson — for those willing to spill their sexual secrets, asking them for reports on their flirting, kissing, cuddling, self-loving time, fetishes, use of birth control, and all other aspects of body-rubbing activity. The app managed to attract a national pool of willing guinea pigs in just over three months time, judging from this recent report: The researchers’ pitch was to share your sexy times for science to allow them to get better insight into “issues that have been challenging to study until now.” (Thanks to those pesky Peeping Tom laws.) The app assured users that all reports would be anonymous, tied solely to the participants’ geolocation, which would be tagged when they uploaded their reports. Then it would be used for research and to generate nifty reports. Though originally released in May, the app got media attention just this week after the university issued a press release. Those reports, of course, involved the word “creepy.” A few hours after the release was issued, the University’s general counsel got wind of the app’s existence, apparently for the first time, and made the decision to disable the Kinsey Reporter app and an accompanying website for further study after concerns were voiced concerns about potential privacy issues and data protection. [Source]

 

Intellectual Property 

US – Federal Appeals Court Restores Initial US $222,000 Verdict in Filesharing Case

The 8th US Circuit Court of Appeals in Missouri has reinstated the original verdict against Jammie Thomas-Rasset, the Minnesota woman who since 2006 has been challenging an illegal file-sharing lawsuit brought by the Recording Industry Association of America (RIAA). Thomas-Rasset was initially ordered to pay US $222,000 for illegally downloading and sharing 24 songs through Kazaa. The RIAA says it found more than 1,700 songs on Thomas-Rasset’s computer but for the court case, it focused on just 24. After the first trial, the judge declared a mistrial after he decided that he had given the jury inaccurate instructions. The subsequent trial also found Thomas-Rasset guilty and the jury gave a verdict of US $1.92 million, which the judge reduced to UD $54,000.  The companies went to third trial on damages, which awarded the RIAA US $1.5 million, but that was reduced to US $54,000 as well. The appeals court ruled that the US $222,000 verdict should stand. Thomas-Rasset’s lawyer says his client plans to appeal to the US Supreme Court. The RIAA no longer pursues action against individual file-sharers; instead, it is focused on working with service providers to help identify and punish those who persist in illegal downloading. [WIRED] [Ars Technica] [BBC] [Opinion]

 

Law Enforcement 

WW – Infrared-Camera Algorithm Could Scan for Drunks in Public

Computer scientists have published a paper detailing how two algorithms could be used in conjunction with thermal imaging to scan for inebriated people in public places. The paper, published in the International Journal of Electronic Security and Digital Forensics, details two different algorithms that focus on data gathered from a subject’s face — alcohol causes blood-vessel dilation at the skin’s surface, so by using this principle as a starting point the two began to compare data gathered from thermal-imaging scans. One algorithm compares a database of these facial scans of drunk and sober individuals against pixel values from different sites on a subject’s face. A similar method has been used in the past to detect infections, such as SARS, at airports — though a study carried out at the time of the 2003 outbreak warned, “although the use of infrared instruments to measure body surface temperatures has many advantages, there are human, environmental, and equipment variables that can affect the accuracy of collected data.” A second algorithm is used to map out the different areas of the face. The pair found that, when inebriated, an individual’s nose tends to become warmer while their forehead remains far cooler. To use this information against the database with the first algorithm, a second algorithm was necessary to identify and differentiate between features. The system could, the paper argues, be used to avoid embarrassing and unfounded reproaches by police officers and officials, who generally make assumptions based on behaviour and appearances alone. [Source] See also: [New Mexico: Eddy County Sheriff’s office uses tech to fight child porn]

 

Location 

US – Feds: No Constitutional Protections for Location Data

Wired reports on court arguments made by the Obama administration claiming there is “no expectation of privacy” in cellphone location data, meaning law enforcement should not need to obtain a warrant to track a suspect’s movements. Citing a 1976 Supreme Court case, the administration said data such as bank records gleaned from cellphone providers are “third-party records.” The arguments come as the government prepares for a retrial in the United States v. Jones case. The administration’s court filing states, “When a cellphone user transmits a signal to a cell tower for his call to be connected, he thereby assumes the risk that the cellphone provider will create its own internal record.” [Source]

US – FTC Issues Guidance to Promote Secure Mobile Apps

The Federal Trade Commission has just published a guide to help mobile application developers observe truth-in-advertising and basic privacy principles when marketing new mobile apps. The FTC’s new publication, Marketing Your Mobile App: Get It Right from the Start, notes that there are eight general guidelines that all app developers should consider. The FTIC guidelines are:

1. Tell the truth about what the app can do.
2. Disclose key information clearly and conspicuously..
3. Build privacy considerations in from the start.
4. Offer choices that are easy to find and easy to use.
5. Honor privacy promises.
6. Protect children’s privacy.
7. Collect sensitive information only with consent.
8. Keep user data secure. .

Berger says the FTC has no plans to ask Congress to give it more authority to deal specifically with mobile-app privacy matters, but is asking lawmakers to enact legislation to require businesses to assure the online privacy of consumers through its privacy framework. [Source]

Mobile Privacy 

US – Mobile Users Avoid, Uninstall Apps Over Privacy Concerns: Pew Report

About six in 10 mobile phone users said they have decided against downloading certain apps over privacy concerns, a new survey finds. And in many cases, they have uninstalled apps that collected too much personal information about them. According to the survey on mobile privacy released this month by the Pew Internet & American Life Project, users made those decisions when they learned how much personal information they would share by using the apps. The findings, in a survey of 2,254 adults, show that “many cell phone users take steps to manage, control or protect the personal data on their mobile devices,” according to the report’s authors. Among the findings:

—  88% of adults said they own some sort of a mobile phone, and 43% of that group downloaded applications to their phone. That’s up from 31% in 2011.

— 30% of smartphone owners said they turned off their phone’s location tracking feature because they were worried about people or companies accessing this information. That compares with just 7% for those with regular, basic cellphones.

— 41% of all cellphone owners said they backed up data on their phone, such as photos or contacts.

— Men were more likely than women to delete an app because of privacy concerns. But there was no gender difference among people who decided not to install apps in the first place due to privacy concerns.

— Those with BlackBerrys were the most likely to say they’ve lost their phone or had it stolen: 45% compared with 30% of iPhone owners and 36% of Android owners. In all, nearly one-third of all mobile phone owners said they have had their phone lost or stolen.

— People who have had their phone lost or stolen were no more likely to back up the information on their phones afterward. . [Source] 

US – Smartphone Apps Track Users Even When Shut Down

Some smartphone apps collect and transmit sensitive information stored on a phone, including location, contacts, and Web browsing histories, even when the apps are not being used by the phone’s owner, according to two researchers at the Massachusetts Institute of Technology. The popular game Angry Birds uses the phone’s GPS and Wi-Fi wireless networking features to track the owner’s location, even when he’s not playing the game, for example. Another game, Bowman, collects information from the phone’s Internet browser, including what websites the owner has been visiting. And WhatsApp, a popular text-messaging program, scans the user’s address book when it is seemingly idle. What is not known is whether apps that run on Apple Inc.’s iPhone and iPad tablet computer collect information in similar ways. The researchers only tested 36 apps written for the Android operating system, which is “open source” software. There are logical reasons for some apps to collect such data, researchers said. Rovio Entertainment Ltd., the maker of Angry Birds, makes money from the free version of the game by displaying ads on the screen. It uses location data from the phone to point players to local advertisers. But researchers questioned the need to keep tracking user locations even when the game is shut down. And there is no apparent reason a video game like Bowman needs to know about the player’s Web-surfing habits. The developers of Angry Birds and Bowman did not respond to requests for comment. WhatsApp cited its privacy policy, which says its app scans address books for phone numbers only to see if any of the user’s friends are also WhatsApp users. According to the policy statement, WhatsApp does not copy names, addresses, or e-mail­ addresses from the phone’s address book. The researchers have applied for a patent on their research, which they hope to turn into a rating system to help consumers quickly understand privacy policies for thousands of apps. They used the results of their tests to calculate an “intrusiveness score” for each app, rating the amounts of personal data it collects while in use and when idle. But they can test only a handful of the more than half a million Android apps, so they hope to develop a separate app that would “crowdsource” the process. Owners of Android phones could install the app, use it to test other apps, then publish the results on a website. Consumers could check an app’s intrusiveness score before deciding whether to install it. [Source]  

US – NTIA Cancels Mobile App Privacy Meeting to Allow for Fact Gathering

The National Telecommunications and Information Administration (NTIA) has cancelled its September 19 stakeholder meeting to allow stakeholders to meet with app developers for informal briefings first. One such briefing will occur September 19. At the NTIA’s August 29 meeting, the second of a series of three, participants said they needed more information on the mobile app sphere before making decisions. As a result, such briefings have been scheduled for September 13, 14, 19 and 28. The NTIA meetings aim to establish a code of conduct framework, called for under the Obama administration’s Privacy Bill of Rights. [Broadcasting & Cable reports] 

US – Justice Dept. Says Counterterrorism Apps Pose Privacy and Security Concerns

The US Department of Justice (DOJ) is discouraging people from reporting suspicious activity through smartphone apps due to privacy concerns. Normally, information about potential threats reported by citizens is sent to regional analysis centers. Some of those centers are now allowing the reports to come to them through iPhone, iPad and other mobile device apps. The WVa app was introduced in February. The devices have the advantage of sending location information and pictures quickly, but there is concern that the apps could be misused and that they might flood emergency centers with unverified information. [NextGov] [WV]

 

Offshore 

WW – Study Says Data Privacy #1 Obstacle in Multinational Probes

Data privacy is the biggest challenge for lawyers and accountants conducting multinational investigations or cross-border litigation, according to a study released this month. The study found that 54% of those questioned said that data privacy was the greatest obstacle when handling these types of investigations or engagements. The study, published by business advisory firm FTI Consulting Inc., surveyed 114 legal and accounting professionals who have handled e-discovery matters for either multinational investigations or cross-border litigation. Respondents also said that multinational investigations were costly enterprises with 48% reporting they had spent more than $500,000 on such matters, and, most thought things would only get tougher with 76% predicting an increase in data privacy requirements in the coming years. [The Wall Street Journal]  

CY – Cayman Islands: Proposed New Privacy Law Open for Comment

The Cayman public now has two months to examine and review critical draft legislation regulating the collection and use of personal data by all businesses, organisations and government entities. The new bill also deals with the individual right of people to access their own personal information and have more control over how it is used. The draft Data Protection Bill 2012 aims to provide legal protection of individual rights without being overly-bureaucratic, officials said this week, as the long awaited proposed law was published for public review. David Archbold, of the Information and Communications Technology Authority, said the bill will have tangible benefits for the Cayman Islands and be an effective tool to advance the right to privacy. “The scope of the draft Bill is quite broad, with exemptions in the public interest or for the protection of other rights and freedoms,” government officials said. The 69 page draft Data Protection Bill 2012 and the accompanying consultation papers are available at http://www.dataprotection.ky [Source]

Online Privacy

WW – Apache Web Software Overrides IE10 Do-Not-Track Setting

Apache has announced it will override Microsoft’s default do-not-track (DNT) setting. One of the authors of the DNT standard, Roy Fielding, wrote a patch for Apache that will disable Microsoft’s DNT setting. As a result, web servers using Apache software—the most commonly used software to house websites—will ignore IE10 DNT settings, the report states. Fielding said, “The only reason DNT exists is to express a non-default option,” adding, “It does not protect anyone’s privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization.” [CNET News] [PCMag] [Microsoft: DNT Default Not an Antidote to Advertising]

WW – Study: File Sharers Heavily Monitored

A study conducted by researchers at the University of Birmingham in the UK reveals that nearly all files shared via torrent sites are monitored by large Internet service companies that are possibly acting on behalf of copyright enforcers. In their study, the researchers noticed that IP addresses of file sharers were being tracked by several monitors acting as file sharers, the report states. One of the researchers said, “In the EU, there are quite strong data protection laws, and people who store personal data have to fulfill a lot of criteria, and this could definitely be looked on as personal data about the people being monitored.” [CBC News] 

US – Big Data: Which Websites Respect Your Privacy Rights the Least?

One lawyer’s has published analysis of how 25 major websites handle customer data. Andrew Nichol’s ClickWrapped.com evaluates sites on four categories, including how user data is used and when it can be disclosed. The evaluations are based on a 100-point scale, and points can be gained based on whether the site’s policy is consumer-friendly. [TIME]  

US – Judge: Twitter Must Produce Posts or Face Fines

A judge has ruled that Twitter must disclose an Occupy Wall Street protester’s tweets or face a fine. New York State Supreme Court Judge Matthew A. Sciarrino Jr. has said the company must either turn over the posts or provide its earning statements from the previous two quarters so the judge can assess a fine. “I can’t put Twitter or the little blue bird in jail, so the only way to punish is monetarily,” Sciarrino said. In an exclusive for The Privacy Advisor, Mathew Schwartz asks, “Can service providers be held liable for what their users post, tweet or upload, including what others may deem to be offensive communications?” [Bloomberg]

 

Other Jurisdictions 

AU – Data Retention Laws Risky, Canberra told

The government was warned early this year that proposed new data retention laws would put Australians at higher risk of privacy breaches. The controversial proposal, which could see internet companies store up to two years’ worth of data on subscribers and users, is part of a package of legislative changes to overhaul the telecommunications interceptions regime currently before a joint parliamentary intelligence and security committee. It has come to light that last December privacy consultants Information Integrity Solutions (IIS) advised Attorney-General cola Roxon that some internet companies subject to the new laws may not have the capability to adequately protect the data. Some may also struggle to understand their obligations to protect it under the proposed laws, it warned. In a report obtained under Freedom of Information, IIS advised the government to limit the data retention period to a maximum of six months in order to mitigate the risk of privacy breaches. Under the current proposal before the committee, the legislation anticipates retaining the data for up to two years. [Source] See also: [Ukraine: New Liability For Company Officials]                                   

SA – Personal Information Bill Referred Back to Parliament

The Protection of Personal Information Bill has been referred back to Parliament for a second reading and further debate. A portfolio committee on justice and constitutional development ruled unanimously in favor of the bill, which would provide a regulatory framework for the ways in which personal data may be processed. The bill is “expected to have a significant impact on the manner in which private and public bodies process personal or identifying information as it aims to protect the free flow of information” and information access while protecting privacy, the report states. One expert advised organizations to look at the bill’s various requirements and consider steps toward compliance. [Business Report]  

IS – Israeli Court Upholds DPA’s Authority to Issue Market Instructions

In a detailed, 27-page decision (Admin. App. 24867-02-11 IDI Insurance v. Database Registrar), the Tel Aviv District Court recently upheld the validity of an instruction issued by the data protection regulator restricting financial institutions from using information about a third party’s attachment of their client’s account for the financial institution’s own purposes. The court held that the regulator is authorized to issue market instructions interpreting the law. The decision is likely to have far-reaching effects on the validity and weight given to a series of detailed guidance documents and market instructions published by the Israeli Law, Information and Technology Authority (“ILITA”) over the past two years. These include instructions regarding:

•  outsourcing data processing operations;
• requirements for user authentication when providing remote access to personal data;
• employee screening and employment recruitment agencies; and
• allocation of responsibility for databases between health insurers and primary health care providers

In addition, ILITA issued a draft instruction concerning the collection of data from minors; draft guidance concerning privacy in the workplace; and, perhaps most importantly, draft data security regulations which are intended to replace the currently applicable regulations that date back to 1986 (the Privacy Protection Regulations (Conditions for Data Storage and Security and Public Sector Data Sharing), 1986).

 

Privacy (US) 

US – FTC Finalizes Myspace Settlement

The Federal Trade Commission (FTC) has finalized a settlement reached in May with Myspace. The settlement requires the company to develop a data privacy program and undergo privacy audits for two decades, the report states. The FTC found that Myspace violated its privacy policy by sharing users’ personal information with third parties without first obtaining their consent. [The Hill] 

US – Next President, Congress Face Privacy Challenges: Report

Among the top technology hurdles facing the next U.S. president and Congress is consumer privacy, according to a new report. With the FTC constrained in its regulatory power and given the nation’s “patchwork of inconsistent, sector-specific laws protecting certain categories of sensitive data…the opportunity for abuse of consumer privacy is growing every day,” the report states. Advances in technology including the increasing use of facial recognition, license plate scanners and drones all present privacy challenges. In the meantime, “Congress has been dragging its feet on a baseline consumer privacy law for over a decade.” [ABC News] 

US – Domestic Surveillance During Divorce Results In Federal Privacy Lawsuits

Dan Horn reports on a case of domestic surveillance that is noteworthy for the issues it raises. If you have a right to install surveillance systems – including audio recording and monitoring online activity – in your own home and on your own devices, what rights do your spouse and visitors to your home have with respect to their privacy? Although a Cincinnati couple’s divorce is finalized, the surveillance uncovered during their divorce proceedings resulted in two federal court lawsuits involving friends and relatives, the husband’s defense attorney, and a company that manufactures the computer monitoring software. One of those suing is a man whose e-mail communications with the wife were recorded without his knowledge or consent. [Source]  

US – Obama Nominates Joshua Wright to FTC

President Obama yesterday announced the nomination of George Mason University School of Law Prof. Joshua Right to the Federal Trade Commission (FTC). If confirmed, Wright will replace Commissioner J. Thomas Rosch. Wright served as the scholar-in-residence at the FTC’s Bureau of Competition from 2007 to 2008. Wright’s academic work has focused on antitrust law, economics, consumer protection, intellectual property and contracts, the report states. The post will now require Senate confirmation. [The Hill]

 

Privacy Enhancing Technologies (PETs) 

WW – Cloudnymous Launches Cloud-Based Privacy Cloak

Startup Cloudnymous has launched a new cloud-based anonymous VPN service which lets users access any restricted or censored website. As customer data is spread evenly across the cloud, even if a server is brought down, customer data cannot easily be retrieved. The cloud-based VPN service offers “true” anonymity and protection of the user’s data through strong encryption protocols, according to the firm — and may be of particular interest to those trying to circumvent location-based restrictions online. “Cloudnymous is perfect for U.S. visitors who want to watch Hulu or listen Pandora overseas, to Asian users wanting to open public sites restricted by local laws and simply for those who want to keep privacy while surfing the Internet”, said the company. The service is based on a ‘pay per use’ system. There are no contracts; instead, users can pay $0.15 for daily paid servers, $4.95 for monthly paid servers and $0.15 per GB for traffic paid servers. Users can choose the point where the traffic “originates” from — for example, an American or European address, which would in theory circumvent blocks on services including Facebook, Skype and Pandora. According to Cloudnymous, the only logs kept on traffic flow are connection start and end times, and the amount of traffic. Names or addresses are not required to sign up — and all website, VPN traffic and internal communication is encrypted. [Source]

 

Security

UK – GCHQ Chooses Top 20 Security Controls for Businesses

The UK’s GCHQ is introducing a new program to help British businesses protect their computer systems from attacks. The program is called Cyber Security for Business and was launched on Wednesday, September 5. This marks the first time that intelligence services in the UK will be working directly with private sector organizations to help better their cybersecurity stance. GCHQ has created a guide titled Top 20 Critical Controls for Effective Cyber Defence, which is aimed at helping organizations reduce the risk of cyberthreats and prevent or deter most attacks. GCHQ director Iain Lobban says the approach will “make the bad guys’ job harder and won’t cost a fortune.” [v3] [Telegraph] [The Independent] [The Register] [SCMagazine] 

WW – Cyber Security Budgets Grow While IT Budgets Stagnate

Security budgets appear to be comparatively safeguarded, growing 8% to $60 billion in 2012, reaching $86bn by 2016.  At the same time IT budgets are relatively flat, according to Gartner. [SecurityWeek] [The Register]

 

Smart Cards 

UK – Researchers Find Flaw in Chip-and-PIN

Researchers at Cambridge University say that criminals have been exploiting certain flaws in the chip-and-pin system meant to prevent payment card fraud at ATMs and point-of-sale terminals. Chip-and-PIN, also known as EMV, relies in an embedded chip that encodes card information; payment cards are authenticated by ATMs or payment devices computing several pieces of data, including an “unpredictable number.” But the researchers have found that certain ATMs and payment terminals use incremental numbers rather than random ones. The research was prompted by a rash of reported thefts from European bank card users; the banks refused to refund their losses because they maintained that EMV made the type of fraud they were talking about impossible. The researchers suspected that the thieves had devised a way to predict the “unpredictable” numbers. [Krebs] [Research Paper]

 

Surveillance

US – Gov’t Report Questions How Privacy Applies to Drones

A report released by the Congressional Research Service last week questions government use of drones for surveillance. The Federal Aviation Administration anticipates 30,000 commercial and government drones flying U.S. skies within the next 20 years. The Supreme Court has ruled police may gather surveillance by flying planes and helicopters over homes because the areas are in public view. But the researchers say courts could decide drones are more privacy invasive; their ability to hover and remain in the air longer “may sway a court’s determination of whether certain types of warrantless drone surveillance are compatible with the Fourth Amendment,” the report states. Several lawmakers have introduced drone bills. [The Hill] [CRS Report: Drones in Domestic Surveillance Operations: Fourth Amendment Implications and Legislative Responses] [Congress report warns: drones will track faces from the sky]

 

US Government Programs 

White House Circulating Draft Cybersecurity Executive Order

A draft executive order on cybersecurity is being circulated by the Obama administration. The draft has been sent to various federal agencies for feedback and would formulate a voluntary system for firms operating critical infrastructure to adhere to government-backed cybersecurity best practices and standards, the report states. The executive order builds off part of Sen. Joe Lieberman’s (I-CT) cybersecurity legislation from earlier this year. According to the report, the order is also subject to change, and it is not yet clear if it will get final approval from the president. [The Hill] [White House draft cyber order promotes voluntary critical infrastructure protections] 

US – ‘Zombies Are Coming!’ U.S. Homeland Security Department Warns

Tongue firmly in cheek, the government urged citizens to prepare for a zombie apocalypse, part of a public health campaign to encourage better preparation for genuine disasters and emergencies. The theory: If you’re prepared for a zombie attack, the same preparations will help you during a hurricane, pandemic, earthquake or terrorist attack. The federal Centers for Disease Control and Prevention last year first launched a zombie apocalypse social media campaign for the same purposes. Among the government’s recommendations were having an emergency evacuation plan and a change of clothes, plus keeping on hand fresh water, extra medications and emergency flashlights. A few suggestions tracked closely with some of the 33 rules for dealing with zombies popularized in the 2009 movie Zombieland, which included “always carry a change of underwear” and “when in doubt, know your way out.” [Source]

 

US Legislation

US – House Approves Reauthorization of FISA Amendments Act

The US House of Representatives has voted to reauthorize the 2008 FISA Amendments Act, a law that “allows a secret national security court to approve the interception of communications in and out of the US among groups of people of interest to intelligence agencies.” While the law requires that any data collected “incidentally” are subject to rules that hides the individual’s identity and limits the use of the information, one congressman observed, “the enforcement of this provision is itself shrouded in secrecy, making the potential for abuse substantial and any remedy unlikely.” And Cato Institute analyst Julian Sanchez notes that the breadth of power that FISA allows is similar to the “general warrants” used by agents of the crown in the colonial era, prompting the adoption of the Fourth Amendment rights against unlawful search and seizure. The bill now goes to the Senate. [Washington Post] [WIRED] [Ars Technica] [NextGov] [The Washington Post]  

US – Markey Introduces Mobile Device Privacy Act

A new bill has been proposed by Rep. Ed Markey (D-MA) to “require mobile phone makers, network providers and application developers to disclose to customers any monitoring software installed on their mobile devices.” The Mobile Device Privacy Act, which Markey introduced this week, would also require permission from customers before their mobile devices could be monitored. “Apps very commonly access our sensitive information—our location, our photos, web browsing, history. Apps often do this without prior notice and even when the app isn’t actively being used,” Markey said, adding reports of such tracking have created a “significant societal issue that has to be discussed.” Software and technology groups, meanwhile, are saying legislation is not the answer, the report states. [IDG News] 

US – Senate Judiciary Geared to Revamp ECPA, VPPA

The Senate Judiciary Committee has said it will work on an update of the Video Privacy Protection Act and attach provisions to amend portions of the Electronic Communications Privacy Act. Judiciary Committee Chairman Patrick Leahy (D-VT) said in a statement, “When Congress first enacted these laws almost three decades ago, e-mail was still a novelty and most Americans viewed movies at home on VHS tapes rented at their local video store,” adding, “The explosion of cloud computing, social networking sites, video streaming and other new technologies in the years since require that Congress take action to bring our privacy laws into the digital age.” [NationalJournal]

US – FTC Extends Comment Deadline for COPPA Reforms

The Federal Trade Commission has extended to Sept. 24 the deadline to comment on proposed modifications to the Children’s Online Privacy Protection Rule, which gives parents control over what information Web sites and online services may collect from children under 12. Go to: https://ftcpublic comments

 

Workplace Privacy

IS – Draft Guidance Issued on Personal Data Protection in the Workplace

The data protection authority in Israel (ILITA) has provided draft guidance on privacy in the workplace (April 2012). Summary: Employers’ increasing collection of employee personal information throughout employment requires the application of information privacy principles in the workplace; informed consent, specified purpose, proportionality, transparency, purpose limitation, confidentiality and security, obligations related to outsourcing, and access and correction. [Source] 

US – Plaintiff Has to Turn Over Emotional Social Media Content In Employment Lawsuit

“Plaintiff sued her former employer for discrimination and emotional distress. In discovery, defendant employer sought from plaintiff all of her social media content that revealed her “emotion, feeling, or mental state,” or related to “events that could be reasonably expected to produce a significant emotion, feeling, or mental state.”“ The case is Robinson v. Jones Lang LaSalle Americas, Inc., 2012 WL 3763545 (D.Or. August 29, 2012), and the outcome is no surprise at this point. If you make a claim in court, expect the defendant’s lawyers to seek your social media content in discovery. Read more on InternetCases [Source]

 

+++

 

21-31 August 2012

Electronic Records

AU – OAIC Seeks Public Comment on PCEHR Enforcement

The Office of the Australian Information Commissioner (OAIC) is seeking public comment on how it should enforce personally controlled electronic health record (PCEHR) privacy regulations. Together with a set of enforcement guidelines, the OAIC has released a consultation paper. The guidelines detail the OAIC’s enforcement and investigative powers under the PCEHR and Privacy Acts and outline the penalties, enforceable undertakings and injunctions that can be applied in breach cases, the report states. The OAIC is asking if the draft guidelines are acceptable and provide enough clarity. The deadline for public comment is September 18. [ZDNet]

US – Hackers Claim File Containing iOS Device IDs is Evidence of FBI Tracking Project

Hackers have posted a document to Pastebin that they claim contains unique identification codes for one million iOS devices that were obtained when the laptop of an FBI agent was compromised earlier this year. The attackers claim to have obtained a file that contains Unique Device Identifiers (UDIDs), usernames, and push notification tokens for 12 million devices. They also claim that the file contains some names and associated mobile phone numbers. The attackers are suggesting that the presence of such a document indicates that the FBI may be tracking iOS devices. [ZDNet] [The Register]

Encryption

WW – Report Calculates Costs Savings from Use of Full Disk Encryption

“Is full disk encryption (FDE) worth it? A recent study conducted by the Ponemon Institute shows that the expected benefits of FDE exceed cost by a factor ranging from 4 to 20, based on a reduction in the probability that data will be compromised as the result of the loss or theft of a digital device. ‘After doing all of the math, Ponemon found that the cost of FDE on laptop and desktop computers in the U.S. per year was $235, while the cost savings from reduced data breach exposure was $4,650.’” [Source] [Source]

EU Developments

UK – ICO Defends Cookie Compliance Initiatives

The Information Commissioner’s Office (ICO) has defended its record against claims it has not investigated cookie compliance failures. An earlier report stated the ICO received 320 violation claims without investigating one. The ICO said the report was “dramatically wide of the mark,” adding, “So far, 45 (websites) have been analyzed, of which 27 have clearly taken action to increase the visibility of the information about cookies.” The ICO also said, “A progress update, including a list of all the websites contacted, will be published on our website in November…” [SC Magazine]

UK – Retailers Could Be Forced to Release Customer Data

UK ministers have announced they may require supermarkets and online retailers “to release sensitive personal data they hold about customers.” Companies could be required by law “to provide electronic copies of ‘historic transaction data’ when individuals request it,” the report states, which would mean shoppers receive “records of their purchases and spending habits.” While consumers currently have the right to request such information under the Data Protection Act, “the details are rarely in electronic form, and the process is awkward and slow,” the report states, noting, “The new rules would make access far quicker and easier.” [London Evening Standard]

Google

US – Advocacy Group Challenges FTC Settlements

Nonprofit advocacy group Consumer Watchdog “is dialing up its criticism of the proposed privacy settlement between the FTC and Google,” filing a motion in U.S. District Court seeking friend-of-the-court status and a hearing. Consumer Watchdog questioned the proposed $22.5 million settlement when it was first announced because it allows Google to deny “any violation of the FTC order, any and all liability for the claims set forth in the complaint and all material allegations of the complaint save for those regarding jurisdiction and venue,” the report states. [IDG]

US – Consumer Group, Resort Challenge FTC Settlement

The U.S. District Court of Northern California has granted Consumer Watchdog the right to challenge the legal logic behind the proposed FTC settlement with Google. The advocacy group has questioned how the FTC can charge a company with a violation while also allowing no admission of guilt. A Google representative noted, “We are confident there is no basis for this challenge,” while a Consumer Watchdog spokesman said, “The settlement is particularly the start of a very slippery slope,” adding, “It’s very important the FTC get called on this.” Meanwhile, Wyndham Hotel & Resorts LLC is challenging the FTC’s allegations that it failed to adequately secure consumer data. [POLITICO]

WW – Google to Set up Privacy Red Team

In what appears to be a response to recent high profile privacy issues involving Google and some of its services, the company is in the process of setting up a Privacy Red Team. In a job post for the role of a Data Privacy Engineer Google says the purpose of the team will be to “independently identify, research, and help resolve potential privacy risks across all of our products, services, and business processes in place today”. Google has come under fire in a number of jurisdictions for how it has infringed on the privacy of its users. Recently Google was ordered by the US Federal Trade Commission to pay a $22.5 million fine for having misrepresented to users of Apple’s Safari Internet browser that it would not place tracking “cookies” or serve targeted ads. While in Europe Google has come under fire from various Data Protection agencies for not deleting Wi-Fi data it gathered as part of its StreetView program from unsecured wireless networks. A ThreatPost report states the move by Google “to look critically at engineering and other decisions in the company’s products and services that could involve user privacy risks is perhaps a unique one.”[ZDNet] [The Register] [Net-Security] [PCMag] [InformationWeek] see also: [Why the FTC May Investigate Google and What to Do If It Happens] see also: [Paying Lip Service to Privacy: Attorney Details Steps for Organizations to Fill Privacy Gaps]

Health / Medical

US – Network Exposure and Healthcare Privacy Breaches

Under Federal law requiring disclosure, the HHS reports on data breaches of over 500 records. Since 2009 HHS has documented 435 PHI breaches impacting 20,066,249 individual records. Why are healthcare systems vulnerable to patient privacy breaches? A key vulnerability is system complexity. EHR systems store patient electronic health records and transported data insider healthcare organizations and between healthcare business units and in and out of HIEs. These systems are big and complex. In addition, the HIE and EHR IT vendors are highly fragmented, competing in typical American free market economy fashion with no vendor-neutral standards for patient privacy enforcement. Lack of vendor neutral standards leads to the implementation of proprietary interfaces between systems for electronic healthcare data transfer and exchange. Every interface developed by a healthcare systems integrator is potential attacker entry point. Risks are compounded by:

• High porousness of the healthcare enterprise network: A porous healthcare provider network invites attackers in and trusted insiders to take good stuff out using pen drives, tablets, DropBox and Gmail.
• Low level of ethics of top executives: Executives should be taking leadership positions in security and HIPAA compliance as an example to the rest of the employees and as proof that they believe that good security is key to protecting customers. When a top executive doesn’t let internal risk management guidelines get in the way of his personal goals, it sets the stage for additional fraud at lower echelons and fosters an environment where it’s OK to take company documents, just as long as you don’t get caught.
• Minimal network monitoring: Organizations with minimal network monitoring are living a life of ignorance that is bliss. If there is a porous network and lack of security and compliance leadership, then even if there is a fraud event, violation of company policy in regards to fraud, online gambling or sexual harassment in the workplace; it will not be detected. Security and fraud violations that are not detected cannot be used for corrective action and future deterrence. [Source]

US – ONC to Revise Model Privacy Notice for PHRs

The Office of the National Coordinator for Health IT is calling for comments and recommendations to inform its revision of the model privacy notice for personal health records. The current model privacy notice is applicable through September 30, the report states. FierceEMR

US – HIMSS Issues Recommendations for “Medical Banking”

The Health Information and Management Systems Society has issued a set of recommendations to guide financial institutions managing revenue for healthcare organizations. Released as a whitepaper , the guidelines aim to help financial institutions involved in “medical banking” to comply with HITECH’s added security and privacy requirements. Recommendations include selecting a privacy officer, updating workforce training and considering data privacy and security accreditation or certification by an independent third party. The paper states, “As customers of financial institutions, healthcare providers and payers need assurances that financial institutions can safeguard protected health information with appropriate technology systems, infrastructure and procedures for risk management and incident management.” [Source]

US – EHR Stage 2 Final Rules Call for Encryption

This week saw the release of the two final rules for Stage 2 of the HITECH Act’s electronic health record (EHR) incentive program. The Department of Health and Human Services rules, which address meaningful use and software certification, are scheduled to be published in the Federal Register on September 4. The meaningful use rule includes requirements for risk assessment analysis addressing encryption of data stored in certified EHR technology, while the software certification rule requires EHR software “be designed to encrypt, by default, electronic health information stored locally on end-user devices,” the report states. A recent whitepaper, meanwhile, cautions against securing personal health information on portable devices. [GovInfoSecurity] [Meaningful Use Rule] [Software Certification Rule]

US – Experts “Mostly Pleased” with HITECH Stage 2 Provisions

Privacy and security experts are “mostly pleased” with the provisions included in Stage 2 of the HITECH electronic health record (EHR) incentive program. One provision requires EHR software be designed to encrypt medical records stored on devices by default, which Rebecca Herold says “will ultimately improve protection of patient information.” Two other provisions—receiving mixed reviews from the experts—include a risk assessment rule mandating security updates, but not specifically encryption, and a patient access rule requiring that five percent of discharged patients access their EHRs within a specified time period—down from 10% in the proposed rule. [Source]

Horror Stories

UK – Data Breaches in UK up More than Tenfold in Five Years

The UK Information Commissioner’s Office (ICO) says that over the past five years, data security breaches in the UK have increased more than 1,000 percent. The figure is slightly higher for local government breaches, and slightly lower for National Health Service (NHS) breaches. The dramatic increase may be attributable in part to organizations reporting more breaches than they have in the past because of increased awareness and legal requirements to keep personal data safe. Telecommunications is the only sector that showed a decline in the number of breaches reported over the given period of time. [BBC] [v3.co.uk]

AU – Cyber Thieves Steal Half a Million Australian Credit Card Numbers

A cyberattack has resulted in the theft of 500,000 credit card numbers in Australia. The incident occurred at an unnamed business in Australia and appears to be the work of hackers located in Eastern Europe. They allegedly placed keystroke loggers on point-of-sale (POS) terminals and remotely downloaded the information. The unnamed company was using default passwords on the POS terminals and stored transaction data unsecured. The thieves appear to have used an unsecured Microsoft Remote Desktop Protocol (RDP) to harvest the data. The people behind the attack are believed to be the same ones that conducted a similar attack in the US on Subway sandwich restaurants. Police are investigating the incident. [WIRED] See also: [Class-Action Filed Against Eastern Health] and [When Cybercrime Isn’t Treated as a Crime: Why Not Report Credit-Card Account Theft to Local Cops?]

US – Thumb Drive Prompts Notifications, Feds Arrest Former ER Worker

A cancer center in Texas is notifying 2,200 patients that a missing thumb drive contained their personal details. CMIO reports that it’s the third breach this year for the University of Texas MD Anderson Cancer Center in Houston. Meanwhile, federal officials have arrested a Florida man for selling the medical records of patients of Florida hospitals. Dale Munroe, who worked in the emergency room at Florida Hospital Celebration before he was fired last year, is accused of accessing and selling the records of more than 700,000 patients, according to the report. [Source]

US – Hackers Publish Stolen Data; Breaches Hit Two Orgs

A hacker collective calling itself Team GhostShell has allegedly accessed and published one million records taken from banks, government agencies and other firms and is warning of further leaks. A security expert said it is “a pretty significant breach.” In a separate incident, a Cancer Care Group laptop containing personal information of approximately 55,000 individuals was stolen from an employee in July. Meanwhile, the University of Rhode Island has disabled a server after it was discovered that the personal information of more than 1,000 faculty and staff was publicly available. [CNET News]

UK – UK Information Commissioner Investigating Tesco Website Security

The UK Information Commissioner’s Office (ICO) is investigating Tesco for alleged inadequate security practices. The retail company allegedly stores its website login and password data unhashed and unsalted. Some of the site’s pages do not use HTTPS, and the company emails users’ passwords in plaintext. Some have noted that it is unusual for the ICO to become involved when a breach has not occurred. [SCMagazine] [BBC] [ComputerWeekly]

Identity Issues

WW – Dropbox Implements Two-Factor Authentication

Dropbox has implemented two-factor authentication for Windows, Mac, and Linux users. Earlier this summer, the company said it would take steps to better protect customers’ data after hackers managed to hijack an employee’s account, access some customer email addresses, and send them spam advertising gambling sites. Dropbox attributed the attack to an employee who used the same password for his work account as for another account elsewhere, which had been compromised earlier. Dropbox will now provide users with one-time security codes, either sent to their phones in a text message, or generated with a mobile authenticator app. Users say the plan still has some problems that need to be worked out. [Krebs] [InformationWeek] [The Register] See also: [Do authenticaton questions really protect you?]

Law Enforcement

US – License Plates Scanned at Border, Data Shared With Car Insurance Group

As public scrutiny continues to mount against the use of license plate readers (LPRs) across the country, the Electronic Privacy Information Center (EPIC) has now released government documents showing that such data, which includes precise GPS location, date, and timestamps, in addition to the plate in question, are shared with an auto insurance umbrella organization. The documents, published this week as the result of a Freedom of Information Act (FOIA) request, include a six-page memorandum of understanding (MOU) from 2005 between the National Insurance Crime Bureau (NICB) and the United States Customs and Border Protection (CBP) agency. The NICB is a nonprofit organization funded by hundreds of American auto insurance corporations around the country, which “partners with insurers and law enforcement agencies to facilitate the identification, detection, and prosecution of insurance criminals.” The revelation has certainly raised some eyebrows, but the NICB now says that while insurance companies are members of the organization, they do not automatically gain access to the LPR data. Roger Morris, the NICB’s chief communications officer, clarified by e-mail that only authorized “Special Investigations Units” personnel from NICB member companies have access to such data “for theft prevention activities.” Every 24 hours, the NICB receives an electronic data transfer from all border stations, providing LPR details on all cars that have crossed in and out of the country. Mainly, the NICB says it’s looking for cars that have been (possibly fraudulently) reported stolen, but were spotted at a border. Morris added that the CPB’s LPR data—”roughly 15 million reads a month”—is kept for 12 months. That means the CBP makes approximately 500,000 LPR reads at the borders every single day, and passes that data along to the NICB. The MOU also allows the NICB to sub-contract management of this data to a “data processing service,” and requires that any misuse of the LPR data be reported to the NICB, and then reported on to the CBP. “In short, US Customs is granting a private company access to what it admits is ‘highly sensitive commercial, financial, and proprietary information,’ and then further allowing the private company to outsource the management of that ‘highly sensitive’ data to yet another private company,” wrote the ACLU Massachusetts. “The only auditing and accountability mechanisms required are self-policing and self-reporting. These documents reveal a growing problem that extends far beyond the management of license plate data. The government is increasingly collecting vast quantities of information about ordinary people accused of no crime, and increasingly it is relying on private contractors to manage, sort, and analyze this data looking for crime or even ‘pre-crime’ trends. The sharing of our license plate data with private companies should be viewed as but one troubling example of this much larger problem.” [Source]

US – Dealer uses MPLS License Plate Data in Car Repo

A South St. Paul car dealer used data stored by Minneapolis police license plate scanners to repossess a car, likely the first time the records have been used by a business in Minnesota. The data’s value for a repo man illustrates just one of the potential applications of Minneapolis’ massive database chronicling patterns of vehicles on its streets. Some privacy advocates fear that data could eventually be used for more sinister purposes. Minneapolis deploys 10 license plate readers, eight of them mounted on police cars and traffic enforcement vehicles, that scan thousands of license plates each day and store their locations – 4.9 million so far in 2012. Their primary use is to help police on patrol identify wanted vehicles in real time. [Source]

US – 6 Years of Spying on NY Muslims Didn’t Generate a Single Terror Lead: NYPD

In more than six years of spying on Muslim neighbourhoods, eavesdropping on conversations and cataloguing mosques, a secret unit of the NYPD never generated a lead or triggered a terrorism investigation, the department acknowledged in court testimony. The demographics unit is at the heart of a police spying program, built with help from the CIA, which assembled databases on where Muslims lived, shopped, worked and prayed. Police infiltrated Muslim student groups, put informants in mosques, monitored sermons and catalogued every Muslim in New York who adopted new, Americanized surnames. Police hoped the unit would serve as an early warning system for terrorism. And if police ever got a tip about, say, an Afghan terrorist in the city, they would know where he was likely to rent a room, buy groceries and watch sports. But in a June 28 deposition as part of a long-standing federal civil rights case, Assistant Chief Thomas Galati said none of the conversations the officers overheard ever led to a case. [The National Post]

Location

US – Location Privacy Act Passed in California

California state legislators have passed a new bill requiring law enforcement agencies to obtain a warrant before collecting any GPS or location data from cell phones or smart phones. The Location Privacy Bill 2012, which was sponsored by the EFF and the ACLU, has now been passed on to California Governor Jerry Brown for signing into law. In a statement the EFF said it “urge[s] Governor Brown to have California take the lead on this issue and sign SB 1434,” and that it “strikes a sensible balance between keeping the public safe and preserving our privacy.” Brown vetoed a similar initiative in 2011, however. Earlier this week, California passed a bill protecting students from having to provide access to their social media accounts. [ZDNet] [ArsTechnica]

US – Missouri Tracking Law Challenged in Court

A new cellphone tracking law recently passed in Missouri is being challenged in court on assertions that it conflicts with federal law. Missouri’s law makes it easier for police to track users’ cellphone locations in cases of emergency. According to a lawsuit filed Monday, the law should be overturned under the supremacy clause of the U.S. Constitution. The suit seeks a restraining order or injunction and class-action status, the report states. The attorney who filed the suit said, “If I take my cellphone to California, I have more rights. If I use my cellphone in Missouri, I have less rights. So really it comes down to a privacy issue.” [Associated Press]

Offshore

IN – India Pushes Sites to Remove ‘Inflammatory’ Content

India pressed social media websites including Facebook and Twitter on to remove “inflammatory” content it said helped spread rumors that caused an exodus of migrants from some cities. The government said in a statement it had already blocked access to 245 web pages it said contained doctored videos and images, and the telecommunications secretary, R Chandrashekhar, threatened legal action against the websites if they did not fully comply with the requests to take down the offending pages. [Reuters]

Online Privacy

US – Advocates Ask FTC to Investigate; FTC Extends COPPA Deadline

A group of advocacy organizations has asked the Federal Trade Commission (FTC) to investigate several viral campaigns aimed at children. The Center for Democracy & Technology—along with 16 advocacy groups—has sent a letter to the FTC with five complaints about the campaigns alleging they violate COPPA. “Such tell-a-friend campaigns, a powerful form of word-of-mouth marketing traditionally directed at teens and adults, are inherently unfair and deceptive when aimed at children,” the complaint states, noting, “The practices also violate existing privacy laws for children.” Meanwhile, the FTC announced it is extending the deadline for public comment on proposed modifications to COPPA. [ZDNet]

US – Child Advocates Ask FTC to Investigate Viral Marketing Aimed at Kids

A coalition of nearly 20 children’s advocacy, health and public interest groups focused on children’s health and privacy have asked the US Federal Trade Commission (FTC) to investigate online viral advertising programs that exploit commercial appeal to children. The groups say that the “tell-a-friend” features used by McDonald’s, General Mills, Turner Broadcasting and other companies violates the Children’s Online Privacy Protection Act (COPPA), which became law in 2000, because the actions are taken without adequate parental notification and without parental consent. Georgetown law professor and legal counsel for the Center for Digital Democracy said that the FTC should put an end to the “commercial exploitation of children.” [WIRED] [CNET] [MSNBC] [New York Times]

US – Judge Rejects Facebook Sponsored Stories Proposed Lawsuit Settlement

A US District Court judge in California has rejected the proposed settlement of a lawsuit brought against Facebook over its Sponsored Stories feature. The lawsuit was filed by five Facebook users and is seeking class action status on behalf of as many as 100 million users; it alleges that Facebook violated users’ rights by using their images in Sponsored Stories. The settlement would allow adults to limit how their images are used in Sponsored Stories; minors would be able to opt out altogether. The settlement would have Facebook change its Statement of Rights and Responsibilities and provide users with more information about how their names and pictures are used with Sponsored Stories. The settlement would also give users more control over their data. The proposed settlement would have Facebook pay US $10 million to Internet privacy organizations and to pay attorney’s fees of up to US $10 million. Judge Richard Seeborg said he had “serious concerns” about the settlement, asking why Facebook should not be asked to pay US $100 million, because it seemed as though the legal team was making money on the case, but the users they were representing were not receiving much in return. [WIRED] [ComputerWorld] See also: [Facebook cleanses pages of fraudulent “Likes”]

EU – Consumer Group Tells Facebook to Fix App Centre

The Federation of German Consumer Organizations “believes Facebook is violating privacy laws with its new app center and has set a deadline for the social network…to fix it or potentially face legal action.” The group contends the app center gives third-party applications users’ information without their knowledge. “It will consider legal action against Facebook if the site fails to fix the problem by September 4,” the report states, noting the deadline follows plans by Hamburg’s data protection commissioner to “reopen his investigation into Facebook’s policies on tagging photos, retaining and deleting data and the level of control users have over their information.” [Reuters]

US – Twitter Appeals Court Decision

Twitter has filed an appeal with the New York State Supreme Court to overrule a lower court order for the company to disclose an Occupy Wall Street protester’s tweets. The American Civil Liberties Union has filed a brief in support of the company, saying, “We are hopeful that Twitter’s appeal will overturn the criminal court’s dangerous decision and reaffirm that we retain our constitutional rights to speech and privacy online as well as offline.” [The Hill] [Twitter and your privacy] [Expert: Case Shows “Privacy Is Big Business”]

WW – Your Old Tweets Resurface with Twitter’s Data Reseller Partners

Twitter has announced its Certified Partners Program. There are currently 12 partners in the program, and they specialize in one of three categories: engagement, analytics, and data resellers. Twitter says that the certifications will “make it easier for businesses to find the right tools.” Three of the 12 partner companies–Topsy, DataSift, and Gnip–are data resellers, which means they provide access to all publicly available tweet content over several years (what Twitter calls the “Firehose”). Before data resellers like these existed, your old tweets–even public ones–would become buried as you continued to pile new ones on top of them. They’d be inaccessible after 30 days. Now, companies like DataSift have unlocked this previously inaccessible archive of every Tweet ever made in the past several years. The company collects about 250 million tweets every day, analyzing the things people talk about, the words they use, their geographic location, and even whether their tone seems negative or positive. Aside from leaving Twitter altogether, there are two ways to protect yourself from Twitter’s data resellers. 1. Go back and delete old tweets: Unlike when you’re looking for someone else’s Tweets, you can always see your own without any expiration date. DataSift is required to regularly update its files to remove Tweets that have since been deleted. 2. Set your tweets to private by protecting them: Protected tweets aren’t part of Twitter’s public stream and data resellers can’t collect them. You’ll know that a user’s Tweets are protected when you see a little lock icon next to their avatar. [Source] [Comment from PogoWasRight] See also: [DIGITAL WILL: How to share your data after death]

US – Social Media Privacy for College Athletes? California Senate Says Yes

California’s Senate has unanimously approved legislation to bar colleges and universities from requiring students to provide administrators with access to their social media usernames and passwords. Governor Jerry Brown now must sign or veto the bill by Sept. 30. California is not the first state to pass legislation protecting social media privacy for students. In March, Maryland’s Senate passed a bill to prevent public colleges and universities in the state from requiring students including athletes to provide access to their social accounts. [Source]

Other Jurisdictions

PH – Data Privacy Law Signed

President Benigno Aquino has signed the Data Privacy Act 2012. The bill is also known as “An Act Protecting Individual Information in Information and Communication Systems in the Government and the Private Sector.” The bill is based on the European Directive and requires data security standards by business process outsourcers. The president did not veto any of the bill’s provisions, the report states. Some lawmakers have said the law will spur investment in the Philippines. [ABS-CBN News] [GovInfoSecurity] [Philippines: BPO companies more bullish after signing of data privacy law] see also: [Rwanda: Proposed Communications Intercept Law – Is Our Privacy Adequately Protected?]

CN – Cabinet OKs Draft Data Protection Bill Changes

China’s Executive Yuan has approved draft legislation that seeks to make improvements on a 2010 amendment to the Personal Data Protection Act. The proposed changes would require data collectors to inform consumers prior to processing such data. The bill will go before the Legislature Yuan for final approval, the report states. [The China Post]

AU – ACC Report Issued, Commissioner Urges Culture Change

An independent report on New Zealand’s Accident Compensation Corportation (ACC) has revealed that a data breach was due to “human error” but also “systemic weaknesses within ACC’s culture, systems and processes.” Commissioned by New Zealand Privacy Commissioner Marie Shroff, the Independent Review of ACC’s Privacy and Security Information was undertaken by KPMG and former Australian Privacy Commissioner Malcolm Crompton. Shroff said the ACC “has elements of privacy protection and security” in place, but they “are not up to the standard expected” of such an organization, adding, a “culture change” will be necessary, starting “right at the top.” Meanwhile, State Services Commissioner Iain Rennie urged vigilance by public servants processing personal data. [Press Release] [Report]

Privacy (US)

US – Magistrate Says Video Privacy Law Applies to Digital Content

A US federal magistrate has ruled that information collected about which videos people watch online is protected under US privacy law, possibly putting Hulu on the spot for sharing users’ viewing habits with third parties. US Magistrate Laurel Beeler ruled that the Video Privacy Protection Act of 1988 applies to Hulu. Hulu argued, unsuccessfully, that the law applies only to video rental stores not video streaming services. Beeler wrote that, despite Hulu’s assertion that the VPPA does not specifically cover digital distribution, “Given Congress’s concern with protecting consumers’ privacy in an evolving technological world, the court rejects that argument.” [WIRED]

US – Administrative Subpoenas Raise Questions

Administrative subpoenas, which carry the signature of a federal official but not that of a judge, require telecommunications companies, Internet service providers, banks, bookstores, hospitals, and utility companies in the US to “turn over” customer records if the US Drug Enforcement Administration (DEA) or agents from other government departments believe the information is relevant to an investigation. The DEA obtained the power through a piece of 1970 legislation; that agency is believed to be one of the major users of administrative subpoenas. A DEA spokesperson said that the agency does not keep a database of the administrative subpoenas it issues. There are reportedly more than 300 US statutes that allow federal officials to bypass Fourth Amendment protections by issuing these subpoenas; government agencies are not obligated to disclose the frequency with which they use administrative subpoenas. Administrative subpoenas can be issued not only for drug investigations, but also for hazardous waste disposal, atomic energy, child exploitation, medical insurance fraud, student loans, and other investigations. [WIRED]

US – 2012 Republican Convention: GOP adopts Internet freedom plank

Part of the platform the Republican party adopted included language to protect Internet freedom, something that lawmakers and interest groups on both sides of the aisle have been calling for in recent months. The Republican plank is focused on removing regulation around technology businesses, as well as language that would protect personal data online from the government. The platform language also says that the party will “resist any effort” to move Internet governance away from its current multi-stakeholder model in favor of international or “intergovernmental” organizations. There has been some discussion of handing more control of the Web to the United Nations, as reported in May. The proposal is being championed by China, Russia and some Arab states but has gathered vocal critics from technology companies such as Google, Microsoft, Verizon and Cisco, who say such a plan would create financial risks to their businesses. The GOP platform also specifically criticized the Federal Communications Commission, saying that the agency’s net neutrality rule and other regulations show the Obama administration is “frozen in the past.” The platform proposes that the federal government inventory its spectrum to discover how much of it could be auctioned to the public. [Source]

US – Privacy Worries Surround UN Internet Regs

“What would online privacy look like if the United Nations (UN) regulated the Internet?” queries Mathew J. Schwartz. “That’s one question on the minds of privacy advocates as the International Telecommunications Union—a UN agency based in Geneva, Switzerland, that regulated telecommunications and IT issues—approaches the task of helping the UN decide if it should exert more control over Internet governance,” Schwartz writes. According to the report, some proposals “have technologists and—at least in the United States—legislators up in arms, leading to allegations that the renegotiated treaty could allow countries such as China and Russia to more easily censor the Internet.” [Privacy worries surround UN Internet regulations]

US – Sens. Call on Obama to Issue Cybersecurity Order

At least two senators have called on the Obama administration to issue an Executive Order on cybersecurity after Congress failed to pass legislation on the issue. In an open letter to the White House, Sen. Diane Feinstein (D-CA) wrote, “our critical infrastructure, our financial hubs and our ability to defend the nation are at risk; we must take action to address these vulnerabilities as soon as possible.” Feinstein did note that the administration does not have power to offer legal certainty or protection to firms that share cybersecurity data with the government, the report states. Meanwhile, some experts say impending cybersecurity initiatives further prompt the need for the Privacy and Civil Liberties Oversight Board. [Hogan Lovells’ Chronicle of Data Protection]

US – SEC Cyber-Disclosure Guidance Becoming Standard

The Securities and Exchange Commission (SEC) cyber-disclosure guidance has “become de facto rules for at least six companies” including Google and Amazon. According to letters sent by the SEC, the companies were asked to, in future filings, disclose to investors if systems had undergone a cyberattack. Companies have expressed concerns that such admissions can hurt reputations, provide competitors with important information or give rise to consumer litigation, the report states. In its deliberations on cybersecurity legislation, Congress has assessed ways to encourage firms to disclose data breaches, including a voluntary reporting system. [Bloomberg]

US – CA PUC Approves Gas Meter Privacy Protections

The California Public Utilities Commission has unanimously agreed to new rules governing the protection and use of consumers’ data captured from gas meters. Two commissioners described the protections as being balanced, enabling both consumer protections and the “responsible use of consumer information,” according to the report. The rules allow covered entities certain rights around the collection, use and disclosure of the data. [Solid State Technology] [US – As Smart Grid Grows, Privacy Concerns Proliferate]

Privacy Enhancing Technologies (PETs)

WW – Researchers Hack Brainwaves to Reveal PIN Numbers, Other Personal Data

A team of security researchers from Oxford, UC Berkeley, and the University of Geneva say that they were able to deduce digits of PIN numbers, birth months, areas of residence and other personal information by presenting 30 headset-wearing subjects with images of ATM machines, debit cards, maps, people, and random numbers in a series of experiments. The paper, titled “On the Feasibility of Side-Channel Attacks with Brain Computer Interfaces,” represents the first major attempt to uncover potential security risks in the use of the headsets. “The correct answer was found by the first guess in 20% of the cases for the experiment with the PIN, the debit cards, people, and the ATM machine,” write the researchers. “The location was exactly guessed for 30% of users, month of birth for almost 60% and the bank based on the ATM machines for almost 30%.” To detect the first digit of the PIN, researchers presented the subjects with numbers from 0 to 9, flashing on the screen in random order, one by one. Each number was repeated 16 times, over a total duration of 90 seconds. The subjects’ brainwaves were monitored for telltale peaks that would rat them out. The EEG headsets, made by companies such as Emotiv Systems and NeuroSky, have become increasingly popular for gaming and other applications. [Source]

RFID

TX – Rebellion Erupts Over School’s Student-Chipping Plan

A rebellion is developing in Texas against a plan by a school district in San Antonio that would monitor the exact location and activities of all students at all times through RFID chips they are being ordered to wear. School district officials did not respond to a request for comment, but the developing furor comes only days after a coalition of civil rights and privacy organizations publicly stated their opposition to “spychipping” the students. A “position paper” from groups including the American Civil Liberties Union, Electronic Frontier Foundation, Big Brother Watch, Citizens’ Council for Health Freedom, Constitutional Alliance, Freedom Force International, Friends of Privacy USA, the Identity Project and Privacy Activism said no students should be subjected to the “chipping” program “unless there is sufficient evidence of its safety and effectiveness.” “Children should never be used as test subjects for technology, no matter what their socio-economic status. If schools choose to move forward without complete information and are willing to accept the associated liability, they should have provisions in place to adhere to the principles of fair information practices and respect individuals’ rights to opt out based on their conscientious and religious objections,” the statement said. The paper said RFID tracking is dehumanizing, since it can “monitor how long a student or teacher spends in a bathroom stall.” The plans also violate free speech and association, since the presence of a tracking device “could dissuade individuals from exercising their rights to freedom of thought, speech and association. For example, students might avoid seeking counsel when they know their RFID tags will document their presence at locations like counselor and School Resource Officer offices.” It argued that the technology also violates religious freedom and could be subject to unauthorized use. “While RFID systems may be developed for use in a school, the RFID tags may be read covertly anywhere by anyone with the right reading device. Since RFID reading devices work by silent, invisible radio waves and the reading devices can be hidden, unauthorized or covert uses can be nearly impossible to detect,” the report said. “A student’s location could be monitored from a distance by a jealous girlfriend or boyfriend, stalker, or pedophile.” [Source]

Security

US – Data Security Now a Main Concern for US Boardrooms: Survey

An annual survey of 11,000 public company directors and 2,000 general counsels shows that for the first time data security is now a prime concern for US boards. The survey, conducted by advisory firms Corporate Board Member and FTI Consulting, shows that over half (55%) of general counsels surveyed rate data security as a major concern while 48% of the directors surveyed felt the same. A similar survey in 2008 found that only 25% of directors and 23% of general counsel noted data security as a high area of concern, which reflects a doubling of this concern in four years. TK Kerstetter, President, Corporate Board Member said about the results “While a number of companies are taking steps to become more educated on IT risks, the fact is that not enough are taking the appropriate actions to fully prepare their organization.” He went on to say “I think it is going to take several well-publicized security breaches before a majority of corporate boards finally embrace the fact that doing business today without a prudent crisis plan in place is a formula for disaster.” [ComputerWorldUK] [Yahoo!]

Surveillance

WW – Researchers Find Spyware Being Used by Police in Countries Around the World

Researchers have found evidence suggesting that governments in several countries around the world are using spyware sold by UK company Gamma International. The spyware, known as FinSpy, can monitor calls and report back about calls and GPS location; record Skype sessions on PCs; log keystrokes; and take control of cameras and microphones. The researchers found the spyware while investigating email attachments sent to Bahraini activists. FinSpy can infect PCs and “a broad range of smartphones.” Research conducted elsewhere found FinSpy command-and-control servers in Indonesia, Australia, Qatar, Ethiopia, the Czech Republic, Estonia, Mongolia, Latvia, UAE, as well as one in the US running on Amazon cloud systems. Shortly after the research was published, several of those servers were shut down. [The Register] [Source] [Software Meant to Fight Crime Is Used to Spy on Dissidents]

UK – Surveillance Device Uses Wi-Fi to See Through Walls

Researchers in England have created a prototype surveillance device that can be used to spy on people inside buildings and behind walls by tracking the frequency changes as Wi-Fi signals generated by wireless routers and access points bounce off people as they move around. The device, which is about the size of a suitcase and has two antennae and a signal processing unit, works as a “passive radar system” that can “see” through walls, according to PopSci.com. It was able to successfully determine the location, speed, and direction of a person behind a one-foot-thick brick wall, but cannot detect people standing or sitting still, the article said. The U.K. Ministry of Defence is looking into whether the device — designed by Karl Woodbridge and Kevin Chetty of the University of College London — can be used in “urban warfare” for scanning buildings, PopSci reported. The paper on the research, “Through-the-Wall Sensing of Personnel Using Passive Bistatic WiFi Radar at Standoff Distances,” appeared in the April issue of iGeoscience and Remote Sensing, IEEE Transactions. [Source]

Telecom / TV

AU – Telstra Charges Crime Victims for Privacy

Consumer advocates have called for Australia’s largest telecommunications provider to stop charging victims of crime to keep their addresses out of the public phone directory. Both Choice and the Australian Communications Consumer Action Network have criticised Telstra for charging a monthly fee for silent home phone numbers, even though the Australian Law Review Commission recommended the law be changed to stop carriers charging for the service. Despite the recommendation, the law has not been changed and Telstra charges users $2.93 monthly to keep numbers out of the White Pages. ACCAN spokeswoman Elise Davidson said the ongoing fee was an “unfair practice” that affected the country’s most at-risk telephone users. [Source]

AU – Tax Office Wants Access to Real-Time Data

The Australian Tax Office (ATO) is asking for changes to the nation’s phone-tapping laws so investigators can intercept data in real time. The office has access to stored communications such as voice mail, e-mail and SMS messages under the Telecommunications (Interception and Access) Act 1979, the report states. “Access to real-time telecommunications data would enable our investigators to quickly identify those involved in suspected fraud, establish an association between two or more people, prove that two or more people have communicated at a particular time and by what means or show that a person was at a location at a particular time,” said the ATO. [iTnews]

US Government Programs

US – White House Considering Establishing Cyberthreat Information Sharing Program

A draft document circulating in the White House suggests that the President may be considering a new program that would protect government and private industry computer networks that are part of the country’s critical infrastructure from cyberattacks. The program would call for the government to establish a continuous threat collection and information dissemination system. The program is being considered in lieu of legislation, as lawmakers have been unable to come to any agreement on a cybersecurity bill. The draft “is not close to being done,” according to a White House spokesperson. The document indicates that the program would aim for “a near-real-time common operating picture” for critical infrastructure threats and establish “strong cooperation” between government and private sector entities. [Business Week]

US – Interior Dept. Seeking Cloud Tool Capable of Wiping Mobile Devices Remotely

The US Department of the Interior has issued a request for information (RFI) seeking a tool that would allow the agency to remotely update, monitor, shut down, or wipe employees’ mobile devices, even when they are overseas. The product sought would have to work on Apple, Android, BlackBerry and Windows mobile devices; the agency prefers cloud-based tools. Just one compromised device could infect other portions of the department’s computer systems. A 2011 study from the Government Accountability Office (GAO) noted that the Interior Department had not put in place “effective controls to prevent, limit, and detect unauthorized access to its systems” nor had it “manage[d] the configuration of network devices to prevent unauthorized access and ensure system integrity.” The RFI wants tools that can determine when a mobile device is being compromised. The Interior Department is seeking to have proposals submitted by September 7, 2012. [FCW] [NextGov] [FBO]

US Legislation

US – Bills to Watch

In California, Assembly Member Fuentes’ bill (A 2055) continues its progress through the California Senate and is now on the consent calendar. The Bill contemplates allowing a search warrant to be issued when the information to be received from the use of a tracking device constitutes evidence that tends to show: a felony has been committed or is being committed; that a particular person has committed a felony or is committing a felony; or will assist in locating an individual that has committed or is committing a felony. As proposed, the bill requires that a search warrant identify the person or property to be tracked and limits the time that the device may be used to a specified number of days. The bill also requires execution of the warrant within 10 days.

Likewise, Senator Leland Yee’s Social Media Privacy Act (S 1349) has progressed to the Assembly’s consent calendar. The bill would prohibit a postsecondary educational institution from requiring, or from formally requesting in writing that a student or prospective student disclose the user name and account password for a personal social media account, or provide the institution with access to any content of that account.

In Michigan, Sen. Richard Jones introduced a bill (S 1228) that would create a Do Not Call list for political calls. “Robo calls are disruptive, and they always seem to come at dinnertime or in the middle of a ball game” said Jones “If a candidate or volunteer wants to contact a voter directly, this measure will not prevent them from doing so. This legislation simply gives citizens a choice whether or not they want to receive automated phone calls.”

In New York, two bills previously reported as awaiting signature have now been enacted. A 8992 prohibits non-governmental entities from requiring individuals to provide their social security number, unless for one of several designated purposes. And A 10569 prohibits telemarketers – regardless of where they are located – from delivering pre-recorded messages by telephone without the consent of the recipient. In addition, this measure will require outbound, pre-recorded sales calls to provide the recipient with a key-press or interactive voice response to be placed on the “do not call” list, as well as immediately disconnect the call. In the event of a voicemail, outbound sales calls will also have to deliver a message with a toll free number for recipients to call to have their names removed from the call list.

In the United States Senate, Senator Johanns of Nebraska introduced a bill (S 3467), which would enact a moratorium on aerial surveillance conducted by the Administrator of the Environmental Protection Agency. The EPA currently uses these flights to determine compliance with the Clean Water Act.

Workplace Privacy

CH – Former Swiss Bank Employee Arrested in Connection with Customer Data Leak

An employee at a private Swiss bank has been arrested for allegedly stealing data from the institution. An internal investigation turned up evidence of data abuse and an alleged perpetrator was identified. The suspect is a Zurich-based employee of the Julius Baer bank; he has been fired and was subsequently arrested. The bank has contacted customers in Germany who may have been affected by the incident. The stolen data were found on a CD that is now in the possession of German tax investigators. A German magazine recently reported that tax investigators raided the homes of several Julius Baer clients in Germany in connection with allegations of untaxed funds being held in Swiss bank accounts. [Bloomberg] [Swissinfo]

CH – Data Disclosure Angers Swiss Bank Employees

Employees at several Swiss-based banks have expressed disapproval over the disclosure of their personal information to U.S. authorities investigating American tax evaders, The Wall Street Journal reports. In some cases, employees were not told of the handover or were told but not allowed to review the data. The Swiss government, in order to avoid an indictment of its banks, allowed banks to share data of thousands of employees with the U.S. Department of Justice. A Zurich University professor said, “The Swiss should offer whatever help is required for the U.S. to track down tax dodgers, but they should make clear that they will do so within the country’s legal framework.” [Wall Street Journal]

+++